Vehicle terminal dynamic sampling starting and key loading method without hardware acceleration

Abstract

The application discloses a kind of vehicle terminal without hardware acceleration dynamic sampling start and key filling method, this method includes: production line offline stage is fragmented and prestores integrity check value to security preset area to firmware;Read OTP key state after power on, enter filling mode when not write, enter finished product mode when have written;In finished product mode, multiple physical heterogeneous entropy sources are synchronously collected in power-on transient window, random seed is generated after extreme filtering and nonlinear confusion;Dynamically determine sampling position and quantity according to random seed, carry out integrity check to the fragment extracted, start application program after all pass;In filling mode, receive encrypted key through CAN-UDS online, write OTP and hardware lock, automatically switch to finished product mode after power on again.The application realizes the overall linkage of security start and key filling under the condition of not depending on hardware encryption acceleration, and has start timeliness, attack resistance and production line convenience.

Description

Technical Field

[0001] This application relates to the field of vehicle terminal information security technology, specifically to a dynamic sampling startup and key filling method for vehicle terminals without hardware acceleration, and more particularly to a method and system for achieving secure startup and key filling of vehicle terminals without hardware encryption acceleration. Background Technology

[0002] With the rapid development of intelligent connected vehicles, the firmware security of the onboard remote communication terminal (TBOX), as the core node for vehicle-to-the-world communication, is receiving increasing attention. The ISO 21434 standard for road vehicle information security, published by the International Organization for Standardization, sets forth clear requirements for the secure boot of onboard terminals: during the device boot process, the integrity and authenticity of the firmware should be checked to prevent malicious tampering, virus intrusion, and data leakage.

[0003] Currently, secure boot solutions for automotive TBOX mainly fall into two categories. The first category is the high-end solution: using an MCU with a Hardware Security Module (HSM) and hardware encryption acceleration unit, it performs hash verification on the entire FLASH firmware upon power-up, with verification time controlled within 50 milliseconds, meeting automotive-grade requirements. However, this type of chip has a high unit cost, making mass production and application difficult in economy passenger cars and commercial vehicles. The second category is the low-end general-purpose solution: using a low-cost automotive-grade MCU without hardware encryption acceleration. Current industry practices mainly include two methods: one is full software verification, which involves hashing the entire FLASH firmware purely in software. Verification time typically exceeds 300 milliseconds, exceeding the hard requirement of no more than 200 milliseconds for application response time from power-up, as generally required by automakers; the other is fixed-position sampling verification, which only verifies a fixed proportion of the pages at the front or back of the FLASH. This type of solution has lower security; attackers can inject malicious code into unverified pages to bypass the secure boot mechanism.

[0004] To address the time-sensitive issues of the aforementioned low-end general-purpose solutions, the industry has proposed an improved approach using random sampling verification, which utilizes random numbers to determine the sampling position. However, existing random sampling schemes typically use only the system clock as a single entropy source to generate random numbers. The system clock can be tampered with or predicted via the JTAG debugging interface, making the sampling sequence predictable and rendering the secure startup mechanism ineffective. Furthermore, existing solutions do not support integrated design with the production line key loading process. Key loading often requires offline programming at the die stage. If a key loading error occurs or after-sales key leakage occurs, the TBOX casing must be disassembled, the MCU desoldered, and reprogrammed, resulting in extremely low production line efficiency and maintainability.

[0005] Therefore, there is an urgent need for a comprehensive solution that can balance startup timeliness, security and anti-attack capabilities, and ease of production line key filling without hardware encryption acceleration. Summary of the Invention

[0006] This application provides a method and system for dynamic sampling startup and key filling of vehicle-mounted terminals without hardware acceleration, aiming to solve at least one of the technical problems existing in the prior art.

[0007] To achieve the above objectives, the present application adopts the following technical solution.

[0008] In a first aspect, embodiments of this application provide a method for dynamic sampling startup and key filling of an in-vehicle terminal without hardware acceleration, including:

[0009] Step S1: Divide the target firmware into multiple verification fragments according to the page size of the physical storage medium, calculate the first integrity verification value for each verification fragment, and store all the first integrity verification values ​​in the security preset area in the storage medium, and enable hardware-level write protection for the security preset area.

[0010] Step S2: Read the key status identifier in the one-time programmable storage area; if the key status identifier is in an unwritten state, enter the filling mode and execute step S5; if the key status identifier is in a state where a valid key has been written, enter the finished product operation mode and execute step S3.

[0011] Step S3: During the power-on transient window, at least two physically independent hardware random entropy source signals are synchronously acquired, and the physical generation mechanisms of each hardware random entropy source signal are different; after performing extreme value filtering preprocessing on each channel of raw acquired data, the multi-channel preprocessing results are input into a nonlinear conflation operation to output a random seed value.

[0012] Step S4: Determine the sampling start position and sampling quantity based on the random seed value; dynamically extract the target fragment from the verification fragment, and the target fragment does not contain the fixed protection partition storing the interrupt vector table in the storage medium; recalculate the second integrity verification value of the target fragment piece by piece, and compare it with the corresponding pre-stored value in the security preset area; if all are consistent, jump to the application area for execution; if there is a discrepancy, trigger security locking;

[0013] Step S5: In the filling mode, the encrypted key data packet sent by the host computer is received through the vehicle diagnostic bus. After decrypting and verifying the validity of the encrypted key data packet, the valid key is written into the one-time programmable storage area and a hardware lock is triggered. The hardware lock causes the one-time programmable storage area to lose any rewrite capability. After power is restored, the key status indicator is switched to the state of having a valid key written, and the filling mode is automatically exited.

[0014] Furthermore, the at least two physically independent hardware random entropy source signals include at least two of the following three categories: chip junction temperature analog quantity, power supply ripple analog quantity, and free-running counter count value;

[0015] These three types of entropy source signals come from the chip's analog-to-digital converter channel, power management unit, and system timer, respectively, and the three do not share a signal link in the front-end analog / digital domain.

[0016] Furthermore, the nonlinear obfuscation operation is a multi-level hybrid hash folding operation, which includes at least the following steps in sequence: concatenating the preprocessing results of each path into intermediate bit-width data and then performing multiplication obfuscation operation, cyclic shift operation, byte rearrangement operation, and XOR compression operation; wherein, at least one operand in the multiplication obfuscation operation is a fixed nonlinear constant, and the shift amount of the cyclic shift operation is dynamically determined by at least one byte in the preprocessing results.

[0017] Furthermore, the power-on transient window period is defined as the time period between the chip reset release and the setting of the system master clock stabilization flag; during this window period, the acquisition and latching of at least two hardware random entropy source signals are synchronously initiated by the same hardware trigger signal; the hardware trigger signal is aligned with the chip reset release signal edge and is not triggered by a software instruction sequence.

[0018] Further, determining the sampling start position and sampling quantity based on the random seed value specifically includes:

[0019] The random seed value is split into a first field and a second field;

[0020] Perform a modulo operation between the first field and the total number of verification fragments to obtain the initial starting fragment number, and determine whether the initial starting fragment number falls within the fixed protection partition. If so, shift backward to the first non-protected fragment according to the preset offset rule, and use the offset number as the sampling starting position.

[0021] The second field is converted into the number of sampling fragments according to a preset mapping rule, and the ratio of the number of sampling fragments to the total number of verification fragments is not less than the preset minimum sampling rate threshold.

[0022] Starting from the sampling start position, select the number of sampling fragments along the continuous address direction as the target fragments.

[0023] Furthermore, in step S5, the encrypted key data packet is encrypted using a session-level dynamic key for double-layer encryption: the first layer uses the device root key pre-installed in the Bootloader to decrypt the outer ciphertext of the encrypted key data packet to obtain the session key; the second layer uses the session key to decrypt the inner ciphertext of the encrypted key data packet to obtain the legitimate key; wherein, the session key is dynamically generated by the host computer based on the random challenge value reported by the vehicle terminal, and is valid for a single filling session.

[0024] Furthermore, after the hardware lock is triggered in step S5, in addition to losing the ability to rewrite, the one-time programmable memory area also triggers at least one of the following protective actions simultaneously: disabling the debugging interface of the vehicle terminal, disabling the non-volatile memory readback function of the vehicle terminal, and adding an exponential backoff delay before allowing the next retry after each power-on verification failure.

[0025] Furthermore, the security lock is an irreversible lock, including a physical fuse lock on the one-time programmable memory area, and the physical fuse lock is independent of the power supply status of the vehicle terminal;

[0026] Once the irreversible lock takes effect, the legitimate key written into the one-time programmable storage area remains readable but unwriteable throughout the chip's entire lifecycle.

[0027] Secondly, embodiments of this application provide a system capable of implementing the dynamic sampling initiation and key filling method described in any of the foregoing claims, comprising:

[0028] The storage medium partitioning module is used to divide the page size of the target firmware physical storage medium into multiple verification fragments, calculate the first integrity verification value of each verification fragment, and store it in the security preset area, and enable hardware-level write protection for the security preset area.

[0029] The mode determination module is connected to the one-time programmable memory area and is used to read the key status identifier in the one-time programmable memory area after power-on reset, and output a mode switching signal according to the key status identifier; the mode switching signal includes a first level signal indicating the filling mode and a second level signal indicating the finished product operation mode;

[0030] The multi-source entropy acquisition module includes at least two physically decoupled entropy source acquisition sub-units. Each entropy source acquisition sub-unit is used to acquire a type of hardware random entropy source signal during the power-on transient window. The multi-source entropy acquisition module also includes an extreme value filtering sub-module and a nonlinear confusion operation sub-module. The extreme value filtering sub-module is used to perform anti-extreme value preprocessing on each channel of raw acquisition data, and the nonlinear confusion operation sub-module is used to fuse the preprocessing results of multiple channels and output a random seed value.

[0031] The dynamic sampling verification module is connected to the multi-source entropy acquisition module to receive the random seed value. It is used to determine the sampling start position and sampling quantity based on the random seed value, dynamically extract the target fragment that does not contain the interrupt vector table protection partition from the verification fragment, recalculate the second integrity verification value of the target fragment, and compare it with the corresponding pre-stored value in the security preset area. If all the comparisons are consistent, the execution permission of the application area is released; if there is a discrepancy, a system lock signal is output.

[0032] The key filling execution module is connected to the mode determination module to receive the first level signal. It is used to receive the encrypted key data packet through the vehicle diagnostic bus in the filling mode, and write the legitimate key into the one-time programmable storage area after decryption and legality verification, and trigger the hardware lock signal. The hardware lock signal is used to make the one-time programmable storage area lose any rewrite capability.

[0033] The mode determination module is further configured to switch the key status identifier to the state of having a valid key written after writing a valid key into the one-time programmable storage area and triggering the hardware lock signal, so that the mode switching signal will automatically switch to the second level signal upon the next power-on.

[0034] Thirdly, embodiments of this application provide an electronic device, including: one or more processors;

[0035] A memory for storing one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors are able to implement the steps in the dynamic sampling startup and key filling method described in any of the preceding claims.

[0036] Fourthly, embodiments of this application provide a computer-readable medium storing a computer program, which, when executed by a processor, can implement the steps in the dynamic sampling initiation and key filling method described in any of the preceding claims.

[0037] This application discloses a dynamic sampling boot and key loading method for vehicle-mounted terminals without hardware acceleration. The method includes: during the offline production line phase, fragmenting the firmware and pre-storing integrity verification values ​​in a secure preset area; upon power-on, reading the OTP key status, entering loading mode if not written, and entering finished product mode if written; in finished product mode, synchronously acquiring multiple physical heterogeneous entropy sources during the power-on transient window, generating a random seed through extreme value filtering and nonlinear obfuscation; dynamically determining the sampling position and quantity based on the random seed, performing integrity verification on the sampled fragments, and starting the application after all fragments pass; in loading mode, receiving the encryption key online via CAN-UDS, writing it to the OTP and hardware locking it, and automatically switching to finished product mode upon power-on again. This application achieves integrated secure boot and key loading without relying on hardware encryption acceleration, combining boot timeliness, attack resistance, and production line convenience. Attached Figure Description

[0038] Figure 1 A schematic diagram of the core process of a dynamic sampling startup and key filling method for a vehicle terminal without hardware acceleration provided in an embodiment of this application;

[0039] Figure 2 This is a schematic diagram of the FLASH partition structure provided in the embodiments of this application;

[0040] Figure 3 A schematic diagram illustrating the process of synchronous acquisition and nonlinear conflation calculation of three transient physical entropy sources provided in this application embodiment;

[0041] Figure 4 This is a schematic diagram of the signaling interaction for CAN-UDS online OTP key filling provided in an embodiment of this application;

[0042] Figure 5 This is a structural block diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0043] To enable those skilled in the art to better understand the technical solutions of this application, exemplary embodiments of this application are described below with reference to the accompanying drawings, including various details of the embodiments of this application to aid understanding. These should be considered merely exemplary. Therefore, those skilled in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this application. Similarly, for clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description. Unless otherwise specified, the various embodiments of this application and the features within those embodiments can be combined with each other.

[0044] As used herein, the term "and / or" includes any and all combinations of one or more of the associated enumerated entries. The terminology used herein is for describing particular embodiments only and is not intended to limit the application. As used herein, the singular forms "a" and "the" are also intended to include the plural forms, unless the context clearly indicates otherwise. It should also be understood that when the terms "comprising" and / or "made of" are used herein, the presence of the stated feature, integral, step, operation, element, and / or component is specified, but the presence or addition of one or more other features, integrals, steps, operations, elements, components, and / or groups thereof is not excluded. Terms such as "connected" or "linked" are not limited to physical or mechanical connections but can include electrical connections, whether direct or indirect.

[0045] Unless otherwise specified, all terms used in this application (including technical and scientific terms) have the same meaning as commonly understood by one of ordinary skill in the art. It should also be understood that terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning in the context of the relevant art and this application, and will not be interpreted as having an idealized or overly formal meaning, unless expressly so defined in this application.

[0046] In the description of this application, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. The term "multiple" means two or more, unless otherwise expressly defined.

[0047] To facilitate understanding of this application, some terms used below will be explained first:

[0048] "One-Time Programmable Memory" (OTP) refers to a memory area within a chip that can only be written to once and cannot be modified permanently. In various embodiments of this application, the OTP is used to store device keys, and once written, it is hardware-locked and cannot be rewritten.

[0049] "Cipher-based Message Authentication Code" (CMAC) refers to a message authentication code based on block ciphers. It is a keyed hash integrity verification code that has stronger anti-tampering capabilities than ordinary hashes. In various embodiments of this application, CMAC is used to generate keyed integrity verification values ​​for firmware fragments.

[0050] "Unified Diagnostic Services" (UDS) refers to the universal diagnostic protocol for the vehicle CAN bus that conforms to the ISO 14229 standard and is a standard diagnostic communication protocol for OEMs.

[0051] "Power-on transient window": refers to the extremely short period of fluctuation after the chip is powered on, during which the power supply and temperature have not yet stabilized, typically within a few milliseconds after power-on. In the embodiments of this application, the hardware signals acquired during this window period have the highest unpredictability.

[0052] I. Overall Method and Process

[0053] This embodiment details the overall implementation process of the lightweight secure boot and key filling method for vehicle terminals based on hardware-free encryption acceleration provided in this application.

[0054] The hardware platform adapted in this embodiment is the GD32A508 series automotive-grade MCU. This chip has no HSM hardware security module, no SHA256 hardware acceleration core, and no AES-CMAC hardware acceleration. It relies solely on the on-chip basic ADC, SysTick, OTP, and CAN peripherals, without any external encryption chips. The total FLASH size is 512 KB, with an address range of 0x08000000 to 0x0807FFFF, and the RAM size is 128 KB.

[0055] See Figure 1 The vehicle terminal dynamic sampling startup and key filling method without hardware acceleration in this embodiment includes the following five serial steps.

[0056] Step S1: Divide the target firmware into multiple verification fragments according to the page size of the physical storage medium, calculate the first integrity verification value for each verification fragment, and store all the first integrity verification values ​​in the security preset area in the storage medium, and enable hardware-level write protection for the security preset area.

[0057] During the offline production line phase, the target firmware is first partitioned and pre-verified.

[0058] (1) Hard partitioning of FLASH. In this embodiment, the FLASH address space is partitioned as follows:

[0059] BOOT area: Address range 0x08000000 to 0x0800FFFF, size 64 KB, stores the bootloader. This area is burned once during production and cannot be rewritten permanently afterward.

[0060] APP Application Area: Address range 0x08010000 to 0x0807DFFF, size 496 KB, stores the main business firmware.

[0061] Security Preset Page: Address range 0x0807E000 to 0x0807EFFF, size 8 KB (actually occupied 4 KB), dedicated to storing the CMAC checksum of all segments, enabling MCU hardware-level FLASH write protection, this area cannot be erased or rewritten by any instruction in the APP runtime state.

[0062] The above partitioning structure is as follows Figure 2 As shown.

[0063] (2) Fragmentation rules. Logical fragmentation is performed according to the physical page size of FLASH (8 KB). The APP area (496 KB) is divided into 62 verification fragments, numbered from fragment 0 to fragment 61. Among them, fragment 0 (address range 0x08010000 to 0x08011FFF) stores the interrupt vector table and belongs to the fixed protection partition, which will be hard-masked in subsequent dynamic sampling verification.

[0064] (3) Checksum Calculation Process. For each checksum fragment, the following operations are performed: Read all the data (8 KB) of the fragment, calculate the SHA256 digest (32 bytes) using the mbedTLS pure software library, and then use the OTP factory default key (all 0xFF, 32 bytes) as the AES-256-CMAC key to calculate the CMAC checksum (16 bytes) of the fragment. The CMAC checksums of all 62 fragments are stored sequentially in the security preset page according to the fragment number, and the image version number (4 bytes), cyclic redundancy check value (CRC, 4 bytes), and fault count field (4 bytes) are attached to the header of the security preset page.

[0065] (4) Hardware-level write protection enabled. After all checksums are written to the secure preset page, hardware-level write protection is enabled for the FLASH sector containing the secure preset page by configuring the write protection bit in the FLASH option byte of the MCU. Once enabled, no software instruction (including code running in privileged mode) can perform erase or write operations on this area. Protection can only be removed under specific hardware conditions after chip reset (such as full chip erase), thus ensuring the immutability of the pre-stored checksums.

[0066] Step S2: Read the key status identifier in the one-time programmable storage area; if the key status identifier is in an unwritten state, enter the filling mode and execute step S5 below; if the key status identifier is in a state where a valid key has been written, enter the finished product operation mode and execute step S3 below.

[0067] After the MCU is powered on and reset, the program counter first jumps to the starting address of the BOOT area, and the Bootloader code is executed first, without entering any application code.

[0068] The first operation performed by the bootloader is to read data from the OTP 32-byte key storage area and determine the mode based on the read result.

[0069] Judgment Condition 1: If all 32 bytes of data in the OTP are 0xFF (i.e., the chip's default state, and no legitimate key has been written), it is determined to be in an unwritten state and enters factory filling mode. In this factory filling mode, the Bootloader forcibly disables APP jump permissions (i.e., does not execute any instructions to jump to the APP area), blocks all peripheral business functions (including but not limited to interrupt responses from communication peripherals such as SPI, I2C, and UART), and only initializes the CAN controller and continuously listens for UDS messages on the CAN bus. At the same time, the Bootloader prohibits any bypass operations to exit factory mode—that is, it does not respond to any unauthorized instruction sequences, nor does it respond to interrupt requests from the JTAG debug interface.

[0070] Judgment condition 2: If there is valid key data other than 0xFF in the OTP memory (i.e., a valid key has been written), it is determined that a valid key has been written, and the program enters the finished product running mode. The program flow jumps to step S3 to continue execution.

[0071] In addition, this embodiment also includes fallback logic for exceptions: if a verification error occurs during OTP reading (e.g., the read data does not conform to the expected data format or the checksum is incorrect), the system will be locked directly—the bootloader will enter an infinite loop deadlock state, prohibiting the device from starting, and preventing insecure states caused by key tampering or OTP hardware failure.

[0072] Step S3: During the power-on transient window, at least two physically independent hardware random entropy source signals are synchronously acquired, and the physical generation mechanisms of each hardware random entropy source signal are different; after performing extreme value filtering preprocessing on each channel of raw acquired data, the multi-channel preprocessing results are input into a nonlinear conflation operation to output a random seed value.

[0073] In the finished product operation mode, the Bootloader first performs the collection and generation of random seeds. The specific implementation of this step is as follows.

[0074] (1) Definition of power-on transient window. In this embodiment, the power-on transient window is defined as the time period from the chip reset release (rising edge of NRST pin) to the setting of the system main clock stability flag (RCU_FLAG). The measured window period is approximately 80 microseconds to 120 microseconds (depending on ambient temperature). During this window period, the chip power supply is not fully established, the internal RC oscillator frequency jitter is at its maximum (±3%), and the chip junction temperature rises rapidly. Therefore, the acquired hardware signals have the highest unpredictability.

[0075] (2) Acquisition of three synchronous transient physical entropy sources. In this embodiment, three types of hardware random entropy source signals with different physical generation mechanisms are acquired simultaneously:

[0076] The first entropy source: ADC channel 0 collects the voltage of the internal temperature sensor, which is then calibrated and converted into the chip junction temperature value (accuracy ±2 ℃), reflecting the thermal noise characteristics of the chip in the current power-on transient state.

[0077] The second entropy source: ADC channel 1 collects the power supply ripple after VDD / 3 voltage division, with a sampling rate of 1 MSPS. The variance of 50 consecutive sampling values ​​is taken as the ripple characteristic quantity to reflect the ripple noise characteristics of the power supply during the power-on setup process.

[0078] The third entropy source is the current value of the SysTick free-running counter (SysTick->VAL register), with the clock source being AHB / 8, reflecting the clock jitter characteristics of the system clock during power-on transients.

[0079] The three entropy source signals mentioned above come from the chip's temperature sensor unit (TSENSE), power management unit (PMU), and Cortex-M33 core debugging component, respectively. The three have no shared signal links in the front-end analog / digital domains and are physically uncoupled.

[0080] The acquisition of the three signals is synchronously initiated by the same hardware trigger signal. This hardware trigger signal is aligned with the rising edge of the chip reset release signal and, via a hardware delay chain (not a software delay), simultaneously triggers the injection sampling start of the ADC dual channels and the latching of the SysTick current value's shadow register at a predetermined time after the reset release. After the window period ends (clock stability flag set triggers an interrupt), the software reads the ADC data register and the SysTick shadow register. If the ADC conversion is not completed within the window period, the hardware automatically extends the sampling and holding time to ensure data validity.

[0081] (3) Extreme value filtering preprocessing. Pre-processing is performed to prevent all 0 / all FF values ​​from the three original data acquisition channels: For the junction temperature value and ripple characteristic value acquired by the ADC, if the original data is 0x0000 or 0xFFFF, it is forcibly replaced with a preset replacement value (such as the XOR result of the lower 16 bits of the chip's unique ID and the historical average value of the data channel); for the SysTick count value, if it is 0x00000000 or 0xFFFFFFF, the same replacement processing is performed. The purpose of this processing is to avoid entropy source degradation under extreme hardware conditions (such as all 0 values ​​caused by a short circuit in the ADC input, or all FF values ​​caused by an abnormal ADC reference voltage).

[0082] (4) Multi-order nonlinear obfuscation algorithm. The three preprocessed data are input into the nonlinear obfuscation operation. The specific process is as follows:

[0083] First, the three data streams are concatenated into a middle bit width data. For example, the ADC junction temperature value (16 bits), ripple characteristic value (16 bits), and the lower 16 bits of SysTick (16 bits) are concatenated bit-by-bit in an interleaved manner to form a 48-bit middle value Tmp.

[0084] Secondly, perform the multiplication confusion operation: Tmp = Tmp × 0x9E3779B1 (golden section constant) modulo 2^48.

[0085] Next, perform a dynamic circular shift: take the lower 4 bits of Tmp[15:8] as the left shift amount, and execute Tmp=(Tmp<<shift)|(Tmp> >(48-shift)).

[0086] Next, byte rearrangement is performed: the 48 bits are split into 6 bytes and rearranged according to a fixed substitution table. This substitution table can be associated with the lower 6 bits of the chip's unique ID (96-bit UID), making the obfuscation paths different for different chips.

[0087] Finally, XOR compression is performed: the high 16 bits of the rearranged 48-bit data are XORed with the low 32 bits, and then XORed with the middle 16 bits, ultimately compressed into a 32-bit random seed value.

[0088] Furthermore, this embodiment also includes a hierarchical entropy source extreme value protection mechanism: when performing a secondary verification on the final seed after mixing, if the seed value is all 0s or all FFs, a backup seed (such as the result of SHA256 calculation after combining the chip UID with the seed value from the last successful startup) is forcibly used, ensuring that no predictable random seed is output under any extreme hardware conditions. The process of synchronous acquisition and nonlinear obfuscation of the above three entropy sources is as follows: Figure 3 As shown.

[0089] (5) Anti-attack supplement. This embodiment prohibits the use of any single entropy source as a random seed; all three sources must be fused before output. Actual testing shows that the minimum entropy value of the fused random seed is not lower than 0.998 within the full automotive-grade temperature range of -40℃ to 105℃ (assessed according to NIST SP 800-90B), meeting the security level requirements of ISO 21434 for random number seed entropy sources.

[0090] Step S4: Determine the sampling start position and sampling quantity based on the random seed value, dynamically extract the target fragment from the verification fragment, and the target fragment does not contain the fixed protection partition storing the interrupt vector table in the storage medium; recalculate the second integrity verification value of the target fragment piece by piece, and compare it with the corresponding pre-stored value in the security preset area. If all are consistent, jump to the application area for execution; if there is a discrepancy, trigger security locking.

[0091] After obtaining the 32-bit random seed value, the Bootloader performs dynamic sampling integrity verification, as detailed below.

[0092] (1) Sampling range is hard masked. As mentioned above, the interrupt vector table is stored in the 0th segment of the APP area (address range 0x08010000 to 0x08011FFF). This segment is hard masked in dynamic sampling and is not used as a sampling target. The remaining 61 segments (segment 1 to segment 61) are used as the sampling range.

[0093] (2) Determining the sampling start position and sampling quantity. The 32-bit random seed is split into a first field and a second field: the high 16 bits are used as the first field and the low 16 bits are used as the second field.

[0094] The starting fragment number is calculated as follows: (first field) mod 61 (total number of sampleable fragments) to get the initial number from 0 to 60, and then add 1 (because fragment 0 is masked) to get the actual starting fragment number, which ranges from 1 to 61.

[0095] The sample size is calculated as: (second field mod 15) + 5, with a value range of 5 to 19. To meet the requirement of a sampling rate of not less than 10%, if the calculated sample size is less than 7 (because 10% of 61 pieces is 6.1 pieces, rounded up to 7 pieces), it is padded to 7 pieces. After correction, the sample size ranges from 7 to 19 pieces, and the sampling rate is approximately 11.5% to 31.1%, meeting the minimum sampling rate requirement of not less than 10%.

[0096] (3) Index out-of-bounds correction. If "starting fragment number + sampling quantity - 1" exceeds the maximum fragment number 61, then continue cyclically from fragment 1. For example, if the starting number is 58 and the sampling quantity is 7, then fragments 58, 59, 60, 61, 1, 2, 3 (skipping 0) will be extracted. This correction method ensures that index out-of-bounds errors will not occur and that block extraction in the direction of continuous addresses is always maintained.

[0097] (4) Verification and comparison logic. After determining the target fragment set, the Bootloader reads the firmware data of each target fragment one by one, and recalculates the SHA256 digest and AES-256-CMAC checksum of the fragment in real time through the mbedTLS pure software library (using the legal key written in OTP as the CMAC key). The real-time calculation result is compared byte by byte with the pre-stored CMAC checksum of the corresponding fragment number in the security preset page.

[0098] If the real-time CMAC of all target fragments is completely consistent with the pre-stored CMAC, the verification passes and the Bootloader jumps to the starting address of the APP area (0x08010000) to execute the application.

[0099] If any target fragment is found to be inconsistent during comparison, a security lock is triggered. The security lock is implemented as follows: the bootloader writes a lock value to the fault flag in the OTP, then executes an infinite loop without jumping to the APP area. This lock is irreversible; even after power-on, the bootloader will detect the fault flag during startup and enter the locked state again, rendering the device permanently unusable.

[0100] In this embodiment, taking a sample of 7 segments (sampling rate of approximately 11.5%) as an example, the actual measured total time for full-process verification of the sampled segments (including segment-by-segment reading, SHA256 calculation, CMAC calculation, and comparison) is approximately 8 milliseconds, far lower than the 200-millisecond power-on response time requirement of automakers. Even in the extreme case of sampling 19 segments (sampling rate of approximately 31.1%), the actual measured total time is approximately 22 milliseconds, still far below the 200-millisecond threshold.

[0101] Step S5: In the filling mode, the encrypted key data packet sent by the host computer is received through the vehicle diagnostic bus. After decrypting and verifying the validity of the encrypted key data packet, the valid key is written into the one-time programmable storage area and a hardware lock is triggered. The hardware lock causes the one-time programmable storage area to lose any rewrite capability. After power is restored, the key status indicator is switched to the state of having a valid key written, and the filling mode is automatically exited.

[0102] In factory filling mode, the Bootloader executes the online key filling process. The key filling in this embodiment follows the ISO 14229 standard protocol, does not customize proprietary messages, is compatible with all mass production diagnostic instruments and CANoe simulation tools on the market, and requires no modification to production line equipment.

[0103] (1) Diagnostic session establishment. The host computer (production line diagnostic instrument) sends a UDS 0x10 0x03 diagnostic session request via the CAN bus, requesting to switch to the extended diagnostic session. After receiving the request, the bootloader replies with an affirmative response and enters the non-default extended session mode, with the session timeout set to 5000 milliseconds.

[0104] (2) Two-way secure handshake. The bootloader responds to the UDS 0x27 (secure access) service request: The host computer first sends a 0x27 0x01 request seed. The bootloader generates a 16-byte random challenge value (Seed) and returns it to the host computer via a 0x67 0x01 response. The host computer uses the pre-shared root key to perform CMAC calculation on the Seed to obtain the response key (Key), and sends the Key to the bootloader via a 0x27 0x02 request. The bootloader uses its own stored root key to perform the same CMAC calculation on the Seed and compares the result with the Key sent by the host computer. If they match, secure access authentication is passed; otherwise, subsequent installation requests are rejected. This two-way identity verification mechanism effectively prevents unauthorized diagnostic devices from installing keys.

[0105] The multi-source entropy acquisition circuit in the above Seed generation and reuse step S3 takes 16 bytes from the random data that has been acquired and latched within the same power-on window as the challenge value to ensure the true randomness of the Seed.

[0106] (3) Encrypted Key Transmission. After successful secure access authentication, the host computer sends the business key payload via the UDS 0x34 (Request Download) service. The business key (32 bytes) is transmitted using AES-128 encryption throughout the process. The key is a session-level dynamic key—this session key is dynamically generated by the host computer based on the random challenge value reported by the Bootloader, and it is valid for a single loading session. All packet capture data on the CAN bus is encrypted, making it impossible to crack the plaintext business key.

[0107] (4) OTP Write and Hardware Lock. After decrypting the service key from the UDS message, the Bootloader performs an OTP write operation: writing the 32-byte service key into the OTP key storage area. After writing, the Bootloader sets the hardware latch bit (LOCK bit) in the OTP control register of the configuration MCU. Once this latch bit is set, the high-voltage pump circuit of the OTP storage unit is hardware cut off, and any subsequent programming operation on the OTP address cannot generate programming high voltage. After the hardware comparator detects the locked state, it directly returns a write error flag without triggering an actual programming pulse. This lock is a physical fuse-type lock, independent of the power supply state, and cannot be released during the entire life cycle of the chip.

[0108] (5) Mode switching. After the key is written and locked, the Bootloader returns a filling completion response (UDS 0x36 transmission completion response) to the host computer. After the device is powered off and then powered on again, the Bootloader reads the OTP key storage area again, detects the presence of a valid key other than 0xFF, automatically determines that a valid key has been written, and enters the finished product operation mode without manual configuration or hardware jumper switching.

[0109] The signaling interaction process for the above-mentioned CAN-UDS online OTP key filling is as follows: Figure 4 As shown.

[0110] Physical independence and synchronous acquisition of type II and III entropy sources

[0111] In the specific implementation of the GD32A508 chip, the acquisition details of the three types of entropy source signals are as follows:

[0112] The first type of entropy source—analog signal of chip junction temperature: The output voltage of the internal temperature sensor is acquired via ADC channel 0. The GD32A508 integrates a temperature sensor, whose output voltage is linearly related to the chip junction temperature (typical sensitivity approximately 2.5 mV / ℃). During the power-on transient window, the chip junction temperature rises rapidly from ambient temperature. The rate of this rise and the specific temperature value are highly unpredictable due to various factors, including individual chip differences, heat dissipation conditions, and initial ambient temperature. The ADC sampled value is output at 12-bit resolution, and after conversion using a calibration formula, a 16-bit temperature characterization value is obtained.

[0113] The second type of entropy source—power supply ripple analog quantity: This is acquired via ADC1 channel 1 after the VDD power supply voltage has been divided by resistors. Specifically, VDD (typically 3.3 V) is divided by two equal resistors to obtain an input signal of approximately 1.65 V, which is then fed into ADC1 channel 1. The sampling rate is 1 MSPS, and the variance of 50 consecutive samples is calculated as the ripple characteristic. During the power-on transient window, the power management unit (PMU) is in the process of building up, and the ripple amplitude on VDD can reach tens of millivolts with random waveforms. The specific characteristics of this ripple are unpredictable due to various factors, including individual differences in the power supply chip, parasitic parameters of PCB wiring, and load capacitance.

[0114] The third type of entropy source—the free-running counter count: reads the current value of the SysTick timer (VAL register). SysTick is a 24-bit down-counter with a clock source of AHB / 8 (in this embodiment, the AHB clock is 64 MHz, so the SysTick clock is 8 MHz). This counter begins free-running immediately after chip reset and is independent of any software configuration. During the power-on transient window, due to the frequency jitter (±3%) of the internal RC oscillator, the SysTick count value exhibits significant differences at the same moment each power-on (e.g., 100 microseconds after reset).

[0115] The three types of entropy source signals mentioned above come from the TSENSE unit, PMU unit, and Cortex-M33 core debugging component of the chip, respectively. The three have no shared signal link in the front-end analog / digital domain—the temperature sensor and ADC are connected by an analog signal link, the power supply ripple sampling is also an independent analog front-end, and SysTick is a pure digital counter—the physical layers are not coupled to each other. When a single entropy source is suppressed by external electromagnetic interference or an attacker, the other two paths still maintain sufficient entropy values ​​independently.

[0116] Synchronous acquisition of the three signals is achieved through the following hardware mechanism: the rising edge of the reset release signal generates a synchronous trigger pulse via a hardware delay chain (composed of a multi-stage inverter delay unit within the chip, with a delay of approximately 50 microseconds). This pulse is simultaneously connected to the ADC injection trigger input and the SysTick shadow register latch trigger input. Upon receiving the trigger, the ADC initiates dual-channel injection sampling (with a sample-and-hold time configured for 2.5 ADC clock cycles). Upon receiving the trigger, SysTick latches the current VAL value into the shadow register. During subsequent readings, the software directly retrieves the synchronously acquired data from the ADC data register and the SysTick shadow register.

[0117] III. Specific Implementation of Nonlinear Confusion Operation

[0118] After obtaining the three preprocessed data streams (all three streams are 16-bit wide in this embodiment), the following multi-level hybrid hash folding operation is performed:

[0119] Level 1 – Concatenation and Bit Interleaving: Concatenate the three 16-bit data streams bit-interleaved into a 48-bit intermediate value Tmp. The specific interleaving method is as follows: take the 0th bit of the three data streams to form the 0th, 1st, and 2nd bits of Tmp; take the 1st bit of the three data streams to form the 3rd, 4th, and 5th bits of Tmp; and so on, ultimately forming 48 bits of data.

[0120] Level Two – Multiplication Confusion: Execute Tmp = Tmp × 0x9E3779B1 (modulo 2^48). Here, 0x9E3779B1 is the hexadecimal representation of the golden ratio ((√5-1) / 2×2^32), and multiplying this constant by any value can produce a good diffusion effect.

[0121] Level 3 – Dynamic Circular Shift: Take the lower 4 bits (8 bits in total) of bits 15 to 8 of the current value of Tmp as the left shift bit shift (value range 0-15), and execute Tmp = (Tmp <<shift)|(Tmp> >(48-shift)). The shift amount is dynamically determined by the data itself, increasing the difficulty for attackers to reverse engineer.

[0122] Level 4 – Byte Reordering: The 48-bit data is split into 6 bytes B0~B5 and rearranged according to the following permutation table: New sequence = [B3, B0, B5, B2, B1, B4]. This permutation table is associated with the mapping result of XORing the lower 6 bits of the chip's 96-bit unique ID (UID) and taking the modulo 6, so that different individual chips have different reordering paths.

[0123] Level 5 – XOR Compression: The high 16 bits (H), middle 16 bits (M), and low 16 bits (L) of the rearranged 48-bit data are compressed using the following operation: Seed32 = H⊕M⊕L⊕(H<<16)⊕(M>>16), which outputs a 32-bit random seed value.

[0124] In the five-stage operation described above, multiplication obfuscation disrupts the linearity of the ADC sampled values ​​(the linear relationship between the ADC value and temperature / ripple is rendered nonlinear), dynamic cyclic shifting and byte rearrangement disrupt the monotonically increasing law of the SysTick count, and XOR compression ensures that the output bit width is fixed at 32 bits. Testing shows that when any 1 bit of the input data changes, the average number of flips in the 32-bit seed output is approximately 16.2 bits, close to the ideal avalanche effect of 16 bits, while the simple XOR concatenation scheme only requires about 4 bits.

[0125] IV. Hardware-level definition and triggering of power-on transient window

[0126] In this embodiment, the power-on transient window period is precisely defined as the time period from the chip reset release (the rising edge of the NRST pin changing from low to high) to the system main clock stability flag (RCU_FLAG) being set by hardware.

[0127] In the GD32A508 chip, after reset, the internal RC oscillator (IRC8M, nominal frequency 8 MHz) begins to oscillate. Its frequency exhibits significant jitter (±3%) in the initial stage of oscillation. After approximately 80 to 120 microseconds, the frequency stabilizes, and the hardware automatically sets the RCU_FLAG flag. The specific duration of this window is affected by temperature—oscillation starts more slowly at low temperatures (-40 ℃), with a window of approximately 120 microseconds; oscillation starts more quickly at high temperatures (105 ℃), with a window of approximately 80 microseconds.

[0128] During this window period, the acquisition and latching of the three entropy source signals are synchronously initiated by the same hardware trigger signal. This hardware trigger signal is generated as follows: the reset release signal (rising edge of NRST) is delayed by approximately 50 microseconds by an internal hardware delay chain before outputting a trigger pulse. This delay chain consists of multiple stages of inverters and capacitive loads; the delay amount is determined by hardware and does not depend on any software instruction sequence. Therefore, attackers cannot delay or prematurely trigger the acquisition by tampering with the Bootloader code.

[0129] The acquisition trigger pulse simultaneously performs the following two hardware actions: (1) Trigger ADC injection sampling start--ADC starts to convert the internal temperature sensor and VDD voltage divider signal; (2) Latch the current value of SysTick to the shadow register--the VAL value of SysTick is latched by hardware at this moment, and the subsequent software reads the latched value rather than the real-time value, avoiding the time correlation introduced by the software reading delay.

[0130] After the clock stability flag is set (i.e., after the window period ends), the software reads the ADC data register and SysTick shadow register through the interrupt service routine. If the ADC conversion is not completed within the window period (the ADC conversion time is about 1 microsecond, which is much shorter than the window length and will not happen under normal circumstances), the hardware automatically extends the sampling and holding time until the conversion is completed.

[0131] By using the aforementioned hardware-triggered rather than software-polling method for data collection, the possibility of attackers reducing entropy by modifying the Bootloader code to delay the data collection window (waiting for power and clock to stabilize before data collection) is eliminated.

[0132] V. Mapping rules from random seed to sampling range

[0133] In this embodiment, the total number of verification fragments is 62 (numbered 0 to 61), of which fragment 0 (stores the interrupt vector table) is a fixed protection partition and cannot be sampled. The sampleable fragments are the 61 fragments numbered 1 to 61.

[0134] After obtaining the 32-bit random seed value, perform the following mapping operation:

[0135] (1) Splitting: Split the 32-bit random seed into a high 16-bit (denoted as Seed_H) and a low 16-bit (denoted as Seed_L).

[0136] (2) Calculation of the starting fragment number: Initial offset = Seed_H mod 61 (the result of the modulo operation ranges from 0 to 60). If the initial offset is 0 (corresponding to fragment 0), then it will be offset to fragment 1 according to the preset offset rule; if the initial offset is not 0, then the starting fragment number = the initial offset. That is, the starting fragment number ranges from 1 to 61.

[0137] (3) Calculation of the number of sampled pieces: Basic number = (Seed_L mod 15) + 1 (range 1 to 15). Convert to the final sample number according to the preset mapping rule: if the basic number < 7, then the final sample number = 7; otherwise, the final sample number = basic number + 4. The corrected sample number range is 7 to 19 pieces.

[0138] (4) Target fragment selection: Starting from the initial fragment number, select the final number of fragments as the target fragments along the continuous address direction (numbers increase). If "initial number + number of samples - 1" exceeds 61, then continue cyclically from fragment 1 (skipping number 0). For example, when the initial number is 58 and the number of samples is 7, the target fragments are {58,59,60,61,1,2,3}.

[0139] Compared with discrete extraction, the above continuous block extraction method has the following advantages: (1) It makes full use of the burst read mode of FLASH and reduces page switching overhead. In actual tests, it takes about 5 milliseconds to continuously read 7 fragments, while it takes about 9 milliseconds to read 7 fragments discretely due to frequent page crossings; (2) The verification coverage is distributed in continuous blocks in the address space, which is more effective in detecting large-scale firmware tampering (such as malicious code injection in the whole area) than the "random point selection" method.

[0140] In this embodiment, the minimum sampling rate is 7 / 62≈11.3% and the maximum is 19 / 62≈30.6%, both of which meet the minimum sampling rate requirement of not less than 10%.

[0141] VI. Two-layer session key encryption filling protocol

[0142] In this embodiment, the transmission of the business key (32-byte OTP key) adopts a two-layer encryption mechanism, and the specific implementation method is as follows.

[0143] First layer of encryption (outer layer): The host computer uses the device root key (32 bytes, identical for each batch of chips, hard-coded in the bootloader read-only area) pre-installed in the bootloader to encrypt a randomly generated session key (16 bytes), obtaining the outer ciphertext. This outer ciphertext is carried in the first frame of the UDS 0x34 request download message.

[0144] The second layer of encryption (inner layer): The host computer uses the aforementioned session key as the AES-128 key to encrypt the business key (32 bytes, padded to a multiple of 16 bytes), obtaining the inner ciphertext. This inner ciphertext is carried in subsequent consecutive frames of the UDS 0x34 request download message.

[0145] The decryption process on the bootloader side is as follows: First, the root key stored on the bootloader (pre-shared with the host computer) is used to decrypt the outer ciphertext to obtain the session key; then, the session key is used to decrypt the inner ciphertext to obtain the plaintext business key.

[0146] The session key is generated as follows: After receiving the 16-byte random challenge value (Seed, from the multi-source entropy acquisition circuit in step S3) returned by the Bootloader, the host computer uses the root key to perform AES-CMAC calculation on the Seed, and takes the first 16 bytes of the calculation result as the session key. The session key has the following characteristics: (1) Valid for a single filling session - after each power-on and entry into filling mode, the Seed is regenerated, and the session key changes accordingly; (2) Binding to the device - the Seed is generated by a specific device, and the Seed of different devices is different, and the session key is also different; (3) Time constraint - the session timeout time is 5000 milliseconds. After the timeout, the session will automatically expire and a new security access authentication needs to be initiated.

[0147] Through the above-mentioned dual-layer encryption mechanism, even if an attacker completely captures all the messages of the filling process on the CAN bus, due to the lack of the root key on the device side and the different challenge value each time it is powered on, they cannot crack the ciphertext of any transmission offline, nor can they complete the key writing by replaying historical messages.

[0148] VII. Hardware Locking and Linkage Protection

[0149] In this embodiment, after the OTP key is written and hardware locking is triggered, the Bootloader synchronously performs the following protection actions:

[0150] (1) Disable debug interface: By configuring the debug interface disable bit in the MCU's debug support unit (DSU), the JTAG / SWD interface is forced into an invalid state. After configuration, the debug port reads back IDCODE and returns all 0s, and no debug probe can establish a connection with the MCU.

[0151] (2) Disable FLASH readback function: Configure the read protection level to Level 1 by configuring the read protection bit (RDP, Read-outProtection) in the FLASH option byte. At this level, any read operation on FLASH content through the debug interface will be rejected by the hardware and will return random data or all zeros.

[0152] (3) Exponential backoff delay retry mechanism: A fault counter is added to the Bootloader and stored in a backup register (maintained by the VBAT battery and unaffected by mains power failure). The fault counter is incremented by 1 each time the CMAC check fails. After the first failure, a delay of 2^1 = 2 seconds is allowed before resetting and retrying. After the second failure, a delay of 2^2 = 4 seconds is allowed. After the third failure, a delay of 2^3 = 8 seconds is allowed. After the fourth failure, retrying is no longer allowed—the Bootloader directly enters a permanent lock-up state (the unrecoverable fault flag is set and an infinite loop is entered).

[0153] Of the three protective measures mentioned above, disabling the debug interface and disabling FLASH readback fundamentally prevent attackers from performing firmware reverse engineering and key reading by physically contacting the PCB; the exponential backoff delay causes the time cost of brute-force attempts at different keys (enumeration attack) to increase exponentially - after 4 failures, it is permanently locked, completely blocking the upper limit of attempts.

[0154] 8. Irreversible locking due to physical fuse failure

[0155] In this embodiment, the OTP of the GD32A508 is an anti-fuse one-time programmable memory cell. The writing principle of the anti-fuse OTP is as follows: during programming, a high-voltage pulse (approximately 7V to 9V) is applied to the target memory cell, causing physical breakdown of the gate oxide layer, which was originally in a high-resistance state, forming a permanent low-resistance conduction path. This physical change is irreversible—a broken-down memory cell cannot be restored to a high-resistance state, and a memory cell that has not been broken down cannot be subjected to high voltage again (because the high-voltage pump circuit has been disconnected).

[0156] After the OTP write is complete, hardware locking is triggered by setting the LOCK bit in the OTP control register. Once the LOCK bit is set, the following hardware actions take effect simultaneously:

[0157] (1) The power supply to the high-pressure pump circuit is cut off by hardware - the high voltage (7 V to 9 V) required for OTP programming cannot be generated.

[0158] (2) The write enable signal of the OTP address decoder is hardware shielded - any write operation to the OTP address is intercepted by the hardware comparator and directly returns a bus error response without triggering any programming pulse.

[0159] (3) LOCK bit self-fuse-out - The LOCK bit is also an anti-fuse type memory cell. After being set, it is physically fused and cannot be cleared.

[0160] The locked state has the following characteristics: (1) Independent of the power supply state - the lock is determined by the physical structure of the OTP cell (breakdown / non-breakdown) and the state is maintained after power failure; (2) Effective throughout the entire life cycle - the locked state remains effective from the moment of lock until the chip is physically damaged; (3) Cannot be unlocked by any means - physical reverse means such as opening the cover and focusing ion beam (FIB) repair cannot restore the programmability of the OTP, because the breakdown of the gate oxide layer is an irreversible change at the material level.

[0161] The written OTP key data can be accessed normally through CPU read operations (allowing upper-layer applications to call the key in scenarios such as communication encryption), but any rewriting attempt is unconditionally rejected by the hardware.

[0162] IX. Modular Implementation of the System

[0163] On the GD32A508 chip platform, the modules of the vehicle terminal's dynamic sampling boot and key filling system without hardware acceleration are implemented using a combination of bootloader firmware logic and chip-embedded hardware peripherals:

[0164] (1) Storage Media Partitioning Module: This corresponds to the Flash Layout Table in the Bootloader code. This table is defined as a constant array in the Bootloader's read-only data area and includes the following fields: BOOT area start address and length, APP area start address and length, security preset area start address and length, and the mapping relationship between each segment number and its physical address. During the production line programming stage, the host computer software, in conjunction with the pre-verification firmware in the Bootloader, completes the batch calculation and writing of the CMAC for each segment.

[0165] (2) Mode determination module: It consists of the OTP controller hardware and the read-compare logic in the Bootloader startup code. The OTP controller is responsible for providing the read / write access interface for the OTP storage area. The Bootloader startup code starts executing the OTP read operation as the first instruction after system reset. After the read result is judged by the comparator, the mode switching signal is output through GPIO - low level indicates filling mode (SysTick interrupt is disabled and APP jump instruction is blocked), high level indicates finished product operation mode.

[0166] (3) Multi-source entropy acquisition module: It consists of ADC peripherals, SysTick peripherals, hardware trigger synchronization logic, and software algorithm library. As mentioned above, the hardware trigger synchronization logic is triggered by the reset release signal through a delay chain to synchronously latch the ADC and SysTick shadow register. The software algorithm library (mbedTLS simplified version) provides function implementations for extreme value filtering and nonlinear confusion operations.

[0167] (4) Dynamic Sampling Verification Module: Implemented by the Verification Engine in the Bootloader. This verification engine receives a 32-bit random seed output from the multi-source entropy acquisition module, calculates the sampling range through index mapping logic, calls the FLASH controller driver to read firmware data chip by chip, then calls the mbedTLS software stack to calculate SHA256 and CMAC chip by chip, and finally compares it with the pre-stored values ​​in the security preset area. After the verification passes, the verification engine modifies the value of the program counter (PC) and jumps to the starting address of the APP area.

[0168] (5) Key filling execution module: It consists of a UDS protocol stack and an OTP write driver. The UDS protocol stack parses the ISO 14229 standard messages received by the CAN controller and identifies diagnostic service requests such as 0x10, 0x27, and 0x34. After the secure access authentication is passed, the OTP write driver writes the decrypted business key into the OTP storage area according to the OTP programming timing and sets the LOCK bit to trigger hardware locking.

[0169] All five modules mentioned above are initialized and executed during the Bootloader phase. The application area (APP) does not participate in any security decisions—the APP code cannot roll back to the Bootloader to re-execute security checks after startup, nor can it modify any data in the security preset area or OTP.

[0170] The embodiments of the aforementioned dynamic sampling initiation and key filling method and the embodiments of the aforementioned dynamic sampling initiation and key filling system are the same or related in terms of technical concept. They can be referred to and learned from each other in terms of technical details and technical effects, which will not be repeated here.

[0171] Overall, the advantages of this application compared to the prior art include:

[0172] 1. In existing low-cost automotive MCU secure boot solutions without hardware encryption acceleration, the industry commonly uses fixed-position sampling verification—verifying only a fixed proportion of pages at the front or back of the FLASH memory. Attackers can inject malicious code (such as OTA backdoors or CAN data forwarding logic) into unverified pages, allowing the tampered firmware to still pass verification and boot normally. This application uses multiple physical heterogeneous entropy sources (ADC chip junction temperature, ADC power supply ripple, SysTick beat) to synchronously collect data during the power-on transient window and generate a true random seed through nonlinear obfuscation. This seed is then used to dynamically determine the sampling start position and sampling quantity for each power-on, making the sampling position unpredictable and unreproducible at each boot. Attackers cannot know in advance which pages will be verified, thus completely eliminating the security bypass vulnerability of "targeted tampering with non-verified pages" in fixed sampling schemes.

[0173] 2. Existing random sampling schemes typically use only the system clock as a single entropy source to generate random numbers. The system clock can be tampered with or predicted through the JTAG debugging interface, making the sampling sequence predictable and rendering the secure startup mechanism ineffective. This application employs synchronous acquisition of three hardware random entropy source signals with different physical generation mechanisms: the chip junction temperature analog quantity reflects thermal noise characteristics, the power supply ripple analog quantity reflects power supply noise characteristics, and the SysTick count value reflects clock jitter characteristics. These three signals do not share a signal link in the front-end analog / digital domain. Even if one entropy source is interfered with by external factors or suppressed by an attacker, the other two channels still maintain sufficient entropy values ​​independently. Combined with extreme value filtering preprocessing to prevent entropy source degradation under extreme conditions of all 0 / all FF, and multi-level nonlinear obfuscation operations (multiplication obfuscation, dynamic cyclic shift, byte rearrangement, XOR compression) to destroy the linear characteristics of ADC sampling and the monotonically increasing law of SysTick, even if an attacker obtains part of the entropy source data of a certain power-on, they will not be able to predict the sampling position at other power-on times.

[0174] 3. In existing low-end MCU solutions without hardware acceleration, the full software verification time typically exceeds 300 milliseconds, exceeding the hard requirement of no more than 300 milliseconds for the MCU power-on to application response time, which is generally required by automakers. This application uses a dynamic sampling verification method—sampling and verifying FLASH fragments with a sampling rate of no less than 10%. In actual tests, the total verification time (including fragment-by-fragment reading, SHA256 calculation, CMAC calculation and comparison) for sampling 7 fragments (sampling rate of approximately 11.5%) is approximately 8 milliseconds. Even in extreme cases, sampling 19 fragments (sampling rate of approximately 31.1%) takes approximately 22 milliseconds, all of which are far below the 200-millisecond threshold. At the same time, the fragment containing the interrupt vector table is hard-shielded from the sampling range, avoiding misjudgment due to incorrect sampling of interrupt vectors and preventing attackers from injecting malicious code into the interrupt vector area to bypass the verification.

[0175] 4. Existing vehicle terminal key programming typically requires offline OTP key programming at the chip die stage. If a key programming error occurs on the production line, the vehicle model key is iterated, or the after-sales key is leaked, the TBOX shell must be disassembled, the MCU desoldered, and reprogrammed. Furthermore, it cannot automatically distinguish between factory mode and finished product mode, requiring manual jumper switching. This application achieves automatic switching between factory programming mode and finished product operation mode through OTP default values—when the factory-shipped chip's OTP area is all 0xFF and unwritten, it automatically enters programming mode. After the legitimate key is written online via CAN-UDS and a hardware lock is triggered, it automatically switches to finished product operation mode upon power-up, without any hardware jumpers or manual intervention. Key transmission uses session-level dynamic key double-layer encryption (the outer layer uses the device root key to encrypt the session key, and the inner layer uses the session key to encrypt the business key). The session key is dynamically generated based on a random challenge value generated each time the device powers on and is valid only once. Even if an attacker completely captures the CAN bus programming message, they cannot crack it offline or perform a replay attack.

[0176] 5. In existing technical solutions, the secure startup function and key filling function are often designed independently. Attackers can target a single link and bypass it—for example, bypassing only the startup verification while retaining the filling interface, or attacking only the filling process while keeping the startup verification unchanged. This application designs five links in a serial and linked manner: offline pre-verification of the production line, power-on mode self-identification, multi-source entropy acquisition, dynamic sampling verification, and online key filling. The pre-stored value in the secure preset area provides a comparison benchmark for dynamic sampling verification. The mode determination result directly determines whether to enter the filling mode or the finished product operation mode. The random seed output by multi-source entropy acquisition is the only index source for dynamic sampling. After the key filling is completed, it is fed back to the mode determination module so that the mode is automatically switched on the next power-on. The absence of any link will cause the entire security chain to break. It is impossible to separate and bypass the startup verification and key filling separately, forming an inseparable overall security solution.

[0177] Based on the same inventive concept, embodiments of this application also provide an electronic device. Figure 5 This is a structural block diagram of an electronic device provided in an embodiment of this application. Figure 5 As shown in the embodiments of this application, an electronic device includes: one or more processors 101, a memory 102, and one or more I / O interfaces 103. The memory 102 stores one or more programs, which, when executed by the one or more processors, enable the one or more processors to implement any of the dynamic sampling startup and key filling methods described in the above embodiments; the one or more I / O interfaces 103 are connected between the processor and the memory, configured to enable information interaction between the processor and the memory.

[0178] The processor 101 is a device with data processing capabilities, including but not limited to a central processing unit (CPU); the memory 102 is a device with data storage capabilities, including but not limited to random access memory (RAM, more specifically SDRAM, DDR, etc.), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), and flash memory (FLASH); the I / O interface (read / write interface) 103 is connected between the processor 101 and the memory 102, and can realize information interaction between the processor 101 and the memory 102, including but not limited to a data bus (Bus).

[0179] In some embodiments, the processor 101, memory 102, and I / O interface 103 are interconnected via bus 104, and thus connected to other components of the computing device.

[0180] In some embodiments, the one or more processors 101 include a field-programmable gate array.

[0181] This application also provides a computer-readable medium. The computer-readable medium stores a computer program, which, when executed by a processor, implements the steps of any of the dynamic sampling initiation and key filling methods described in the above embodiments. The computer-readable storage medium can be volatile or non-volatile.

[0182] This application also provides a computer program product, including computer-readable code, or a non-volatile computer-readable storage medium carrying computer-readable code. When the computer-readable code is run in the processor of an electronic device, the processor in the electronic device executes the above-described dynamic sampling startup and key filling method.

[0183] Those skilled in the art will understand that all or some of the steps, systems, and apparatuses disclosed above, and their functional modules / units, can be implemented as software, firmware, hardware, or suitable combinations thereof. In hardware implementations, the division between functional modules / units mentioned above does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed collaboratively by several physical components. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit (ASIC). Such software can be distributed on a computer-readable storage medium, which may include computer storage media (or non-transitory media) and communication media (or transient media).

[0184] As is known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information, such as computer-readable program instructions, data structures, program modules, or other data. Computer storage media includes, but is not limited to, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), static random access memory (SRAM), flash memory or other memory technologies, portable compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer. Furthermore, it is known to those skilled in the art that communication media typically contain computer-readable program instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

[0185] The computer-readable program instructions described herein can be downloaded from computer-readable storage media to various computing / processing devices, or downloaded via a network, such as the Internet, local area network, wide area network, and / or wireless network, to an external computer or external storage device. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to the computer-readable storage media in the respective computing / processing device.

[0186] The computer program instructions used to perform the operations of this application may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, status setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, etc., and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuits, such as programmable logic circuits, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), are personalized by utilizing the status information of the computer-readable program instructions. These electronic circuits can execute the computer-readable program instructions to implement various aspects of this application.

[0187] The computer program product described herein can be implemented specifically through hardware, software, or a combination thereof. In one alternative embodiment, the computer program product is specifically embodied in a computer storage medium; in another alternative embodiment, the computer program product is specifically embodied in a software product, such as a software development kit (SDK), etc.

[0188] Various aspects of this application are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0189] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that, when executed by the processor of the computer or other programmable data processing apparatus, they create means for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner; thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing aspects of the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0190] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0191] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of an instruction containing one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0192] Exemplary embodiments have been disclosed in this application, and while specific terminology has been used, it is used only and should be interpreted in a general illustrative sense and is not intended to be limiting. In some embodiments, it will be apparent to those skilled in the art that features, characteristics, and / or elements described in conjunction with particular embodiments may be used alone, or in combination with features, characteristics, and / or elements described in conjunction with other embodiments, unless otherwise expressly indicated. Therefore, those skilled in the art will understand that various changes in form and detail may be made without departing from the scope of this application as set forth by the appended claims.

Claims

1. A method for dynamic sampling startup and key filling without hardware acceleration in an in-vehicle terminal, characterized in that, include: Step S1: Divide the target firmware into multiple verification fragments according to the page size of the physical storage medium, calculate the first integrity verification value for each verification fragment, and store all the first integrity verification values ​​in the security preset area in the storage medium, and enable hardware-level write protection for the security preset area. Step S2: Read the key status identifier in the one-time programmable storage area; if the key status identifier is in an unwritten state, enter the filling mode and execute step S5; if the key status identifier is in a state where a valid key has been written, enter the finished product operation mode and execute step S3. Step S3: During the power-on transient window, at least two physically independent hardware random entropy source signals are synchronously acquired, and the physical generation mechanisms of each hardware random entropy source signal are different; after performing extreme value filtering preprocessing on each channel of raw acquired data, the multi-channel preprocessing results are input into a nonlinear conflation operation to output a random seed value. Step S4: Determine the sampling start position and sampling quantity according to the random seed value, dynamically extract the target fragment from the verification fragment, and the target fragment does not contain the fixed protection partition storing the interrupt vector table in the storage medium; The second integrity check value of the target fragment is recalculated for each fragment and compared with the corresponding pre-stored value in the security preset area. If all values ​​match, the process jumps to the application area for execution. If an inconsistency is found, a security lock will be triggered. Step S5: In the filling mode, the encrypted key data packet sent by the host computer is received through the vehicle diagnostic bus. After decrypting and verifying the validity of the encrypted key data packet, the valid key is written into the one-time programmable storage area and a hardware lock is triggered. The hardware lock causes the one-time programmable storage area to lose any rewrite capability. After power is restored, the key status indicator is switched to the state of having a valid key written, and the filling mode is automatically exited.

2. The dynamic sampling initiation and key filling method according to claim 1, characterized in that, The at least two physically independent hardware random entropy source signals include at least two of the following three categories: chip junction temperature analog quantity, power supply ripple analog quantity, and free-running counter count value. These three types of entropy source signals come from the chip's analog-to-digital converter channel, power management unit, and system timer, respectively, and the three do not share a signal link in the front-end analog / digital domain.

3. The dynamic sampling initiation and key filling method according to claim 1, characterized in that, The nonlinear obfuscation operation is a multi-level hybrid hash folding operation, which includes at least the following steps in sequence: concatenating the preprocessing results of each path into intermediate bit-width data and then performing multiplication obfuscation operation, cyclic shift operation, byte rearrangement operation, and XOR compression operation; wherein, at least one operand in the multiplication obfuscation operation is a fixed nonlinear constant, and the shift amount of the cyclic shift operation is dynamically determined by at least one byte in the preprocessing results.

4. The dynamic sampling initiation and key filling method according to claim 1, characterized in that, The power-on transient window period is defined as the time period between the chip reset release and the setting of the system master clock stabilization flag. During this window period, the acquisition and latching of at least two hardware random entropy source signals are synchronously initiated by the same hardware trigger signal. The hardware trigger signal is aligned with the chip reset release signal edge and is not triggered by a software instruction sequence.

5. The dynamic sampling initiation and key filling method according to claim 1, characterized in that, Determining the sampling start position and sampling quantity based on the random seed value specifically includes: The random seed value is split into a first field and a second field; Perform a modulo operation between the first field and the total number of verification fragments to obtain the initial starting fragment number, and determine whether the initial starting fragment number falls within the fixed protection partition. If so, shift backward to the first non-protected fragment according to the preset offset rule, and use the offset number as the sampling starting position. The second field is converted into the number of sampling fragments according to a preset mapping rule, and the ratio of the number of sampling fragments to the total number of verification fragments is not less than the preset minimum sampling rate threshold. Starting from the sampling start position, select the number of sampling fragments along the continuous address direction as the target fragments.

6. The dynamic sampling initiation and key filling method according to claim 1, characterized in that, The encryption key data packet in step S5 uses a session-level dynamic key for double-layer encryption, specifically including: The first layer uses the device root key pre-installed in the bootloader to decrypt the outer ciphertext of the encryption key data packet to obtain the session key; The second layer uses the session key to decrypt the inner ciphertext of the encrypted key data packet to obtain the legitimate key; wherein, the session key is dynamically generated by the host computer based on the random challenge value reported by the vehicle terminal, and is valid for a single filling session.

7. The dynamic sampling initiation and key filling method according to claim 1, characterized in that, After the hardware lock is triggered in step S5, in addition to losing the ability to rewrite, the one-time programmable memory area will also trigger at least one of the following protective actions: disabling the debugging interface of the vehicle terminal, disabling the non-volatile memory readback function of the vehicle terminal, and adding an exponential backoff delay before allowing the next retry after each power-on verification failure.

8. The dynamic sampling initiation and key filling method according to claim 1, characterized in that, The security lock is an irreversible lock, including a physical fuse lock on the one-time programmable memory area, and the physical fuse lock is independent of the power supply status of the vehicle terminal; Once the irreversible lock takes effect, the legitimate key written into the one-time programmable storage area remains readable but unrewriteable throughout the chip's entire lifecycle.

9. A system capable of implementing the dynamic sampling initiation and key filling method according to any one of claims 1-8, characterized in that, include: The storage medium partitioning module is used to divide the page size of the target firmware physical storage medium into multiple verification fragments, calculate the first integrity verification value of each verification fragment, and store it in the security preset area, and enable hardware-level write protection for the security preset area. The mode determination module is connected to the one-time programmable memory area and is used to read the key status identifier in the one-time programmable memory area after power-on reset, and output a mode switching signal according to the key status identifier; the mode switching signal includes a first level signal indicating the filling mode and a second level signal indicating the finished product operation mode; The multi-source entropy acquisition module includes at least two physically decoupled entropy source acquisition sub-units. Each entropy source acquisition sub-unit is used to acquire a type of hardware random entropy source signal during the power-on transient window. The multi-source entropy acquisition module also includes an extreme value filtering sub-module and a nonlinear confusion operation sub-module. The extreme value filtering sub-module is used to perform anti-extreme value preprocessing on each channel of raw acquisition data, and the nonlinear confusion operation sub-module is used to fuse the preprocessing results of multiple channels and output a random seed value. The dynamic sampling verification module is connected to the multi-source entropy acquisition module to receive the random seed value. It is used to determine the sampling start position and sampling quantity according to the random seed value, dynamically extract the target fragment that does not contain the interrupt vector table protection partition from the verification fragment, recalculate the second integrity verification value of the target fragment, and compare it with the corresponding pre-stored value in the security preset area. If all matches, the application's execution permissions are released; if there are any discrepancies, a system lock signal is output. The key filling execution module is connected to the mode determination module to receive the first level signal. It is used to receive the encrypted key data packet through the vehicle diagnostic bus in the filling mode, and write the legitimate key into the one-time programmable storage area after decryption and legality verification, and trigger the hardware lock signal. The hardware lock signal is used to make the one-time programmable storage area lose any rewrite capability. The mode determination module is further configured to switch the key status identifier to the state of having a valid key written after writing a valid key into the one-time programmable storage area and triggering the hardware lock signal, so that the mode switching signal will automatically switch to the second level signal upon the next power-on.

10. A computer-readable medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it can implement the steps in the dynamic sampling initiation and key filling method according to any one of claims 1 to 8.

Images