Start control method and device for application software in battery management system

Abstract

The invention provides a start control method and device for application software in a battery management system, relates to the technical field of battery management system application, and aims to solve the problems of redundancy check, partition stiffness and key exposure of the existing BMS safety start. According to the scheme, a security startup table is managed through a hardware security module (HSM), an App initial address, an actual effective length and a corresponding app-CMAC value are stored in the table, and a key is solidified in the HSM and cannot be accessed by the outside; during burning, the HSM calculates CMAC according to the actual length of the App and writes the CMAC into a table, the HSM only verifies effective length data during starting, and meanwhile, the Bootloader executes service logic in parallel. According to the method, the BMS starting speed is smaller than or equal to 200 ms, App length dynamic change in OTA upgrading is supported, physical tampering is prevented, additional storage and CPU burden are avoided, and the BMS starting efficiency, flexibility and safety are improved.

Description

Technical Field

[0001] This invention relates to the technical field of battery management system applications, and in particular to a method and apparatus for controlling the startup of application software in a battery management system. Background Technology

[0002] With the rapid development of electric vehicles and energy storage systems, the Battery Management System (BMS), as one of the core components, has received widespread attention for its safety and reliability. The BMS needs to ensure the integrity and authenticity of its firmware during startup to prevent malicious code injection or tampering.

[0003] In existing technologies, secure booting of a BMS typically employs a verification mechanism based on a fixed partition size. Specifically, during the firmware burning phase, a hash calculation is performed on a predefined Flash partition (of fixed size) to generate a checksum, which is then stored in a specific area of ​​the Flash. During the system boot phase, the checksum is recalculated for the same fixed partition area and compared with the stored checksum for verification. This mechanism ensures system boot security by verifying firmware integrity.

[0004] However, existing BMS secure boot technology suffers from long boot times, poor scalability, and susceptibility to physical tampering due to its use of fixed partition full verification, lack of dynamic adaptation capabilities, and storage of verification data and keys in plaintext in Flash. Summary of the Invention

[0005] In view of this, the purpose of the present invention is to provide a method and apparatus for controlling the startup of application software in a battery management system, which triggers startup by reading only the storage information of the application software firmware, thereby alleviating the technical problems of long startup time, poor security and scalability of the battery management system caused by full verification of fixed partitions.

[0006] In a first aspect, the present invention provides a method for controlling the startup of application software in a battery management system, wherein the microcontroller used in the battery management system includes at least a hardware security module, a startup loading module, and storage memory; the method includes: The startup loading module burns each application software firmware in the battery management system to the storage memory and writes the storage information used to locate each application software firmware into the security startup table built into the hardware security module. The hardware security module triggers the boot loading module to start the target application software firmware used to execute the target business application function in the battery management system by reading the storage information of the target application software firmware in the security boot table; When the target application software firmware receives the latest version of the target application software firmware, the hardware security module updates the security boot table based on the storage information of the latest version of the target application software firmware, and uses the latest version of the target application software firmware as the new target application software firmware. Then, it executes the step of triggering the boot loading module to start the target application software firmware used to execute the target business application function in the battery management system by reading the storage information of the target application software firmware in the security boot table.

[0007] In an optional implementation, the steps of the boot loading module burning each application software firmware in the battery management system to the storage memory and writing the storage information used to locate each application software firmware into the secure boot table built into the hardware security module include: During the production phase of the battery management system, the startup loading module writes each application software firmware used to execute the business application functions in the battery management system into the storage memory, records the storage information of each application software firmware in the storage memory, and sends the storage information to the hardware security module; wherein, the storage information includes at least the starting address and the actual length; The hardware security module writes the stored information into the built-in secure boot table.

[0008] In an optional implementation, the stored information further includes an application layer authentication code; the step of the hardware security module writing the stored information into the built-in secure boot table further includes: The hardware security module reads the actual length of byte data from the starting address, and uses the solidified key to calculate the byte data to obtain the application layer authentication code corresponding to each application software firmware; the starting address, the actual length, and the application layer authentication code are written as storage information into the built-in secure boot table.

[0009] In an optional implementation, before the step of the hardware security module triggering the boot loading module to start the target application software firmware in the battery management system for executing the target business application function by reading the storage information of the target application software firmware in the security boot table, the method further includes: Based on the identity identifier of each application software firmware obtained by the hardware security module, the status information of the battery management system obtained by the startup loading module, and the trigger information from the user, the target application software firmware to be started in the battery management system is determined collaboratively.

[0010] In an optional implementation, the hardware security module triggers the boot loading module to start the target application software firmware in the battery management system for executing target business application functions by reading the storage information of the target application software firmware in the security boot table, including: When the battery management system is powered on and the hardware security module is initialized, the hardware security module is triggered to read byte data of actual length from the starting address of the storage memory based on the storage information, and calculate the message authentication code of the byte data using the solidified key; Determine whether the message authentication code and the application layer authentication code are the same; If they are different, the current verification result is returned to the startup loading module to terminate the startup of the target application software firmware in the battery management system; If they are the same, the current verification result is returned to the startup loading module so that the startup loading module can execute the target application software firmware from the starting address.

[0011] In an optional implementation, when the target application software firmware receives the latest version of the target application software firmware, the step of the hardware security module updating the secure boot table based on the storage information of the latest version of the target application software firmware includes: If the currently running target application software firmware receives the latest version of the target application software firmware, then the latest version of the target application software firmware is verified, the verified latest version of the target application software firmware is written to the preset partition of the storage memory, the latest storage information of the latest version of the target application software firmware is recorded, and sent to the hardware security module. The hardware security module updates the secure boot table based on the latest storage information and the latest application layer authentication code corresponding to the latest version of the target application software firmware, which is calculated by using the solidified key to read the latest actual length of byte data from the latest starting address.

[0012] In an optional implementation, the method further includes: The target application software firmware writes an upgrade request flag at a preset address in the storage memory, triggering the battery management system to restart; When the restarted boot loading module detects the upgrade request flag, it again executes the step of triggering the boot loading module to start the target application software firmware in the battery management system for executing the target business application function by reading the storage information of the target application software firmware in the secure boot table.

[0013] Secondly, the present invention provides a startup control device for application software in a battery management system. The microcontroller used in the battery management system includes at least a hardware security module, a startup loading module, and storage memory; the device includes: The startup loading module burns each application software firmware in the battery management system to the storage memory and writes the storage information used to locate each application software firmware into the security startup table built into the hardware security module. The hardware security module triggers the boot loading module to start the target application software firmware used to execute the target business application function in the battery management system by reading the storage information of the target application software firmware in the security boot table. When the target application software firmware receives the latest version of the target application software firmware, the hardware security module updates the security boot table based on the storage information of the latest version of the target application software firmware, and uses the latest version of the target application software firmware as the new target application software firmware. Then, it executes the step of triggering the boot loading module to start the target application software firmware in the battery management system for executing the target business application function by reading the storage information of the target application software firmware in the security boot table.

[0014] Thirdly, the present invention provides an electronic device, including a memory and a processor, wherein the memory stores a computer program that can run on the processor, and the processor executes the computer program to implement the steps of the method described in any of the foregoing embodiments.

[0015] Fourthly, the present invention provides a machine-readable storage medium storing machine-executable instructions, which, when invoked and executed by a processor, cause the processor to perform the steps of the method described in any of the foregoing embodiments.

[0016] This invention provides a method and apparatus for controlling the startup of application software in a battery management system. During the battery management system's production phase, storage information for locating the starting address and actual length of each application software is set in the Hardware Security Module (HSM) of its microcontroller. In practical applications, the target application software firmware can be read directly based on the storage information in this secure startup table. This triggers the startup loading module to start the target application software firmware, enabling the implementation of the target business application function in the battery management system. When the target business application firmware receives a new firmware package, it can update the aforementioned secure startup table using the storage information of the latest version of the target application software firmware and read the updated information from the secure startup table to upgrade to the latest version of the target application software firmware, thereby enabling the execution of the latest version of the target business application performance. This method dynamically triggers startup based on the different storage conditions of each application software firmware to be executed, ensuring that the startup of the application software eliminates the time loss from reading useless storage and improves the startup efficiency of the application software firmware.

[0017] Other features and advantages of this disclosure will be set forth in the following description, or some features and advantages may be inferred from the description or determined without doubt, or may be learned by practicing the techniques described above.

[0018] To make the above-mentioned objects, features and advantages of this disclosure more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0019] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0020] Figure 1 A flowchart of a startup control method for application software in a battery management system provided in an embodiment of the present invention; Figure 2 A flowchart of another method for starting up application software in a battery management system provided in an embodiment of the present invention; Figure 3 A functional block diagram of a startup control device for application software in a battery management system provided in an embodiment of the present invention; Figure 4 This is a schematic diagram of the hardware architecture of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] The inventors discovered that the current technical solution for controlling the startup of a battery management system based on fixed partition verification has significant limitations: First, even if the application (App) only occupies a portion of the Flash partition, the system still needs to perform integrity verification on the entire predefined partition, and this redundant verification process significantly prolongs the startup time; second, when the starting address or length of the application changes, the storage space must be re-partitioned and the partition configuration adjusted, lacking dynamic adaptability; in addition, if the verification value and related keys are stored directly in Flash, there is a security risk of unauthorized access or tampering.

[0023] Based on this, the present invention provides a method and apparatus for controlling the startup of application software in a battery management system. The method and apparatus implement read verification according to the dynamic length of the application software storage process. This solves the problems of slow startup and rigid partitioning caused by traditional fixed partition redundant verification. It also ensures security by keeping the key within the HSM and using CMAC to prevent tampering. At the same time, it saves storage resources, reduces CPU load, and balances BMS startup speed, dynamic adaptability, security and resource economy.

[0024] To facilitate understanding of this embodiment, a startup control method for application software in a battery management system disclosed in this embodiment will be described in detail first. The method provided by this embodiment can be applied to the microcontroller used in the battery management system. The microcontroller used in the battery management system includes at least a hardware security module, a startup loading module, and storage memory.

[0025] Figure 1 This is a flowchart of a method for starting up application software in a battery management system, provided as an embodiment of the present invention.

[0026] like Figure 1 As shown, the method includes the following steps: S102, the startup loading module burns the firmware of each application software in the battery management system to the storage memory, and writes the storage information used to locate each application software firmware into the security startup table built into the hardware security module.

[0027] It should be noted that Flash is the storage memory within the BMS controller and serves as the data source for secure boot. This application no longer uses the entire storage memory as the trust basis for the security mechanism. That is, it avoids the method of reading the entire storage memory to obtain the software firmware and then booting the corresponding software firmware. Instead, it dynamically adapts to the storage conditions of each software firmware, reading only the application software firmware based on its storage information to achieve fast boot. For example, reading the entire storage memory takes 800 milliseconds, while dynamically adapting to the length of each software firmware only takes 200 milliseconds, thus effectively improving the boot efficiency of the application software firmware.

[0028] This step can be performed during BMS factory shipment or initial application software firmware deployment. The core is to write the application software firmware (App) to storage and establish a secure boot table in the HSM (Hardware Security Module) based on the stored information to characterize the basis for trusted verification.

[0029] For example, during the BMS production programming stage, the storage information of the application software firmware is stored in the security table built into the hardware security module HSM, so as to realize the dynamic startup of the corresponding application software firmware in subsequent battery management applications and ensure startup efficiency; specifically, this step S102 can also be implemented through the following steps: Step 1.1: During the production phase of the battery management system, the startup loading module writes each application software firmware used to execute the business application functions in the battery management system into the storage memory, records the storage information of each application software firmware in the storage memory, and sends the storage information to the hardware security module.

[0030] The application software firmware, or App firmware, is the main body for executing business logic in the battery management system. The business application functions executed by the application software firmware include at least application performance such as battery sampling, equalization control, and SOC estimation; for example, processing SOC (remaining capacity), SOH (state of health), and SOP (power capability) estimation; equalization management, charge and discharge enable, fault protection (overvoltage / undervoltage / overtemperature, etc.); and communication with the vehicle VCU, charger, or host computer via protocols such as CAN / LIN.

[0031] Here, the aforementioned storage information includes at least the starting address and the actual length. During the burning stage, the bootloader module writes the App / application software firmware to the Flash storage memory, records its starting address (app_startaddr) and actual length (app_length), and submits it to the hardware security module HSM.

[0032] Step 1.2: The hardware security module writes the stored information into the built-in secure boot table.

[0033] The hardware security module (HSM) writes (app_startaddr, app_length) into the secure boot table so that during the subsequent application software firmware boot process, HSM can read the actual length of the bytes from the starting address of app_startaddr according to the secure boot table, thereby achieving the purpose of quickly and accurately reading the application software firmware.

[0034] In practical applications, the stored information may also include an application-layer authentication code, i.e., an authentication code is added to the secure boot table to ensure boot security; in this case, step 1.2 also includes: The hardware security module reads the actual length of byte data from the starting address and uses the embedded key to calculate the byte data to obtain the application layer authentication code corresponding to each application software firmware; the starting address, actual length and application layer authentication code are written as storage information into the built-in secure boot table.

[0035] Here, the hardware security module HSM can read the actual length of the byte data from the starting address app_startaddr according to the secure boot table, and then use the AES-CMAC algorithm to calculate the message authentication code from the byte data. This message authentication code is used as the application layer authentication code (denoted as app_cmac) and the starting address and actual length (app_startaddr, app_length, app_cmac) and written together into the secure boot table.

[0036] Understandably, the hardware security module (HSM) uses a fixed key to calculate the AES-CMAC of this segment of byte data in the application software firmware to obtain the application layer authentication code app_cmac. Here, the secure boot table built into the hardware security module is shown in Table 1 below: Table 1

[0037] It should be noted that the BMS will have an AES-CMAC key embedded in the HSM during production, which cannot be accessed from the outside to prevent tampering; the HSM can realize automatic verification, and at the same time the verification is started, the Bootloader module can execute its own business logic in parallel to speed up the startup.

[0038] It is understandable that in practical applications, only one application software firmware can be started and the corresponding application performance can be executed at any given time. Therefore, before step S104, a method is also used to select a specific application software firmware from multiple application software firmwares. Based on the identity identifier of each application software firmware obtained by the hardware security module, the status information of the battery management system obtained by the startup loading module, and the trigger information from the user, the target application software firmware to be started in the battery management system is determined collaboratively.

[0039] First, when multiple application software firmwares are stored in the storage memory, each application software firmware will simultaneously store a corresponding identity identifier. Second, in actual BMS applications, the boot loading module can monitor and acquire BMS status information in real time, such as hardware status signals and software status signals. Furthermore, the boot loading module can acquire user-input trigger information in real time, which can be used to characterize the trigger control signal that the user expects to enter a certain mode or achieve a certain application performance. Based on the above two types of information, the application software firmware to be booted can be determined, and then the target application software firmware can be determined according to its identity identifier.

[0040] S104, the hardware security module reads the storage information of the target application software firmware in the security boot table and triggers the boot loading module to start the target application software firmware in the battery management system used to execute the target business application function.

[0041] Based on the foregoing embodiments, step S104 can achieve rapid startup of the target business application software firmware through the following steps, specifically including: Step 2.1: When the battery management system is powered on and the hardware security module has completed initialization, the hardware security module is triggered to read the actual length of byte data from the starting address of the storage memory based on the storage information, and calculate the message authentication code of the byte data through the solidified key.

[0042] Here, the system powers on, HSM initialization is completed, and automatic verification logic is triggered; HSM reads the entries (app_startaddr, app_length, app_cmac) in the secure boot table; HSM reads app_length bytes of data from the app_startaddr address of Flash (this read operation points to this byte of data and skips unused storage memory areas), and uses the hardened key to calculate the message authentication code AES-CMAC for the read data.

[0043] Step 2.2: Determine whether the message authentication code and the application layer authentication code are the same.

[0044] HSM compares the read application layer authentication code app_cmac with the calculated message authentication code AES-CMAC.

[0045] Step 2.3: If the results are different, return the current verification result to the startup loading module and terminate the startup of the target application software firmware in the battery management system.

[0046] Here, if the calculated message authentication code is not equal to the application layer authentication code app_cmac in the secure boot table, the boot of the target application software firmware is terminated. In this case, the HSM verification fails, the result is returned to the bootloader, and the system remains under the bootloader without starting the App target application software firmware.

[0047] Step 2.4: If they are the same, return the current verification result to the boot loading module so that the boot loading module can execute the target application software firmware from the starting address.

[0048] If the two are the same, the HSM verification passes and the result is returned to the Bootloader. The Bootloader then executes the App target application software firmware from app_startaddr.

[0049] In this embodiment of the invention, after the battery management system is powered on, the integrity of the application software firmware stored in the non-volatile memory is verified. If the verification is successful, the system jumps to the entry address of the application software firmware to execute the corresponding battery management function. If the verification fails, the execution of the application software firmware is prohibited, and the system enters a preset security state.

[0050] S106, when the target application software firmware receives the latest version of the target application software firmware, the hardware security module updates the security boot table based on the storage information of the latest version of the target application software firmware, and uses the latest version of the target application software firmware as the new target application software firmware, and executes S104 again.

[0051] In practical applications, such as OTA upgrade scenarios, the upgraded application software firmware can also achieve fast startup based on the updated secure boot table. This step S106 can be achieved through the following steps, including: Step 3.1: If the currently running target application software firmware receives the latest version of the target application software firmware, then the latest version of the target application software firmware is verified, the verified latest version of the target application software firmware is written to the preset partition of the storage memory, the latest storage information of the latest version of the target application software firmware is recorded, and sent to the hardware security module.

[0052] Here, this embodiment of the invention addresses scenarios where application software firmware undergoes upgrades, such as OTA upgrades, enabling fast and secure boot. When the old version of the target application software firmware receives the latest firmware package, it first performs verification. If the verification fails, subsequent steps are not executed. If the verification passes, the latest version of the target application firmware is written to the backup partition of the storage memory or the OTA buffer, and the latest storage information, such as the storage start address and actual length of the latest target application software firmware, is recorded. It should be noted that the old and new versions of firmware can be understood as corresponding to the same application software firmware to facilitate upgrades.

[0053] Step 3.2: The hardware security module updates the secure boot table based on the latest stored information and the latest application layer authentication code corresponding to the latest version of the target application software firmware, which is calculated by using the solidified key to read the latest actual length of byte data from the latest starting address.

[0054] Specifically, the hardware security module then reads the byte data corresponding to the latest target application software firmware based on the latest storage information to calculate the application layer authentication code. Based on this application layer authentication code and the latest starting address in the aforementioned steps, the latest actual length is updated to the secure boot table. As an optional embodiment, the storage information corresponding to the target application software firmware can be replaced using this application layer authentication code and the latest starting address in the aforementioned steps to update the secure boot table.

[0055] Based on the aforementioned steps, after the storage information of the latest version of the target application software firmware is updated, the latest version of the target application software firmware is used as the new target application software firmware. The battery management system restarts to trigger the upgrade and operation of this version of the target application software firmware. The method of this embodiment of the invention further includes: Step 4.1: The target application software firmware writes an upgrade request flag to a preset address in the storage memory, triggering a restart of the battery management system.

[0056] Here, the battery management system is restarted based on the upgrade request.

[0057] Step 4.2: When the restarted startup loading module detects the upgrade request flag, it executes step S104 again to upgrade and execute the latest version of the target application software firmware.

[0058] In addition, the status flag corresponding to the target application software firmware of this new version will be updated to "activated".

[0059] In a preferred embodiment of practical application, during the battery management system production stage, storage information for locating the starting address and actual length of each application software is set in the hardware security module (HSM) of its microcontroller. During practical application, the target application software firmware can be read directly based on the storage information in this security boot table. This triggers the boot loading module to start the target application software firmware, enabling the implementation of the target business application function in the battery management system. When the target business application firmware receives a new version firmware package, it can update the aforementioned security boot table using the storage information of the latest version of the target application software firmware and read the updated information in the security boot table to upgrade to the latest version of the target application software firmware, thereby enabling the execution of the latest version of the target business application performance. This method dynamically triggers booting based on the different storage conditions of each application software firmware to be executed, ensuring that the booting of the application software eliminates the time loss from reading useless storage and improves the booting efficiency of the application software firmware.

[0060] Figure 2 A flowchart illustrating another method for starting up application software in a battery management system, provided in an embodiment of the present invention.

[0061] Reference Figure 2 This method can be executed through three terminals: the bootloader module, the hardware security module (HSM), and the flash memory. During the battery management system programming stage, the Bootloader writes the application software firmware / APP data into the Flash. The Bootloader submits the storage information (app_startaddr, app_length) to the HSM, so that the HSM can read byte data from the Flash based on the storage information (app_startaddr, app_length) and calculate app_cmac based on this byte data and store it in the secure boot table. During the application software firmware startup phase of the battery management system, the HSM reads byte data from the Flash memory using the stored information (app_startaddr, app_length) in the secure boot table, calculates the AES-CMAC based on this byte data, verifies the AES-CMAC against the app_cmac in the secure boot table, and returns the verification result to the Bootloader. If the verification result shows a match, the application software firmware / APP is started from the Flash memory. If the verification result shows a mismatch, the system remains under the Bootloader and does not jump to start the application software firmware / APP.

[0062] In some embodiments, such as Figure 3As shown, this embodiment of the invention also provides a startup control device for application software in a battery management system. The microcontroller used in the battery management system includes at least a hardware security module, a startup loading module, and storage memory; the device includes: The startup loading module 201 burns each application software firmware in the battery management system to the storage memory, and writes the storage information used to locate each application software firmware into the security startup table built into the hardware security module. The hardware security module 202 triggers the boot loading module to start the target application software firmware used to execute the target business application function in the battery management system by reading the storage information of the target application software firmware in the security boot table; When the target application software firmware receives the latest version of the target application software firmware, the hardware security module 202 updates the security boot table based on the storage information of the latest version of the target application software firmware, and uses the latest version of the target application software firmware as the new target application software firmware. Then, it executes the step of triggering the boot loading module to start the target application software firmware used to perform the target business application function in the battery management system by reading the storage information of the target application software firmware in the security boot table.

[0063] This invention achieves multiple technical advantages through a secure boot table managed by HSM and a dynamic length verification mechanism: HSM can read and verify valid data of variable length as needed, skipping unused areas, significantly reducing BMS boot time and improving product performance; it supports dynamic changes in App length (such as OTA updates), requiring only an update to the HSM secure boot table during burning, without adjusting storage space partitions, providing excellent dynamic flexibility; the key never leaves the HSM, CMAC calculation and comparison are both completed within the HSM, and the key is physically unextractable, forming ultimate security, and tampering with App data, starting address, or length will destroy CMAC, achieving triple protection against tampering; at the same time, there is no need to store the key and verification information in Flash, saving storage space, and the Host CPU has no related computational burden, achieving zero resource overhead and lower power consumption.

[0064] Figure 4 This is a schematic diagram of the hardware architecture of the electronic device 300 provided in an embodiment of the present invention. See also... Figure 4As shown, the electronic device 300 includes a machine-readable storage medium 301 and a processor 302, and may also include a non-volatile storage medium 303, a communication interface 304, and a bus 305; wherein the machine-readable storage medium 301, the processor 302, the non-volatile storage medium 303, and the communication interface 304 communicate with each other through the bus 305. The processor 302 can execute the startup control method for the application software in the battery management system described in the above embodiments by reading and executing machine-executable instructions for startup control of the application software in the battery management system in the machine-readable storage medium 301.

[0065] The machine-readable storage medium mentioned in this article can be any electronic, magnetic, optical, or other physical storage device that can contain or store information such as executable instructions, data, etc. For example, machine-readable storage media can be: RAM (Random Access Memory), volatile memory, non-volatile memory, flash memory, storage drives (such as hard disk drives), any type of storage disk (such as optical discs, DVDs, etc.), or similar storage media, or combinations thereof.

[0066] Non-volatile media can be non-volatile memory, flash memory, storage drives (such as hard disk drives), any type of storage disk (such as optical discs, DVDs, etc.), or similar non-volatile storage media, or combinations thereof.

[0067] It is understood that the specific operation methods of each functional module in this embodiment can be referred to the detailed description of the corresponding steps in the above method embodiment, and will not be repeated here.

[0068] The computer-readable storage medium provided in this embodiment of the invention stores a computer program. When the computer program code is executed, it can implement the startup control method of the application software in the battery management system described in any of the above embodiments. For specific implementation, please refer to the method embodiments, which will not be repeated here.

[0069] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the system and apparatus described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0070] Furthermore, in the description of the embodiments of the present invention, unless otherwise explicitly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in the present invention based on the specific circumstances.

[0071] In the description of this invention, it should be noted that the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are used only for the convenience of describing the invention and for simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on the invention. Furthermore, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0072] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit them. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the scope of the technology disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention.

Claims

1. A method for starting up application software in a battery management system, characterized in that, The microcontroller used in the battery management system includes at least a hardware security module, a boot loading module, and storage memory; the method includes: The startup loading module burns each application software firmware in the battery management system to the storage memory and writes the storage information used to locate each application software firmware into the security startup table built into the hardware security module. The hardware security module triggers the boot loading module to start the target application software firmware used to execute the target business application function in the battery management system by reading the storage information of the target application software firmware in the security boot table; When the target application software firmware receives the latest version of the target application software firmware, the hardware security module updates the security boot table based on the storage information of the latest version of the target application software firmware, and uses the latest version of the target application software firmware as the new target application software firmware. Then, it executes the step of triggering the boot loading module to start the target application software firmware used to execute the target business application function in the battery management system by reading the storage information of the target application software firmware in the security boot table.

2. The method according to claim 1, characterized in that, The steps of the boot loading module burning each application software firmware in the battery management system to the storage memory and writing the storage information used to locate each application software firmware into the secure boot table built into the hardware security module include: During the production phase of the battery management system, the startup loading module writes each application software firmware used to execute the business application functions in the battery management system into the storage memory, records the storage information of each application software firmware in the storage memory, and sends the storage information to the hardware security module; wherein, the storage information includes at least the starting address and the actual length; The hardware security module writes the stored information into the built-in secure boot table.

3. The method according to claim 2, characterized in that, The stored information also includes an application layer authentication code; the step of the hardware security module writing the stored information into the built-in secure boot table further includes: The hardware security module reads the actual length of byte data from the starting address, and uses the solidified key to calculate the byte data to obtain the application layer authentication code corresponding to each application software firmware; the starting address, the actual length, and the application layer authentication code are written as storage information into the built-in secure boot table.

4. The method according to claim 1, characterized in that, Before the step whereby the hardware security module triggers the boot loading module to start the target application software firmware used to execute the target business application function in the battery management system by reading the storage information of the target application software firmware in the security boot table, the method further includes: Based on the identity identifier of each application software firmware obtained by the hardware security module, the status information of the battery management system obtained by the startup loading module, and the trigger information from the user, the target application software firmware to be started in the battery management system is determined collaboratively.

5. The method according to claim 3, characterized in that, The hardware security module triggers the boot loading module to start the target application software firmware used to execute the target business application function in the battery management system by reading the storage information of the target application software firmware in the security boot table, including: When the battery management system is powered on and the hardware security module is initialized, the hardware security module is triggered to read byte data of actual length from the starting address of the storage memory based on the storage information, and calculate the message authentication code of the byte data using the solidified key; Determine whether the message authentication code and the application layer authentication code are the same; If they are different, the current verification result is returned to the startup loading module to terminate the startup of the target application software firmware in the battery management system; If they are the same, the current verification result is returned to the startup loading module so that the startup loading module can execute the target application software firmware from the starting address.

6. The method according to claim 1, characterized in that, When the target application software firmware receives the latest version of the target application software firmware, the step of the hardware security module updating the secure boot table based on the storage information of the latest version of the target application software firmware includes: If the currently running target application software firmware receives the latest version of the target application software firmware, then the latest version of the target application software firmware is verified, the verified latest version of the target application software firmware is written to the preset partition of the storage memory, the latest storage information of the latest version of the target application software firmware is recorded, and sent to the hardware security module. The hardware security module updates the secure boot table based on the latest storage information and the latest application layer authentication code corresponding to the latest version of the target application software firmware, which is calculated by using the solidified key to read the latest actual length of byte data from the latest starting address.

7. The method according to claim 1, characterized in that, The method further includes: The target application software firmware writes an upgrade request flag at a preset address in the storage memory, triggering the battery management system to restart; When the restarted boot loading module detects the upgrade request flag, it again executes the step of triggering the boot loading module to start the target application software firmware in the battery management system for executing the target business application function by reading the storage information of the target application software firmware in the secure boot table.

8. A startup control device for application software in a battery management system, characterized in that, The microcontroller used in the pool management system includes at least a hardware security module, a boot loading module, and storage memory; the device includes: The startup loading module burns each application software firmware in the battery management system to the storage memory and writes the storage information used to locate each application software firmware into the security startup table built into the hardware security module. The hardware security module triggers the boot loading module to start the target application software firmware used to execute the target business application function in the battery management system by reading the storage information of the target application software firmware in the security boot table. When the target application software firmware receives the latest version of the target application software firmware, the hardware security module updates the security boot table based on the storage information of the latest version of the target application software firmware, and uses the latest version of the target application software firmware as the new target application software firmware. Then, it executes the step of triggering the boot loading module to start the target application software firmware in the battery management system for executing the target business application function by reading the storage information of the target application software firmware in the security boot table.

9. An electronic device comprising a memory and a processor, wherein the memory stores a computer program executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method described in any one of claims 1 to 7.

10. A machine-readable storage medium, characterized in that, The machine-readable storage medium stores machine-executable instructions that, when invoked and executed by a processor, cause the processor to perform the steps of the method according to any one of claims 1 to 7.

Images