Safe starting method and device of vehicle-mounted controller, electronic equipment and storage medium

Abstract

The invention discloses a safe starting method and device of a vehicle-mounted controller, electronic equipment and a storage medium, and relates to the technical field of vehicle information security, and the safe starting method comprises the steps that after the controller is reset and powered on, a first processing core and a second processing core are started synchronously; the second processing core comprises an intermediary bootstrap program, and the second processing core issues an execution instruction to the first processing core to guide the first processing core to run the intermediary bootstrap program; the first processing core sends a start configuration query request to the second processing core; the first processing core sends a code verification request to the second processing core, the second processing core asynchronously executes verification operation according to a code segment division sequence to generate a verification result of each code segment, compares the verification result with a corresponding verification reference value, and stores a comparison result in a preset state storage unit; the first processing core starts the boot loader segment, queries a comparison result of the code segment, and skips to the functional application program segment if verification is passed; and inquiring a self comparison result, and stopping running if verification fails.

Description

Technical Field

[0001] This invention relates to the field of vehicle information security technology, and in particular to a secure startup method for an onboard controller, a secure startup device for an onboard controller, an electronic device, and a storage medium. Background Technology

[0002] Secure boot methods refer to establishing a trusted boot process, booting the system with an immutable sequence, and using trust chains and cryptographic authentication methods to verify the authenticity of the software involved in the boot sequence. This prevents any unauthorized or maliciously modified software from running on the device. Currently, secure boot methods for controllers both domestically and internationally employ symmetric or asymmetric algorithms to perform integrity checks on the bootloader, application software, and calibration data within the controller. Boot loading only proceeds after all three have passed the checks.

[0003] For example, a Chinese patent, titled "A Secure Boot Method and Device for an In-Vehicle MCU," application number CN115422545A, discloses a secure boot method and device for an in-vehicle MCU using a symmetric key algorithm and utilizing a built-in HSM or an external security chip. The secure boot method for the in-vehicle MCU is described as follows: the Bootrom obtains the starting address of a second security verification module and starts the second security verification module; the second security verification module uses a first security verification module to verify the authenticity and integrity of the BootLoader, obtaining a second result; the secure boot module in the BootLoader uses the first security verification module to verify the authenticity and integrity of the APP to be launched, obtaining a third result; wherein, the feasibility of the second security verification module is higher than that of the third security verification module; if the second and third results pass verification one by one, the software is launched; if any result fails, the process terminates immediately.

[0004] The aforementioned patents ensure that the code loaded or executed after the device starts up is trustworthy, thus guaranteeing the security and integrity of the firmware. However, introducing secure boot into the controller startup process increases the complexity of the controller state management system and the consumption of time and resources. Summary of the Invention

[0005] In view of this, the purpose of the present invention is to provide a safe startup method for an on-board controller, a safe startup device for an on-board controller, an electronic device and a storage medium, aiming to provide a safe startup method for the controller that, while ensuring the integrity and security of the running program and data, shortens the startup time and improves the system response speed.

[0006] This invention provides the following solution:

[0007] According to one aspect of the present invention, a safe startup method for an on-board controller is provided, comprising the following steps:

[0008] After the controller is reset and powered on, the first processing core and the second processing core start up synchronously;

[0009] After the first processing core executes the initial code and completes the underlying hardware initialization, it enters a waiting scheduling state.

[0010] The second processing core prepares the execution environment for the first processing core. The second processing core includes an intermediate bootloader, which is copied to a designated memory area of ​​the first processing core after its integrity is verified.

[0011] The second processing core sends an execution instruction to the first processing core, guiding the first processing core to run the intermediate boot program;

[0012] The first processing core sends a startup configuration query request to the second processing core;

[0013] Obtain startup configuration information, which includes the division information of the code segment to be verified, the verification benchmark value corresponding to each code segment, the number of code segments, and the verification key information;

[0014] The code segment to be verified includes at least the bootloader segment and the functional application segment;

[0015] The first processing core sends a code verification request to the second processing core. The second processing core performs the verification operation asynchronously according to the code segment division order, generates the verification result of each code segment, compares it with the corresponding verification benchmark value, and stores the comparison result in the preset state storage unit.

[0016] The first processing core starts the bootloader segment, queries the comparison result of the code segment, and if the verification is successful, it jumps to the functional application segment;

[0017] The functional application segment queries its own comparison results through the intermediary bootstrap program. If the verification passes, the functional application starts to execute the core control logic; if the verification fails, it stops running.

[0018] Furthermore, including:

[0019] While the second processing core performs asynchronous verification, the first processing core synchronously performs hardware self-test, function self-test, and dual-core clock synchronization configuration.

[0020] Furthermore, the segmentation information of the code segment to be verified includes: measurement segment information;

[0021] The verification benchmark values ​​for each code segment include the verification values ​​for the measurement segment;

[0022] The number of code segments includes: the number of metric segments;

[0023] The verification key information includes: the authentication key handle.

[0024] Furthermore, including:

[0025] The number of metric segments must include at least the first metric segment and the second metric segment;

[0026] The first measurement code segment is the bootloader segment, and the second measurement code segment is the functional application segment.

[0027] Furthermore, including:

[0028] The checksum value of the measurement segment is the CMAC value of each code segment;

[0029] The second processing core uses a symmetric encryption algorithm to perform verification operations, and the verification key information is stored in the second processing core through the authentication key handle.

[0030] Furthermore, including:

[0031] The intermediate bootloader is stored in the secure Flash area of ​​the second processing core and is booted by the second processing core into the RAM of the first processing core for execution;

[0032] The intermediate bootloader is used to enable interaction between the first and second processing cores during the secure boot process.

[0033] Furthermore, including:

[0034] When the controller starts up for the first time, the BootConfig program is run to store the hardened key to the second processing core. Then, the second processing core is requested to calculate the CMAC value of the bootloader segment and the functional application segment and store it in the verification base value storage area. After the key injection and verification base value pre-configuration are completed, the controller is reset and the secure boot process is started.

[0035] According to a second aspect of the present invention, a safe start device for an on-board controller is provided, comprising:

[0036] Initialization module, copy verification module, query startup module, and code verification module;

[0037] The initialization module is used to synchronously start the first and second processing cores after the controller is reset and powered on.

[0038] After executing the initial code and completing the underlying hardware initialization, it enters a waiting-for-scheduling state.

[0039] The verification copy module is used to prepare the execution environment of the first processing core. The second processing core includes an intermediate bootloader. After verifying its integrity, it is copied to a designated memory area of ​​the first processing core.

[0040] The second processing core sends an execution instruction to the first processing core, guiding the first processing core to run the intermediate boot program;

[0041] The startup query module is used to send a startup configuration query request to the second processing core;

[0042] Obtain startup configuration information, which includes the division information of the code segment to be verified, the verification benchmark value corresponding to each code segment, the number of code segments, and the verification key information;

[0043] The code segment to be verified includes at least the bootloader segment and the functional application segment;

[0044] The code verification module is used to send code verification requests to the second processing core. The second processing core asynchronously performs verification operations according to the code segment division order, generates verification results for each code segment, compares them with the corresponding verification benchmark values, and stores the comparison results in the preset state storage unit.

[0045] The first processing core starts the bootloader segment, queries the comparison result of the code segment, and if the verification is successful, it jumps to the functional application segment;

[0046] The functional application segment queries its own comparison results through the intermediary bootstrap program. If the verification passes, the functional application starts to execute the core control logic; if the verification fails, it stops running.

[0047] According to three aspects of the present invention, an electronic device is provided, comprising: a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;

[0048] The memory stores a computer program, which, when executed by a processor, causes the processor to perform the steps of a safe startup method for an onboard controller.

[0049] According to four aspects of the present invention, a computer-readable storage medium is provided that stores a computer program executable by an electronic device, which, when run on the electronic device, causes the electronic device to perform the steps of a safe startup method for an on-board controller.

[0050] Compared with the prior art, the present invention has the following advantages:

[0051] This application protects the system from attacks by implementing safe startup measures in the electric drive controller to prevent malicious loading of illegal code during system startup. It employs a design that uses synchronous startup of the main core and HSM core, along with asynchronous verification code segments, replacing the traditional serial verification method with parallel processing. This significantly shortens the safe startup verification time and improves system response speed. Attached Figure Description

[0052] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0053] Figure 1 This is a flowchart of a safe startup method for an on-board controller provided by one or more embodiments of the present invention.

[0054] Figure 2 This is a structural diagram of a safe start device for an on-board controller provided in one or more embodiments of the present invention.

[0055] Figure 3 This is a schematic diagram of the main core running Flash area according to a specific embodiment of the present invention.

[0056] Figure 4 This is a schematic diagram of the HSM core running Flash region according to a specific embodiment of the present invention.

[0057] Figure 5 This is a schematic diagram of the controller's initial startup process according to a specific embodiment of the present invention.

[0058] Figure 6 This is a detailed schematic diagram of the safe startup process after controller reset according to a specific embodiment of the present invention.

[0059] Figure 7 This is an electronic device structural block diagram of a safe startup method for an on-board controller provided by one or more embodiments of the present invention. Detailed Implementation

[0060] The technical solution of the present invention will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0061] The terminology used in the embodiments of this application is for the purpose of describing particular embodiments only and is not intended to limit the application. The singular forms “a,” “said,” and “the” used in the embodiments of this application and the appended claims are also intended to include the plural forms, and “multiple” generally includes at least two unless the context clearly indicates otherwise.

[0062] It should be understood that the term "and / or" used in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0063] It should be understood that although the terms first, second, third, etc., may be used in the embodiments of this application, these descriptions should not be limited to these terms. These terms are only used to distinguish the descriptions. For example, first may also be referred to as second without departing from the scope of the embodiments of this application, and similarly, second may also be referred to as first.

[0064] Depending on the context, the words “if” or “suppose” as used here can be interpreted as “when” or “in response to determination” or “in response to detection.” Similarly, depending on the context, the phrases “if determination” or “if detection (of the stated condition or event)” can be interpreted as “when determination” or “in response to determination” or “when detection (of the stated condition or event)” or “in response to detection (of the stated condition or event).”

[0065] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that an article or device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such an article or device. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the article or device that includes said element.

[0066] It should be noted that any symbols and / or numbers present in the specification that are not marked in the accompanying drawings are not reference numerals.

[0067] Figure 1 This is a flowchart of a safe startup method for an on-board controller provided by one or more embodiments of the present invention.

[0068] like Figure 1 As shown, it includes the following steps:

[0069] Step S1: After the controller is reset and powered on, the first processing core and the second processing core start synchronously.

[0070] Step S2: After the first processing core executes the initial code and completes the underlying hardware initialization, it enters the waiting scheduling state.

[0071] Step S3: The second processing core prepares the execution environment for the first processing core. The second processing core includes an intermediate bootloader, which is copied to a designated memory area of ​​the first processing core after its integrity is verified.

[0072] Step S4: The second processing core sends an execution instruction to the first processing core, guiding the first processing core to run the intermediate bootstrap program;

[0073] Step S5: The first processing core sends a startup configuration query request to the second processing core;

[0074] Obtain startup configuration information, which includes the division information of the code segment to be verified, the verification benchmark value corresponding to each code segment, the number of code segments, and the verification key information;

[0075] The code segment to be verified includes at least the bootloader segment and the functional application segment;

[0076] Specifically, the segmentation information of the code segment to be verified includes: measurement segment information;

[0077] The verification benchmark values ​​for each code segment include the verification values ​​for the measurement segment;

[0078] The number of code segments includes: the number of metric segments;

[0079] The verification key information includes: the authentication key handle.

[0080] The number of metric segments must include at least the first metric segment and the second metric segment;

[0081] The first measurement code segment is the bootloader segment, and the second measurement code segment is the functional application segment.

[0082] The checksum value of the measurement segment is the CMAC value of each code segment;

[0083] The second processing core uses a symmetric encryption algorithm to perform verification operations, and the verification key information is stored in the second processing core through the authentication key handle.

[0084] Step S6: The first processing core sends a code verification request to the second processing core. The second processing core performs the verification operation asynchronously according to the code segment division order, generates the verification result of each code segment, compares it with the corresponding verification benchmark value, and stores the comparison result in the preset state storage unit.

[0085] Step S7: The first processing core starts the bootloader segment, queries the comparison result of the code segment, and if the verification is successful, it jumps to the functional application segment.

[0086] The functional application segment queries its own comparison results through the intermediary bootstrap program. If the verification passes, the functional application starts to execute the core control logic; if the verification fails, it stops running.

[0087] In one embodiment,

[0088] While the second processing core performs asynchronous verification, the first processing core synchronously performs hardware self-test, function self-test, and dual-core clock synchronization configuration.

[0089] The intermediate bootloader is stored in the secure Flash area of ​​the second processing core and is booted by the second processing core into the RAM of the first processing core for execution;

[0090] The intermediate bootloader is used to enable interaction between the first and second processing cores during the secure boot process.

[0091] In one embodiment, when the controller starts for the first time, the BootConfig program is run to store the solidified key in the second processing core. Then, the second processing core is requested to calculate the CMAC value of the bootloader segment and the functional application segment and store it in the verification benchmark value storage area. After the key injection and verification benchmark value pre-configuration are completed, the controller is reset and starts the secure boot process as described in claim 1.

[0092] Specifically, existing secure boot solutions mostly employ a "serial verification" mode, which involves completing security verification of all code before starting the main program. This results in excessively long boot times, especially in scenarios with extremely high responsiveness requirements, making it difficult to meet real-time control needs. This solution provides a secure boot method and corresponding device for domestically produced electric drive controllers that balances high security and high timeliness. While the HSM core executes code measurement, the main core simultaneously completes hardware self-tests, clock configuration, and other initialization tasks. This significantly shortens boot time and improves system response speed while ensuring the integrity of the running program and data security, adapting to the application needs of domestically produced electric drive controllers in various scenarios.

[0093] Figure 2 This is a structural diagram of a safe start device for an on-board controller provided in one or more embodiments of the present invention.

[0094] like Figure 2 As shown, it includes:

[0095] Initialization module, copy verification module, query startup module, and code verification module;

[0096] The initialization module is used to synchronously start the first and second processing cores after the controller is reset and powered on.

[0097] After executing the initial code and completing the underlying hardware initialization, it enters a waiting-for-scheduling state.

[0098] The verification copy module is used to prepare the execution environment of the first processing core. The second processing core includes an intermediate bootloader. After verifying its integrity, it is copied to a designated memory area of ​​the first processing core.

[0099] The second processing core sends an execution instruction to the first processing core, guiding the first processing core to run the intermediate boot program;

[0100] The startup query module is used to send a startup configuration query request to the second processing core;

[0101] Obtain startup configuration information, which includes the division information of the code segment to be verified, the verification benchmark value corresponding to each code segment, the number of code segments, and the verification key information;

[0102] The code segment to be verified includes at least the bootloader segment and the functional application segment;

[0103] The code verification module is used to send code verification requests to the second processing core. The second processing core asynchronously performs verification operations according to the code segment division order, generates verification results for each code segment, compares them with the corresponding verification benchmark values, and stores the comparison results in the preset state storage unit.

[0104] The first processing core starts the bootloader segment, queries the comparison result of the code segment, and if the verification is successful, it jumps to the functional application segment;

[0105] The functional application segment queries its own comparison results through the intermediary bootstrap program. If the verification passes, the functional application starts to execute the core control logic; if the verification fails, it stops running.

[0106] It is worth noting that although only some basic functional modules are disclosed in this embodiment, it does not mean that the composition of this system is limited to the above-mentioned basic functional modules. On the contrary, what this embodiment intends to express is that, based on the above-mentioned basic functional modules, those skilled in the art can arbitrarily add one or more functional modules in combination with existing technology to form an infinite number of embodiments or technical solutions. That is to say, this system is open rather than closed. The fact that this embodiment only discloses a few basic functional modules does not mean that the scope of protection of the claims of this invention is limited to the disclosed basic functional modules. At the same time, for the convenience of description, the above device is described separately according to its functions as various units and modules. Of course, in implementing this invention, the functions of each unit and module can be implemented in one or more software and / or hardware.

[0107] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0108] In one specific embodiment of the present invention, such as Figure 3 and Figure 4 As shown, the controller's storage area is divided into the main core operating area and the HSM core operating area.

[0109] The main core operating area includes a checksum storage area, a BootConfig module, a Bootloader module, and an application module.

[0110] The verification value storage area stores the CMAC values ​​of the Bootloader code segment and the application code segment. This value is generated by the BootConfig program requesting the HSM when the controller starts for the first time. During code measurement, the HSM core compares the real-time generated CMAC value with the pre-stored value in this area, and the comparison result serves as the basis for whether the program starts.

[0111] The BootConfig module starts only when the controller is first run. It is used to perform key injection, request the generation and storage of CMAC values, write relevant secure boot configurations into the HSM, and lay the foundation for subsequent secure boot.

[0112] The Bootloader module is used for downloading, updating, and launching applications. During the secure startup process, before executing download or launch functions, the code itself must undergo security verification; only after successful verification can it run.

[0113] The application module contains the core control program of the electric drive controller. During the safe startup process, after jumping to the application module, it needs to perform a security verification on its own code. Only after the verification is passed can it run.

[0114] The HSM core operating area includes the MCU secondary boot memory area and the HSM core firmware area.

[0115] The MCU secondary boot memory area stores the MCU secondary boot program, which is mainly used for interaction between the main core and the HSM core during the secure boot process. During runtime, it is copied to the RAM area by the HSM core.

[0116] The HSM core firmware area stores the core operating firmware of the HSM core, including functions such as key management, symmetric encryption algorithms, and CMAC value calculation logic. This firmware area is written during the production stage using a secure flashing tool and cannot be modified subsequently, ensuring the security of the HSM core itself.

[0117] In one embodiment, such as Figure 5 As shown, the specific steps are as follows:

[0118] 1) After the controller is powered on for the first time, the main core starts the BootConfig program and enables the HSM function at the same time;

[0119] 2) The BootConfig program stores the security key embedded in its own program into the key management area of ​​the HSM core;

[0120] 3) The BootConfig program requests the HSM core to calculate the CMAC value for the Bootloader code segment and the application code segment respectively. After the HSM core calls the security key to generate the CMAC value, it feeds back the result to the BootConfig program, which stores it in the verification value storage area in the main core Flash area.

[0121] 4) After the CMAC value is successfully stored, the BootConfig program triggers a hardware reset of the controller. After the controller is powered on again, the safe boot process begins.

[0122] In an embodiment of safe startup after controller reset, such as Figure 6 As shown, it includes the following steps:

[0123] Step 1: After the controller is reset, the main core and the HSM core start synchronously. The main core executes the initial code embedded in the ROM and waits for HSM scheduling. After the HSM core starts, it enters the HSM secondary boot and guides the HSM firmware to start.

[0124] Step 2: The HSM core begins preparing the execution environment for the main core by copying the MCU secondary boot program stored in its secure Flash to RAM;

[0125] Step 3: After the HSM core boots the MCU's secondary boot process, the HSM itself enters a low-privilege HSM service routine, waiting for requests from the main core.

[0126] Step 4: The main core runs the MCU secondary boot program and sends a "boot configuration query request" to the HSM core to obtain the information required for secure boot. The information contained in the HSM boot configuration is as follows:

[0127] 1) Measurement segment information: To improve security detection efficiency, HSM performs segmented measurement on the code. The measurement segment information contains the start address and length of each code segment. HSM calculates the CMAC value of each code segment based on this information.

[0128] 2) Verification value of metric segment: For each metric segment, the HSM core pre-generates and stores the corresponding verification value. In this invention, the CMAC value is used as the verification value.

[0129] 3) Number of measurement segments: The actual number of measurement segments used, with a maximum of 8 measurement segments. In this invention example, only two measurement segments are configured: the first segment is the Bootloader, responsible for booting the application; the second segment is the application module, which is the core control program of the electric drive controller.

[0130] 4) Authentication Key Handle: The CMAC value is generated and verified using a symmetric encryption algorithm. The authentication key handle stores the key information required by the HSM core to perform metric operations. It should be noted that the key handle does not directly store the plaintext key; instead, it stores the "index address" of the key in the key management area within the HSM core. The main core cannot obtain the plaintext key through the key handle; it can only trigger the HSM core to use this key for computation.

[0131] Step 5: The main core initiates a code measurement request to the HSM core. The HSM core then begins asynchronous measurement according to the measurement segment order (starting from the first Bootloader code segment): For each measurement segment, the HSM core reads code data from Flash, calls the authentication key to generate a real-time CMAC value, and compares it with the pre-stored checksum. The comparison result (success / failure) is first stored in the status register, and then the measurement of the next code segment continues without waiting for feedback from the main core. If a measurement segment fails during the measurement process, all subsequent remaining segments will be marked as failed.

[0132] Step Six: While the HSM core is performing asynchronous metrics, the main core continues to execute tasks such as MBIST and functional self-checks.

[0133] Step 7: Perform configuration preparation work before the main core code starts, mainly including clock synchronization settings. The main core starts to modify the clock configuration synchronously with the HSM core to ensure that the configuration of the default working clock is completed before switching user code, so as to provide a stable clock environment for subsequent program execution.

[0134] Step 8: The main core starts the first segment of measurement code—the Bootloader starts the bootloader program. After the Bootloader starts, it obtains its own signature verification result by querying the HSM measurement result register. If the measurement is successful, it proves that the Bootloader has not been tampered with and can continue to execute the boot function; if the measurement fails, it immediately terminates the operation and triggers a hardware reset to prevent an illegal Bootloader from loading subsequent programs.

[0135] Step 9: After the Bootloader code segment successfully performs the measurement, it jumps to the application code segment. The application obtains its own verification result by querying the HSM measurement result register. If the measurement is successful, the application starts running normally and executes the core logic of electric drive control; if the measurement fails, it stops running immediately to ensure that the system is in a safe state.

[0136] Figure 7 This is an electronic device structural block diagram of a safe startup method for an on-board controller provided by one or more embodiments of the present invention.

[0137] like Figure 7 As shown, this application provides an electronic device, including: a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;

[0138] The memory stores a computer program that, when executed by a processor, causes the processor to perform the steps of a safe startup method for an onboard controller.

[0139] This application also provides a computer-readable storage medium storing a computer program executable by an electronic device, which, when run on the electronic device, causes the electronic device to perform the steps of a safe startup method for an on-board controller.

[0140] For the sake of simplicity, the method embodiments are described as a series of actions. However, those skilled in the art should understand that the embodiments of the present invention are not limited to the described order of actions, because according to the embodiments of the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions involved are not necessarily essential to the embodiments of the present invention.

[0141] As can be seen from the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in various embodiments or some parts of the embodiments of this application.

[0142] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A safe start method for an on-board controller, characterized in that, Includes the following steps: After the controller is reset and powered on, the first processing core and the second processing core start up synchronously; After the first processing core executes the initial code and completes the underlying hardware initialization, it enters a waiting scheduling state. The second processing core prepares the execution environment for the first processing core. The second processing core includes an intermediate bootloader, which is copied to a designated memory area of ​​the first processing core after its integrity is verified. The second processing core sends an execution instruction to the first processing core, guiding the first processing core to run the intermediate boot program; The first processing core sends a startup configuration query request to the second processing core; Obtain startup configuration information, which includes the division information of the code segment to be verified, the verification benchmark value corresponding to each code segment, the number of code segments, and the verification key information; The code segment to be verified includes at least a bootloader segment and a functional application segment; The first processing core sends a code verification request to the second processing core. The second processing core asynchronously performs the verification operation according to the code segment division order, generates the verification result of each code segment, compares it with the corresponding verification benchmark value, and stores the comparison result in the preset state storage unit. The first processing core starts the bootloader segment, queries the comparison result of the code segment, and if the verification is successful, it jumps to the functional application segment; The functional application segment queries its own comparison results through the intermediary bootstrap program. If the verification passes, the functional application starts to execute the core control logic; if the verification fails, it stops running.

2. The safe start method for an on-board controller according to claim 1, characterized in that, While the second processing core performs asynchronous verification, the first processing core synchronously performs hardware self-test, function self-test, and dual-core clock synchronization configuration.

3. The safe start method for an on-board controller according to claim 1, characterized in that, The segmentation information of the code segment to be verified includes: measurement segment information; The verification benchmark values ​​for each code segment include the verification values ​​for the measurement segment; The number of code segments includes: the number of metric segments; The verification key information includes: the authentication key handle.

4. The safe start method for an on-board controller according to claim 3, characterized in that, The number of metric segments includes at least a first metric segment and a second metric segment; The first segment of measurement code is the bootloader segment, and the second segment of measurement code is the functional application segment.

5. The safe start method for an on-board controller according to claim 1, characterized in that, The verification value of the metric segment is the CMAC value of each code segment; The second processing core uses a symmetric encryption algorithm to perform verification operations, and the verification key information is stored in the second processing core through an authentication key handle.

6. The safe start method for an on-board controller according to claim 1, characterized in that, The intermediate bootloader is stored in the secure Flash area of ​​the second processing core and is guided by the second processing core to run in the RAM of the first processing core. The intermediate bootloader is used to realize the interaction between the first processing core and the second processing core during the secure boot process.

7. The safe start method for an on-board controller according to claim 1, characterized in that, When the controller starts up for the first time, the BootConfig program is run to store the hardened key to the second processing core. Then, the second processing core is requested to calculate the CMAC value of the bootloader segment and the functional application segment and store it in the verification base value storage area. After the key injection and verification base value pre-configuration are completed, the controller is reset and the secure boot process is started.

8. A safety start device for an on-board controller, characterized in that, include: Initialization module, copy verification module, query startup module, and code verification module; The initialization module is used to synchronously start the first and second processing cores after the controller is reset and powered on. After executing the initial code and completing the underlying hardware initialization, it enters a waiting-for-scheduling state. The verification copy module is used to prepare the execution environment of the first processing core. The second processing core includes an intermediate boot program. After verifying its integrity, it is copied to a designated memory area of ​​the first processing core. The second processing core sends an execution instruction to the first processing core, guiding the first processing core to run the intermediate boot program; The startup query module is used to send a startup configuration query request to the second processing core; Obtain startup configuration information, which includes the division information of the code segment to be verified, the verification benchmark value corresponding to each code segment, the number of code segments, and the verification key information; The code segment to be verified includes at least a bootloader segment and a functional application segment; The code verification module is used to send a code verification request to the second processing core. The second processing core asynchronously performs the verification operation according to the code segment division order, generates the verification result of each code segment, compares it with the corresponding verification benchmark value, and stores the comparison result in the preset state storage unit. The first processing core starts the bootloader segment, queries the comparison result of the code segment, and if the verification is successful, it jumps to the functional application segment; The functional application segment queries its own comparison results through the intermediary bootstrap program. If the verification passes, the functional application starts to execute the core control logic; if the verification fails, it stops running.

9. An electronic device, characterized in that, include: The processor, communication interface, memory, and communication bus are connected, with the processor, communication interface, and memory communicating with each other via the communication bus. The memory stores a computer program that, when executed by the processor, causes the processor to perform the steps of a safe startup method for a vehicle controller as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, It stores a computer program executable by an electronic device, which, when run on the electronic device, causes the electronic device to perform the steps of a safe startup method for an on-board controller as described in any one of claims 1 to 7.

Images