An electric control system software security brush writing method and device

Abstract

The application discloses an electric control system software security writing method and device, wherein the electric control system software security writing method comprises the following steps: allocating a unique software ID to software to be written, selecting a target encryption algorithm from a plurality of candidate encryption algorithms according to the software ID, encrypting the software to be written by using the target encryption algorithm, and generating an encrypted software package; wherein the encrypted software package contains the software ID; when the target electric control system is written by using a writing device, the software ID in the encrypted software package, the device ID of the writing device and the system ID of the target electric control system are acquired, and the combination of the software ID, the device ID and the system ID is verified; after the verification is passed, the target decryption algorithm corresponding to the software ID is indexed and determined from a plurality of candidate decryption algorithms according to the software ID, the encrypted software package is decrypted by using the target decryption algorithm; and the decrypted software is written to the target electric control system.

Description

Technical Field

[0001] This invention relates to the field of electronic control technology, and in particular to a method and apparatus for securely flashing software in an electronic control system. Background Technology

[0002] With the increasing complexity of Electronic Control Units (ECUs) and the growing intelligence of vehicles and industrial equipment, software updates (i.e., software remapping) have become a routine operation for product maintenance, function upgrades, and vulnerability patching. However, unauthorized software remapping and data reading have brought serious security risks and management problems:

[0003] 1. Risk of intellectual property leakage: Competitors or third parties can easily extract and copy the core software algorithms in the ECU.

[0004] 2. Functional safety hazards: Unauthorized software that has been tampered with or implanted with malicious code may cause vehicles or industrial equipment to go out of control, leading to serious safety accidents and threatening personal and property safety.

[0005] 3. Chaotic market order: Software flashing through unofficial channels undermines the consistency and reliability of products.

[0006] To address the aforementioned issues, various software security protection schemes have been proposed in existing technologies. For example, patent CN119363394A discloses an ECU flashing system, method, and storage medium. The system includes: a PKI certificate management module that generates a digital certificate and issues it to a flashing authentication module; a vehicle software management module that updates the ECU software version information based on the flashing-related information uploaded by the flashing authentication module; the flashing authentication module that uploads flashing-related information to the vehicle software management module; and sends the authorization file and software flashing package to a gateway module; the gateway module that verifies the digital certificate of the flashing authentication module; and establishes communication with the ECU module based on the authorization file; and the ECU module that flashes the ECU software. While the aforementioned patent effectively improves the security and stability of ECU flashing, it relies on the online support of the PKI system, making it difficult to execute properly in offline scenarios. Furthermore, its authentication process depends on the real-time availability of the certificate management system, limiting the flexibility and applicability of the flashing operation.

[0007] To address the aforementioned technical problems, this invention proposes a method and apparatus for securely flashing software in an electronic control system. Summary of the Invention

[0008] The purpose of this invention is to address the shortcomings of existing technologies by providing a secure software flashing method and apparatus for electronic control systems. This method effectively prevents the software from being illegally flashed and decrypted, and ensures traceability of the flashing process. It also prevents unauthorized third parties from flashing the electronic control system software, ensuring that only certified service stations or personnel can perform software updates and data reading and writing, thereby protecting the safety of vehicles or equipment.

[0009] To achieve the above objectives, the present invention adopts the following technical solution:

[0010] A method for securely flashing software in an electronic control system includes:

[0011] Assign a unique software ID to the software to be flashed, select a target encryption algorithm from multiple candidate encryption algorithms based on the software ID, encrypt the software to be flashed using the target encryption algorithm, and generate an encrypted software package; the encrypted software package contains the software ID;

[0012] When flashing the target electronic control system using a flashing device, the software ID in the encrypted software package, the device ID of the flashing device, and the system ID of the target electronic control system are obtained, and the combination of the software ID, device ID, and system ID is verified.

[0013] Once the verification is successful, the target decryption algorithm corresponding to the software ID is determined by indexing from multiple candidate decryption algorithms based on the software ID, and the encrypted software package is decrypted using the target decryption algorithm.

[0014] The decrypted software is then flashed onto the target electronic control system.

[0015] Furthermore, the step of selecting the target encryption algorithm from multiple candidate encryption algorithms based on the software ID specifically involves:

[0016] Convert each digit of the software ID to a hexadecimal value according to the ASCII code;

[0017] Perform an XOR operation on each of the converted hexadecimal values ​​to obtain the first result.

[0018] Take the decimal digits of the first operation result to obtain the algorithm number;

[0019] Based on the preset encryption level and algorithm number, the corresponding target encryption algorithm is determined from the algorithm library.

[0020] Furthermore, after determining the corresponding target encryption algorithm from the algorithm library based on the preset encryption level and algorithm number, the process further includes:

[0021] An encryption key of the corresponding level is generated based on the software ID; the encryption key levels include low encryption level, medium encryption level, and high encryption level.

[0022] In lower encryption levels, the result of the first operation is used as the key;

[0023] In the medium encryption level, the key is the combination of the first and second operation results, where the second operation result is the result of sequentially summing the hexadecimal values ​​of the software ID and taking the lower 8 bits.

[0024] In high encryption levels, the key is a combination of the first, second, and third operation results; the third operation result is the sum of the hexadecimal values ​​of the software ID after XORing them in sequence and taking the lower 8 bits.

[0025] Furthermore, the generated encryption software package stores keys in multiple consecutive preset locations, and the keys stored in different preset locations have an increasing numerical relationship.

[0026] Furthermore, the verification of the combination of software ID, device ID, and system ID also includes: reading keys from multiple consecutive preset positions and verifying whether the numerical increment relationship between each key is consistent with a preset rule.

[0027] Furthermore, the specific verification of the combination of software ID, device ID, and system ID is as follows:

[0028] The software ID, device ID, and system ID are combined into authentication information according to preset rules;

[0029] The authentication information is compared with the locally stored whitelist, or the authentication information is calculated using a preset verification algorithm and compared with the key pre-stored in the encryption software package. Verification is confirmed to be successful only if the comparison matches.

[0030] Furthermore, the step of flashing the decrypted software onto the target electronic control system specifically includes:

[0031] The flashing device uses transmission encryption rules to encrypt and transmit the decrypted software data.

[0032] The target electronic control system decrypts the encrypted transmission data according to the preset transmission decryption rules and stores it in the controller storage area.

[0033] Furthermore, the transmission encryption rules include:

[0034] Obtain the number of passwords associated with the target electronic control system, where the number of passwords is a preset value;

[0035] Each byte in each frame of data is XORed with the number of cipher bits before being sent.

[0036] The last byte of each frame of data is the transmission check code, which is calculated from each byte of the frame of data using a cyclic redundancy check algorithm.

[0037] Furthermore, after verifying the combination of software ID, device ID, and system ID, the method further includes: when the verification fails, recording the number of failures; and when the number of consecutive failures reaches a preset threshold, locking the write function.

[0038] Correspondingly, a device for securely flashing electronic control system software is also provided, comprising:

[0039] The encryption module is used to assign a unique software ID to the software to be flashed, select a target encryption algorithm from multiple candidate encryption algorithms based on the software ID, encrypt the software to be flashed using the target encryption algorithm, and generate an encrypted software package; the encrypted software package contains the software ID;

[0040] The identity authentication module is used to obtain the software ID in the encrypted software package, the device ID of the flashing device, and the system ID of the target electronic control system when the target electronic control system is flashed through the flashing device, and to verify the combination of the software ID, device ID, and system ID.

[0041] The decryption module is used to, after verification, index from multiple candidate decryption algorithms based on the software ID and determine the target decryption algorithm corresponding to the software ID, and use the target decryption algorithm to decrypt the encrypted software package;

[0042] The flashing module is used to flash the decrypted software onto the target electronic control system.

[0043] Compared with the prior art, the beneficial effects of the present invention are:

[0044] 1. High Security: Employs a dynamic mapping mechanism between software ID and decryption algorithm. Even if an attacker cracks one algorithm, they cannot decrypt other software packages using different algorithms. Triple ID binding ensures that only the correct software can be flashed onto the designated controller via authorized devices. Encryption algorithms are also provided for the communication process, ensuring the security of the entire operation.

[0045] 2. Strong traceability: The binding relationship between software ID, device ID and system ID makes every legitimate flashing operation traceable, making it easy to trace the source when problems occur.

[0046] 3. Flexible offline operation: This solution does not require a real-time connection to a cloud server, making it suitable for scenarios with poor network environments such as workshops and the field, providing convenience while ensuring safety.

[0047] 4. Easy to manage: Software developers can assign different software IDs and encryption algorithms to different versions and different customers, achieving refined software release management. Attached Figure Description

[0048] Figure 1 This is a flowchart of a method for securely flashing software in an electronic control system, provided in Embodiment 1. Detailed Implementation

[0049] The following specific examples illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that, unless otherwise specified, the following embodiments and features described therein can be combined with each other.

[0050] The purpose of this invention is to address the shortcomings of existing technologies by providing a secure software flashing method and apparatus for electronic control systems. Through mechanisms such as dynamic mapping of software ID and encryption algorithm, triple identity binding, multi-level key generation, transmission encryption, and failure locking, the invention achieves high security, strong traceability, and offline availability for flashing electronic control system software.

[0051] Example 1

[0052] This embodiment provides a method for securely flashing software in an electronic control system, such as... Figure 1 As shown, it includes:

[0053] Software encryption preprocessing: Assign a unique software ID to the software to be flashed, and select a target encryption algorithm from multiple candidate encryption algorithms based on the software ID. Use the target encryption algorithm to encrypt the software to be flashed to generate an encrypted software package; the encrypted software package contains the software ID.

[0054] Identity authentication: When flashing the target electronic control system through the flashing device, obtain the software ID in the encrypted software package, the device ID of the flashing device, and the system ID of the target electronic control system, and verify the combination of the software ID, device ID, and system ID;

[0055] Dynamic decryption: After verification, the target decryption algorithm corresponding to the software ID is determined by indexing from multiple candidate decryption algorithms based on the software ID, and the encrypted software package is decrypted using the target decryption algorithm;

[0056] Flashing: Flashing the decrypted software onto the target electronic control system.

[0057] This implementation method uses the software flashing of a vehicle electronic control system (ECU) as an example, but this method is also applicable to other types of electronic control systems such as industrial equipment and construction machinery.

[0058] The system in the flashing method of this embodiment includes a server, a flashing device, and a target electronic control system.

[0059] The server is maintained by the software developer and performs software encryption preprocessing operations when the software is released, which is used to store encrypted software packages.

[0060] The flashing device is an authorized encrypted flashing device, such as a dedicated diagnostic instrument. Each flashing device has a unique device ID, and the device internally stores a mapping table of software IDs and decryption algorithms, a whitelist, and communication encryption algorithms.

[0061] The target electronic control system is the ECU to be flashed. Each ECU has a unique system ID, which is preset in its secure storage area at the factory. The ECU also has preset transmission decryption rules, which are used to parse the received encrypted transmission data.

[0062] The server and the flashing device can exchange data via a USB flash drive, SD card, or network connection. The flashing device and the target ECU can be connected via a CAN bus, Ethernet bus, or diagnostic interface.

[0063] In the software encryption preprocessing, a unique software ID is assigned to the software to be flashed, and a target encryption algorithm is selected from multiple candidate encryption algorithms based on the software ID. The target encryption algorithm is used to encrypt the software to be flashed, generating an encrypted software package; the encrypted software package contains the software ID.

[0064] In this embodiment, the software encryption preprocessing is performed by the server before the software is released, specifically as follows:

[0065] Assign a unique software ID to the software to be flashed. The software ID can be a string containing version information, vehicle model information, customer code, etc., such as "SQ01-TS001-GL8001001". This software ID will be written to a specified location in the encrypted software package for subsequent authentication and decryption algorithm indexing.

[0066] The system has three preset encryption levels: low, medium, and high. Software developers select the encryption level when generating the encryption software package, based on the software's importance and the client's security requirements. Different encryption levels correspond to different key lengths and encryption strengths. Furthermore, multiple encryption algorithms are pre-stored in the algorithm library, such as 3 encryption levels × 10 sets of algorithms, totaling 30 different encryption algorithms. The target encryption algorithm is selected from multiple candidate algorithms based on the software ID, specifically as follows:

[0067] Convert each digit of the software ID to a hexadecimal value according to the ASCII code. For example, the software ID SQ01 is converted to S→0x53, Q→0x51, 0→0x30, 1→0x31.

[0068] Perform an XOR operation on each of the converted hexadecimal values ​​in sequence to obtain the first result (denoted as hex1), such as 0x53⊕0x51⊕0x30⊕0x31= 0x13.

[0069] Take each decimal digit of the first operation result to obtain the encryption algorithm number between 0 and 9. For example, 0x13 is converted to decimal as 19. Take the tens digit and the units digit to get 1 and 9. You can take the units digit 9 as the encryption algorithm number, or combine them according to preset rules.

[0070] Based on the preset encryption level and algorithm number, the corresponding target encryption algorithm is determined from the algorithm library. For example, if the encryption level is medium and the algorithm number is 3, then the third encryption algorithm in the medium-level algorithm library is selected.

[0071] Next, an encryption key corresponding to the encryption level is generated based on the software ID. This key is used to encrypt and decrypt the software. The key generation method is as follows:

[0072] In the low encryption level, the first operation result (hex1) is used as the key, and the key length is 8 bits. Hex1 is the result of XORing the hexadecimal values ​​of the software ID in sequence; for example, if hex1 is 0x13, the low-level key is 0x13.

[0073] In the medium encryption level, the key is a combination of the first operation result (hex1) and the second operation result (hex2). The key length is 16 bits. Hex2 is the result of summing the hexadecimal values ​​of the software ID in sequence and taking the lower 8 bits. For example, summing 0x53, 0x51, 0x30, and 0x31 gives 0x105. Taking the lower 8 bits gives 0x05, so hex2 is 0x05. The medium encryption level key is 0x1305.

[0074] In the high encryption level, the key is a combination of the first operation result (hex1), the second operation result (hex2), and the third operation result (hex3). The key length is 24 bits. Hex3 is the result of XORing the hexadecimal values ​​of the software ID in sequence, summing them, and taking the lower 8 bits. For example, hex3 is calculated by first XORing the result 0x13, then adding it to the accumulated value 0x105 to get 0x118, and taking the lower 8 bits to get 0x18. That is, hex2 is 0x18, and the high-level key is 0x130518.

[0075] To ensure the security and reliability of key storage and prevent key tampering or damage, this embodiment stores the key in multiple consecutive preset locations, with the keys stored in different preset locations exhibiting an increasing numerical relationship.

[0076] For example, the key can be stored in 5 consecutive preset positions in the encryption software package, and the value stored in each position is in an increasing relationship. Specifically, position 1 stores the original key value, position 2 stores the key + 1, position 3 stores the key + 2, position 4 stores the key + 3, and position 5 stores the key + 4. If the key is 0x13, then position 1 stores 0x13, position 2 stores 0x14, position 3 stores 0x15, position 4 stores 0x16, and position 5 stores 0x17.

[0077] In this embodiment, the specific steps for generating the encrypted software package are as follows:

[0078] The selected target encryption algorithm and the generated key are used to encrypt the software to be flashed, generating an encrypted software package. The encrypted software package contains the following information: software ID, encryption level, algorithm number, key stored in multiple locations, and encrypted software data.

[0079] Finally, the encrypted package is packaged into a file of a specific format, such as test.pack, for easy distribution and storage.

[0080] In identity authentication, when the target electronic control system is flashed by the flashing device, the software ID in the encrypted software package, the device ID of the flashing device, and the system ID of the target electronic control system are obtained, and the combination of the software ID, device ID, and system ID is verified.

[0081] Each authorized flashing device is assigned a unique device ID at the factory. This ID is stored in a secure storage area inside the device. The flashing device periodically updates the whitelist, algorithm mapping relationships, and algorithm library from the server.

[0082] The whitelist contains a list of combinations of authorized software IDs, device IDs, and system IDs.

[0083] The algorithm mapping table records the correspondence between software IDs and decryption algorithms. The flashing device can index the corresponding decryption algorithm from the mapping table based on the software ID.

[0084] The algorithm library contains decryption algorithms corresponding to encryption algorithms, organized by encryption level and algorithm number.

[0085] The data is protected by digital signatures when it is transmitted to the writing device to ensure the authenticity and integrity of its source.

[0086] The flashing device also has pre-set communication encryption rules, including the number of passwords (associated with the target ECU) and CRC check algorithm for transmitting encryption.

[0087] The on-site rewriting process is as follows:

[0088] The technician connects the flashing device to the diagnostic interface of the target ECU. After the flashing device is powered on, it first reads the electronic control system ID stored in the ECU via the CAN bus. The system ID is a unique identifier for each ECU, such as ECU-2024-001.

[0089] The technician selects the encrypted software package (e.g., test.pack) to be flashed on the flashing device, and the flashing device performs the following authentication operations:

[0090] 1. Read the software ID, key (read from 5 consecutive positions), encryption level, algorithm number, and other information from the encrypted software package;

[0091] 2. Obtain the device ID stored within itself;

[0092] 3. Obtain the target ECU system ID;

[0093] 4. Verify the combination of software ID, device ID, and system ID. The verification method in this embodiment includes whitelist comparison or calculation of verification code through a preset algorithm. The specific verification method can be selected according to the actual situation.

[0094] The whitelist comparison process is as follows: The flashing device combines the software ID, device ID, and system ID into a triplet and compares it with the locally stored whitelist. If the triplet exists in the whitelist, the verification passes and the flashing device continues to execute subsequent steps; otherwise, the verification fails. Records in the whitelist are obtained from the server when the device is remotely updated.

[0095] The verification code is calculated using a preset algorithm as follows: The flashing device reads the key stored in the encryption software package (from 5 consecutive positions). Simultaneously, following the same rules as the software encryption preprocessing, the flashing device calculates the key based on the software ID. If the read key matches the calculated key, the verification passes, and the flashing device continues with subsequent steps; otherwise, the verification fails.

[0096] In addition, the flashing device also verifies the numerical increment relationship between the five position keys. It verifies whether the key at position 2 is equal to the key at position 1 + 1, the key at position 3 is equal to the key at position 1 + 2, and so on. If the key at any position does not satisfy the increment relationship, it is determined that the key has been tampered with and the verification fails.

[0097] When verification fails, the flashing device records a failure count. The device maintains an internal failure counter to record the number of consecutive authentication failures. When the number of consecutive failures reaches a preset threshold (e.g., 10 times), the flashing device automatically locks its flashing function. Once locked, the device can no longer perform any flashing operations and must be returned to the manufacturer for unlocking by a professional using specialized tools. This mechanism effectively prevents brute-force attacks.

[0098] If authentication fails but the lockout threshold is not reached, the flashing device will stop the current flashing operation and display an error message on the screen (such as device unauthorized or ECU mismatch), and wait for the next operation attempt. When subsequent authentication is successful, the failure counter will be cleared to zero.

[0099] In dynamic decryption, once the verification is successful, the target decryption algorithm corresponding to the software ID is determined by indexing from multiple candidate decryption algorithms based on the software ID, and then the encrypted software package is decrypted using the target decryption algorithm.

[0100] After successful identity authentication, the flashing device performs a dynamic decryption operation:

[0101] 1. Based on the software ID, the corresponding decryption algorithm is indexed from the mapping table. Specifically, the flashing device reads the encryption level and algorithm number stored in the encryption software package and selects the corresponding decryption algorithm from the local algorithm library.

[0102] 2. Decrypt the encrypted software package using the selected decryption algorithm and key (the key read from the encrypted software package) to recover the original executable program. For example, if the encryption level is medium and algorithm 3 is used, then the decryption will also use algorithm 3 from the medium decryption library and a medium-level key.

[0103] During the flashing process, the decrypted software is flashed onto the target electronic control system.

[0104] After decryption, the flashing device obtains the original software data (executable binary file). To prevent information leakage and cracking during communication, the flashing device encrypts the transmission process, specifically as follows:

[0105] 1. Obtain the password number associated with the target ECU. The password number is a preset 8-digit hexadecimal value (e.g., 0x8E). Each ECU has a unique password number preset at the factory, which is stored in the ECU's secure storage area. The flashing device obtains this password number by reading the ECU.

[0106] 2. Divide the decrypted software data into blocks, and encapsulate each block into a transmission frame. XOR each byte (except the last byte) in each frame with the ciphertext number before sending. For example, if a byte's value is 0xA5 and the ciphertext number is 0x8E, the XOR operation will result in 0xA5⊕0x8E=0x2B.

[0107] 3. The last byte of each data frame is a transmission checksum, which is calculated from each byte of the data frame (including the data after XOR encryption) using a Cyclic Redundancy Check (CRC) algorithm. The receiving end can use this checksum to verify the integrity of the data transmission.

[0108] The target ECU receives encrypted data transmitted by the flashing device via the CAN bus, specifically:

[0109] 1. For each frame of data received, perform an XOR operation using the same password number as the flashing device to decrypt the original data.

[0110] 2. Verify data integrity based on the last byte (transmission checksum) of each data frame. If the CRC check passes, accept the data frame; if the check fails, request the flashing device to retransmit.

[0111] 3. Write the decrypted and verified software data sequentially into the designated area of ​​the ECU's Flash memory.

[0112] Once all data transmission is complete, the ECU verifies the integrity and validity of the written software data. If the verification passes, the ECU records information about this flashing operation (including software ID, device ID, timestamp, etc.) and prepares to start the new software; if the verification fails, the ECU starts the existing software from the backup storage area to ensure device availability.

[0113] This implementation has the following beneficial effects:

[0114] 1. High Security: The software ID dynamically determines the encryption algorithm and key. Even if an attacker cracks one algorithm, they cannot decrypt other software packages using different algorithms. Triple ID binding ensures that only the "correct software" can be flashed onto the "designated controller" through the "authorized device." XOR encryption during communication further guarantees transmission security.

[0115] 2. Strong traceability: The binding relationship between software ID, device ID, and system ID ensures that every legitimate flashing operation is traceable. Failure counts and lock events recorded by the flashing device can also be used for security auditing.

[0116] 3. Flexible offline operation: This solution does not require real-time connection to the cloud server. The whitelist and algorithm mapping table can be pre-stored in the flashing device through physical media or by periodic updates, making it suitable for scenarios with poor network environments such as workshops and the field.

[0117] 4. Anti-tampering protection: The multi-location incremental storage mechanism of the key makes it difficult for attackers to tamper with the key without destroying the numerical relationship, even if they read the encrypted software package, thus improving the anti-tampering capability.

[0118] 5. Brute-force prevention: The continuous failure locking mechanism effectively prevents attackers from performing brute-force attacks through repeated attempts.

[0119] Example 2

[0120] The difference between the electronic control system software security flashing method provided in this embodiment and the first embodiment is as follows:

[0121] This embodiment uses specific numerical values ​​as an example to illustrate the writing process:

[0122] 1. Software encryption preprocessing:

[0123] The software to be flashed is the engine control program for a certain car model. The software developer has assigned it the software ID SQ01-TS001-GL8001001, and the default encryption level is medium.

[0124] Convert the software ID to a sequence of hex values, and XOR the result to get hex1 = 0x2A. Take the decimal digits of hex1 to get 0x2A = 42, and take the units digit 2 to get the algorithm number 2. Select algorithm number 2 from the intermediate algorithm library (e.g., a custom encryption algorithm based on SM4).

[0125] At this point, hex1 = 0x2A; the accumulated hex value is taken as the lower 8 bits, resulting in hex2 = 0x4C; after XORing and summing, the lower 8 bits are taken as hex3 = 0x7E; therefore, the low-level key is 0x2A, and the medium-level key is hex1 + hex2 = 0x2A4C.

[0126] The key is stored at position 1: 0x2A4C; position 2: 0x2A4D; position 3: 0x2A4E; position 4: 0x2A4F; position 5: 0x2A50.

[0127] The software is encrypted using the SM4 algorithm and the key 0x2A4C to generate the encrypted software package Engine_Control.pack.

[0128] 2. Identity Authentication:

[0129] The authorized flashing device ID is DIAG-2024-001. The whitelist in the device has been updated from the server and includes the triplet (SQ01-TS001-GL8001001, DIAG-2024-001, ECU-2024-001). The algorithm mapping table records the correspondence between the software ID and the decryption algorithm.

[0130] The technician connected the flashing device to the target ECU (System ID: ECU-2024-001) and selected the encrypted software package Engine_Control.pack.

[0131] Next, read the software ID as SQ01-TS001-GL8001001, the device ID as DIAG-2024-001, and the system ID as ECU-2024-001;

[0132] The flashing device combines the software ID, device ID, and system ID into a triple and compares it with a locally stored whitelist. If the triple exists in the whitelist, the verification passes, and the flashing device continues with subsequent steps.

[0133] Next, read the 5 location keys, verify that the incrementing relationship is correct, and then perform dynamic decoding.

[0134] 3. Dynamic decryption:

[0135] Decrypt the software package using the software ID from the mapping table index decryption algorithm (intermediate level 2), and use the key 0x2A4C to recover the original executable program.

[0136] 4. Rewriting:

[0137] The ECU password number is 0x8E. Each frame of data is XORed with 0x8E and then sent. A CRC checksum is added to the last byte of each frame. The ECU receives, decrypts, verifies, and stores the data. Finally, the ECU successfully writes the new software and records the operation log.

[0138] Example 3

[0139] This embodiment provides a secure software flashing device for an electronic control system, comprising:

[0140] The encryption module is used to assign a unique software ID to the software to be flashed, select a target encryption algorithm from multiple candidate encryption algorithms based on the software ID, encrypt the software to be flashed using the target encryption algorithm, and generate an encrypted software package; the encrypted software package contains the software ID;

[0141] The identity authentication module is used to obtain the software ID in the encrypted software package, the device ID of the flashing device, and the system ID of the target electronic control system when the target electronic control system is flashed through the flashing device, and to verify the combination of the software ID, device ID, and system ID.

[0142] The decryption module is used to, after verification, index from multiple candidate decryption algorithms based on the software ID and determine the target decryption algorithm corresponding to the software ID, and use the target decryption algorithm to decrypt the encrypted software package;

[0143] The flashing module is used to flash the decrypted software onto the target electronic control system.

[0144] It should be noted that the electronic control system software security flashing device provided in this embodiment is similar to that in Embodiment 1, and will not be described in detail here.

[0145] Note that the above description is merely a preferred embodiment of the present invention and the technical principles employed. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and various obvious changes, readjustments, and substitutions can be made without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in detail through the above embodiments, the present invention is not limited to the above embodiments, and may include many other equivalent embodiments without departing from the concept of the present invention, the scope of which is determined by the scope of the appended claims.

Claims

1. A method for securely flashing software in an electronic control system, characterized in that, include: Assign a unique software ID to the software to be flashed, select a target encryption algorithm from multiple candidate encryption algorithms based on the software ID, encrypt the software to be flashed using the target encryption algorithm, and generate an encrypted software package; The encrypted software package contains a software ID; When flashing the target electronic control system using a flashing device, the software ID in the encrypted software package, the device ID of the flashing device, and the system ID of the target electronic control system are obtained, and the combination of the software ID, device ID, and system ID is verified. Once the verification is successful, the target decryption algorithm corresponding to the software ID is determined by indexing from multiple candidate decryption algorithms based on the software ID, and the encrypted software package is decrypted using the target decryption algorithm. The decrypted software is then flashed onto the target electronic control system.

2. The method for securely flashing software in an electronic control system according to claim 1, characterized in that, The step of selecting the target encryption algorithm from multiple candidate encryption algorithms based on the software ID specifically involves: Convert each digit of the software ID to a hexadecimal value according to the ASCII code; Perform an XOR operation on each of the converted hexadecimal values ​​to obtain the first result. Take the decimal digits of the first operation result to obtain the algorithm number; Based on the preset encryption level and algorithm number, the corresponding target encryption algorithm is determined from the algorithm library.

3. The method for securely flashing software in an electronic control system according to claim 2, characterized in that, After determining the corresponding target encryption algorithm from the algorithm library based on the preset encryption level and algorithm number, the process further includes: An encryption key of the corresponding level is generated based on the software ID; the encryption key levels include low encryption level, medium encryption level, and high encryption level. In lower encryption levels, the result of the first operation is used as the key; In the medium encryption level, the key is the combination of the first and second operation results, where the second operation result is the result of sequentially summing the hexadecimal values ​​of the software ID and taking the lower 8 bits. In high encryption levels, the key is a combination of the first, second, and third operation results; the third operation result is the sum of the hexadecimal values ​​of the software ID after XORing them in sequence and taking the lower 8 bits.

4. The method for securely flashing software in an electronic control system according to claim 1, characterized in that, The generated encryption software package stores keys in multiple consecutive preset locations, and the keys stored in different preset locations have an increasing numerical relationship.

5. The method for securely flashing software in an electronic control system according to claim 4, characterized in that, The verification of the combination of software ID, device ID and system ID also includes: reading keys from multiple consecutive preset positions and verifying whether the numerical increment relationship between each key is consistent with the preset rule.

6. The method for securely flashing software in an electronic control system according to claim 4, characterized in that, The specific steps for verifying the combination of software ID, device ID, and system ID are as follows: The software ID, device ID, and system ID are combined into authentication information according to preset rules; The authentication information is compared with the locally stored whitelist, or the authentication information is calculated using a preset verification algorithm and compared with the key pre-stored in the encryption software package. Verification is confirmed to be successful only if the comparison matches.

7. The method for securely flashing software in an electronic control system according to claim 1, characterized in that, The process of flashing the decrypted software onto the target electronic control system specifically includes: The flashing device uses transmission encryption rules to encrypt and transmit the decrypted software data. The target electronic control system decrypts the encrypted transmission data according to the preset transmission decryption rules and stores it in the controller storage area.

8. The method for securely flashing software in an electronic control system according to claim 7, characterized in that, The transmission encryption rules include: Obtain the number of passwords associated with the target electronic control system, where the number of passwords is a preset value; Each byte in each frame of data is XORed with the number of cipher bits before being sent. The last byte of each frame of data is the transmission check code, which is calculated from each byte of the frame of data using a cyclic redundancy check algorithm.

9. The method for securely flashing software in an electronic control system according to claim 1, characterized in that, After verifying the combination of software ID, device ID, and system ID, the method further includes: when the verification fails, recording the number of failures; when the number of consecutive failures reaches a preset threshold, locking the write function.

10. A flashing device based on the electronic control system software security flashing method according to any one of claims 1-9, characterized in that, include: The encryption module is used to assign a unique software ID to the software to be flashed, select a target encryption algorithm from multiple candidate encryption algorithms based on the software ID, encrypt the software to be flashed using the target encryption algorithm, and generate an encrypted software package. The encrypted software package contains a software ID; The identity authentication module is used to obtain the software ID in the encrypted software package, the device ID of the flashing device, and the system ID of the target electronic control system when the target electronic control system is flashed through the flashing device, and to verify the combination of the software ID, device ID, and system ID. The decryption module is used to, after verification, index from multiple candidate decryption algorithms based on the software ID and determine the target decryption algorithm corresponding to the software ID, and use the target decryption algorithm to decrypt the encrypted software package; The flashing module is used to flash the decrypted software onto the target electronic control system.

Images