A method and system for protecting network security of remote upgrading of automobile software

Abstract

The application discloses a kind of automobile software remote upgrading network security protection method and system, vehicle end is divided into security communication guarantee, vehicle password, three independent modules of security upgrade, build three layers of depth protection architecture, whole process uses national secret algorithm protection.Vehicle power-on completes safety self-check, vehicle end and service platform interact SM2 certificate two-way authentication, rely on TLS1.2 to establish encrypted channel;Platform is with SM4 encryption upgrade package, SM2 encryption symmetric key data issuance.Vehicle end is based on the security chip or TEE that satisfies national secret second level standard to complete decryption, temporary key destruction, and pass SM2 and SM3 to upgrade package sign.System real-time monitoring DOS, replay attack, abnormal event is stored in isolated log, certificate chain damage will block upgrade process.The scheme adapts mainstream vehicle-mounted system, realizes identity credible, transmission encryption, upgrade package tamper-proof, security behavior is traceable, effectively avoids network security threat in OTA upgrade process.

Description

Technical Field

[0001] This application relates to the field of remote automotive software upgrade technology, specifically to a network security protection method and system for remote automotive software upgrades. Background Technology

[0002] A new round of technological revolution and industrial transformation is driving the intelligent development of automobiles. While intelligent vehicles promote the deep integration of automobiles with the Internet, big data, communications, and other industries, they also bring network and data security issues to automobiles. The increasing connectivity of automobiles makes them a key target for cyberattacks, highlighting security risks and highlighting weak security protection foundations. Over the past 10 years, the number of automotive cybersecurity incidents has been increasing dramatically.

[0003] Automotive software upgrade technology modifies the software of electronic control units in modules such as airbags, engines, and charging systems. This allows for changes to vehicle safety, emissions, fuel consumption, and battery performance parameters, as well as vulnerability fixes and new feature rollouts. It has become a new ecosystem in the automotive industry and is widely used, with upgradeable content expanding from in-car entertainment systems to the entire vehicle control system. However, while providing a crucial update pathway for intelligent connected vehicles, automotive software upgrade technology also introduces greater information security risks. The technology provides internal and external interconnectivity interfaces, and the upgrade process requires downloading upgrade packages and flashing firmware and software, increasing the possibility of external information security intrusions.

[0004] Currently, domestic and international automakers have designed their own remote and local automotive software upgrade technology processes and system designs. However, how to deal with hacker attacks such as unauthorized access and data tampering during data transmission and flashing remains a hot research topic. Summary of the Invention

[0005] In view of the technical problems mentioned in the background, the purpose of this invention is to provide a network security protection method and system for remote vehicle software upgrades.

[0006] To achieve the objectives of this invention, the technical solution provided by this invention is as follows: First aspect This invention provides a network security protection method for remote automotive software upgrades, the method comprising the following steps: Step S1: The vehicle is powered on and started. The security upgrade module performs a security self-test, checking the status of the vehicle password module key storage and upgrade cache data. Step S2: The secure communication protection module initiates a connection and certificate issuance request to the service platform, and the service platform issues the server SM2 digital certificate; Step S3: The secure communication protection module forwards the server SM2 digital certificate to the vehicle password module, and the vehicle password module retrieves the local pre-set certificate chain to complete the legality verification of the server SM2 digital certificate; Step S4: After the certificate verification is successful, the secure communication assurance module uploads the vehicle terminal SM2 identity certificate to the service platform. The service platform completes the vehicle identity authentication and establishes an encrypted communication channel based on TLS1.2. Step S5: The service platform uses the SM4 symmetric encryption algorithm to encrypt the upgrade package, uses the server's SM2 public key to encrypt the SM4 symmetric key, and sends the encrypted symmetric key and the encryption upgrade package together. Step S6: The secure communication module receives the data packet and transmits it to the vehicle password module; Step S7: The vehicle password module uses the local preset private key to decrypt and obtain the SM4 symmetric key, uses the SM4 to decrypt the upgrade package, and clears the temporary symmetric key in memory after decryption; if decryption fails, an exception message is pushed to the security upgrade module. Step S8: The vehicle password module uses the SM2 and SM3 digest algorithms to perform signature verification on the decrypted upgrade package. If the signature verification fails, an abnormal message is pushed to the security upgrade module simultaneously. Step S9: After the signature verification is successful, the vehicle password module sends the compliance upgrade package to the security upgrade module, which then distributes it to the corresponding ECU to execute the software flashing. The security upgrade module collects the upgrade progress in real time and reports it to the service platform. It also monitors DOS, replay, and key brute-force attacks. Decryption, signature verification anomalies, and attack events are all stored in the isolated security log.

[0007] Furthermore, the vehicle cryptographic module uses a TEE or a security chip to store the certificate chain, and the certificate chain storage area meets the security requirements of Level 2 of the national cryptographic standard as specified in GM / T008.

[0008] Furthermore, the vehicle cryptographic module is equipped with a key certificate storage area and a computation area, and the SM2 signature verification, SM3 digest, and SM4 encryption and decryption operations are all performed independently in the computation area.

[0009] Furthermore, the vehicle password module sends an error message to the security upgrade module after the signature verification or decryption fails, and the security upgrade module records the corresponding security log.

[0010] Furthermore, the service platform uniformly issues certificate chains, and the certificate chains are pre-installed in the vehicle password module before the vehicle leaves the factory.

[0011] Furthermore, the secure communication protection module uses TLS 1.2 for communication channel security protection; the symmetric encryption and decryption of the upgrade package uses SM4; the asymmetric encryption uses the server's public key to encrypt the SM4 symmetric key, and the vehicle terminal uses the vehicle password module to decrypt it using a preset private key.

[0012] Furthermore, the security upgrade module is equipped with a security event monitoring module and a periodically updated attack identification feature library.

[0013] Furthermore, the security upgrade module's log storage uses an HSM or a dedicated storage area. The log storage is designed as a separate storage area, which can reject unauthorized access.

[0014] Furthermore, the vehicle-side is compatible with Linux and QNX in-vehicle operating systems and can be integrated into the in-vehicle T-BOX or in-vehicle gateway; the security upgrade module has a secure boot function, and the system cannot start normally when the certificate chain is damaged; the vehicle password module, secure communication protection module, and security upgrade module are set up independently in layers to achieve three-layer protection in depth of communication channel, communication message, and operating environment.

[0015] Second aspect This invention provides a network security protection system for remote automotive software upgrades, used to execute the aforementioned network security protection method for remote automotive software upgrades, including a service platform and a vehicle. The service platform is used to issue server SM2 digital certificates, distribute certificate chains, generate SM4 encryption upgrade packages, encrypt SM4 symmetric keys using the server SM2 public key, and distribute encrypted data packets. The vehicle-mounted module integrates a vehicle password module, a secure communication protection module, and a security upgrade module, which, together with a communication module, enable wireless network interaction. The secure communication protection module integrates a TLS 1.2 protocol stack and is responsible for initiating certificate requests, establishing encrypted channels, and encrypting uplink and downlink data transmission. The vehicle password module has a built-in security chip or TEE that meets the GM / T 0008 national cryptographic level 2 security capability, a pre-installed certificate chain issued by the service platform, and independently completes SM2 identity verification, SM3 hash operation, and SM4 encryption and decryption. After decryption, it automatically clears the temporary key, and reports the fault to the security upgrade module if the operation is abnormal. The security upgrade module is used for power-on security self-test, distributing legitimate upgrade packages to each ECU, collecting and reporting upgrade progress, and is equipped with a security event monitoring module to identify DOS, replay, and key brute-force attacks. It is equipped with an independent dedicated storage area or HSM to store security logs and blocks remote upgrade startup when the certificate chain is damaged. The vehicle-side upgrade host is connected to the vehicle ECU via CAN or vehicle Ethernet.

[0016] Compared with the prior art, the beneficial effects of the present invention are as follows: This invention provides a network security protection method for remote automotive software upgrades applied to the vehicle end. It employs a three-tiered security protection system: communication channel security protection, communication message / upgrade package cryptographic protection, and upgrade environment protection. This achieves confidentiality of communication messages, protection and verification of the authenticity and integrity of upgrade packages, and ensures basic environmental security and traceability of security events. This invention uses SM2 digital certificates to uniformly represent the identities of the vehicle end and the service platform end. The vehicle end cryptographic module uses a public key certificate obtained through a secure communication channel to provide certificate authentication for the upgrade package, ensuring the integrity and authenticity of the upgrade package data during transmission. Symmetric encryption technology ensures the confidentiality of the upgrade package storage, achieving secure authentication of the communication identities of the vehicle end and the service platform end, preventing information leakage caused by unauthorized access from external entities. This invention implements TLS 1.2 communication encryption technology to ensure the security of the upgrade package transmission channel. All signature verification, encryption, and decryption processes involved in this invention are completed within the cryptographic module, providing comprehensive protection for remote automotive upgrades and offering excellent application capabilities on the vehicle end. Attached Figure Description

[0017] Figure 1 This is a schematic diagram of a network security protection method for remote vehicle software upgrades provided in an embodiment of the present invention; Figure 2 This is a functional module diagram of a network security protection system for remote vehicle software upgrade provided in an embodiment of the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0019] It should be noted that the acquisition of data and collection of information in this application are legal, compliant, or obtained with the consent of the subject of the data collection.

[0020] Figure 1The diagram illustrates a network security protection method for remote automotive software upgrades according to an embodiment of the present invention. In the diagram: 1. Connection request, requesting authentication from the service platform; 2. Service platform issues certificate information; 3. Vehicle verifies the certificate using a certificate chain (this invention requires the vehicle to have the certificate chain pre-installed); 4. Send vehicle authentication certificate; 5. Service platform authentication; 6. Issuance of authentication result and commencement of communication; 7. Upload of the private key supported by symmetric encryption; 8. Decryption of asymmetric encryption to obtain the symmetric encryption key; 9. Issuance of encrypted upgrade package / message; 10. Transmitting the message to the cryptographic module; 11. Upgrade package decryption; 11-1 Log recording if decryption fails; 12. Signature verification of the upgrade package; 12-1 Log recording if signature verification fails; 13. Successful signature verification sends the current and next upgrade packages to the upgrade security module, which distributes them to the upgrade ECU for upgrade; 14. Reporting upgrade progress messages; 15. Uploading upgrade progress messages to the service platform. Figure 2 This is a functional block diagram of a network security protection system for remote vehicle software upgrades provided in an embodiment of the present invention. In the diagram, A represents the vehicle-side system for vehicle software upgrades, B represents the secure communication protection module, C represents the vehicle-side cryptographic module, D represents the security upgrade module, and F represents the communication module; a represents secure upgrade uplink data, and b represents secure upgrade downlink data.

[0021] This invention proposes a lightweight and efficient network security protection method for remote automotive software upgrades in embedded environments. This method breaks down the protection process of remote automotive software upgrades into a vehicle-side cryptographic module, a secure communication assurance module, and a secure upgrade module. This achieves layered decoupling of network security, establishes in-depth defense measures, and provides protection from communication channels, communication messages, and basic security. It solves problems such as high resource consumption and dispersed risk points in remote automotive software upgrade protection. Furthermore, by applying domestically produced commercial cryptography on the vehicle side, it achieves rapid, efficient, and secure over-security on the vehicle side, protecting the network security of automotive upgrades from the ground up.

[0022] This method is applied to the vehicle end and integrated with the in-vehicle terminal. It includes a vehicle-side cryptographic module, a secure communication assurance module, and a secure upgrade module, providing functions such as software upgrade key management, certificate management, signature verification, symmetric decryption, and secure communication. SM2 digital certificates are used to uniformly represent the identities of the in-vehicle terminal and service platform. The vehicle-side cryptographic module uses a public key certificate obtained through a secure communication channel to provide certificate authentication for the upgrade package, ensuring the integrity and authenticity of the upgrade package data during transmission. Symmetric encryption technology ensures the confidentiality of the upgrade package storage, achieving secure authentication of the communication identities of the in-vehicle terminal and service platform, preventing information leakage caused by unauthorized access from external entities. The invention implements TLS 1.2 communication encryption technology to ensure the security of the upgrade package transmission channel. The signature verification, encryption, and decryption processes involved in this invention are all completed within the cryptographic module.

[0023] Specifically, this embodiment provides a network security protection method for remote vehicle software upgrades, which includes the following steps: Step S1: The vehicle is powered on and started. The security upgrade module performs a security self-test, checking the status of the vehicle password module key storage and upgrade cache data. Step S2: The secure communication protection module initiates a connection and certificate issuance request to the service platform, and the service platform issues the server SM2 digital certificate; Step S3: The secure communication protection module forwards the server SM2 digital certificate to the vehicle password module, and the vehicle password module retrieves the local pre-set certificate chain to complete the legality verification of the server SM2 digital certificate; Step S4: After the certificate verification is successful, the secure communication assurance module uploads the vehicle terminal SM2 identity certificate to the service platform. The service platform completes the vehicle identity authentication and establishes an encrypted communication channel based on TLS1.2. Step S5: The service platform uses the SM4 symmetric encryption algorithm to encrypt the upgrade package, uses the server's SM2 public key to encrypt the SM4 symmetric key, and sends the encrypted symmetric key and the encryption upgrade package together. Step S6: The secure communication module receives the data packet and transmits it to the vehicle password module; Step S7: The vehicle password module uses the local preset private key to decrypt and obtain the SM4 symmetric key, uses the SM4 to decrypt the upgrade package, and clears the temporary symmetric key in memory after decryption; if decryption fails, an exception message is pushed to the security upgrade module. Step S8: The vehicle password module uses the SM2 and SM3 digest algorithms to perform signature verification on the decrypted upgrade package. If the signature verification fails, an abnormal message is pushed to the security upgrade module simultaneously. Step S9: After the signature verification is successful, the vehicle password module sends the compliance upgrade package to the security upgrade module, which then distributes it to the corresponding ECU to execute the software flashing. The security upgrade module collects the upgrade progress in real time and reports it to the service platform. It also monitors DOS, replay, and key brute-force attacks. Decryption, signature verification anomalies, and attack events are all stored in the isolated security log.

[0024] Preferably, the vehicle cryptographic module uses a TEE or a security chip to store the certificate chain, and the certificate chain storage area meets the security requirements of Level 2 of the national cryptographic standard as specified in GM / T008.

[0025] Preferably, the vehicle cryptographic module is equipped with a key certificate storage area and a computation area, and the SM2 signature verification, SM3 digest, and SM4 encryption / decryption operations are all performed independently in the computation area.

[0026] Preferably, the vehicle password module sends an error message to the security upgrade module after the signature verification or decryption fails, and the security upgrade module records the corresponding security log.

[0027] Preferably, the service platform uniformly issues the certificate chain, and the certificate chain is pre-installed in the vehicle password module before the vehicle leaves the factory.

[0028] Preferably, the secure communication protection module uses TLS 1.2 for communication channel security protection; the symmetric encryption and decryption of the upgrade package uses SM4; the asymmetric encryption uses the server's public key to encrypt the symmetric key of SM4, and the vehicle terminal uses the vehicle password module to decrypt it using a preset private key.

[0029] Preferably, the security upgrade module is equipped with a security event monitoring module and a periodically updated attack identification feature library.

[0030] Preferably, the log storage of the security upgrade module adopts HSM or a dedicated storage area. The log storage is designed as a separate storage area, which can reject unauthorized access.

[0031] Preferably, the vehicle-side is compatible with Linux and QNX vehicle operating systems and can be integrated into the vehicle T-BOX or vehicle gateway; the security upgrade module has a secure boot function, and the system cannot start normally when the certificate chain is damaged; the vehicle password module, secure communication protection module, and security upgrade module are set up independently in layers to achieve three-layer protection in depth of communication channel, communication message, and operating environment.

[0032] In addition, the present invention provides a network security protection system for remote vehicle software upgrade, used to execute the aforementioned network security protection method for remote vehicle software upgrade, including a service platform and a vehicle. The service platform is used to issue server SM2 digital certificates, distribute certificate chains, generate SM4 encryption upgrade packages, encrypt SM4 symmetric keys using the server SM2 public key, and distribute encrypted data packets. The vehicle-mounted module integrates a vehicle password module, a secure communication protection module, and a security upgrade module, which, together with a communication module, enable wireless network interaction. The secure communication protection module integrates a TLS 1.2 protocol stack and is responsible for initiating certificate requests, establishing encrypted channels, and encrypting uplink and downlink data transmission. The vehicle password module has a built-in security chip or TEE that meets the GM / T 0008 national cryptographic level 2 security capability, a pre-installed certificate chain issued by the service platform, and independently completes SM2 identity verification, SM3 hash operation, and SM4 encryption and decryption. After decryption, it automatically clears the temporary key, and reports the fault to the security upgrade module if the operation is abnormal. The security upgrade module is used for power-on security self-test, distributing legitimate upgrade packages to each ECU, collecting and reporting upgrade progress, and is equipped with a security event monitoring module to identify DOS, replay, and key brute-force attacks. It is equipped with an independent dedicated storage area or HSM to store security logs and blocks remote upgrade startup when the certificate chain is damaged. The vehicle-side upgrade host is connected to the vehicle ECU via CAN or vehicle Ethernet.

[0033] Finally, it should be noted that the above embodiments are merely illustrative and explanatory of the present invention, and are not intended to limit the present invention to the scope of the described embodiments. Furthermore, those skilled in the art will understand that the present invention is not limited to the above embodiments, and many more variations and modifications can be made based on the teachings of the present invention, all of which fall within the scope of protection claimed by the present invention.

Claims

1. A network security protection method for remote automotive software upgrades, characterized in that, The method includes the following steps: Step S1: The vehicle is powered on and started. The security upgrade module performs a security self-test, checking the status of the vehicle password module key storage and upgrade cache data. Step S2: The secure communication protection module initiates a connection and certificate issuance request to the service platform, and the service platform issues the server SM2 digital certificate; Step S3: The secure communication protection module forwards the server SM2 digital certificate to the vehicle password module, and the vehicle password module retrieves the local pre-set certificate chain to complete the legality verification of the server SM2 digital certificate; Step S4: After the certificate verification is successful, the secure communication assurance module uploads the vehicle terminal SM2 identity certificate to the service platform. The service platform completes the vehicle identity authentication and establishes an encrypted communication channel based on TLS1.

2. Step S5: The service platform uses the SM4 symmetric encryption algorithm to encrypt the upgrade package, uses the server's SM2 public key to encrypt the SM4 symmetric key, and sends the encrypted symmetric key and the encryption upgrade package together. Step S6: The secure communication module receives the data packet and transmits it to the vehicle password module; Step S7: The vehicle password module uses the local preset private key to decrypt and obtain the SM4 symmetric key, uses the SM4 to decrypt the upgrade package, and clears the temporary symmetric key in memory after decryption; if decryption fails, an exception message is pushed to the security upgrade module. Step S8: The vehicle password module uses the SM2 and SM3 digest algorithms to perform signature verification on the decrypted upgrade package. If the signature verification fails, an abnormal message is pushed to the security upgrade module simultaneously. Step S9: After the signature verification is successful, the vehicle password module sends the compliance upgrade package to the security upgrade module, which then distributes it to the corresponding ECU to execute the software flashing. The security upgrade module collects upgrade progress data in real time and reports it to the service platform in encrypted form. It also monitors DOS, replay, and key brute-force attacks. Decryption and signature verification anomalies and attack events are all stored in an isolated security log.

2. The method for network security protection of remote automotive software upgrades according to claim 1, characterized in that, The vehicle cryptographic module uses a TEE or a security chip to store the certificate chain, and the certificate chain storage area meets the security requirements of Level 2 of the national cryptographic standard as specified in GM / T008.

3. The method for network security protection of remote automotive software upgrades according to claim 1, characterized in that, The vehicle cryptographic module is equipped with a key certificate storage area and a computation area. SM2 signature verification, SM3 digest, and SM4 encryption / decryption operations are all performed independently in the computation area.

4. A network security protection method for remote automotive software upgrades according to claim 1, characterized in that, If the vehicle password module fails to verify the signature or decrypt the password, it sends an error message to the security upgrade module, which then records the corresponding security log.

5. A network security protection method for remote automotive software upgrades according to claim 1, characterized in that, The service platform uniformly issues certificate chains, and the certificate chains are pre-installed in the vehicle password module before the vehicle leaves the factory.

6. A network security protection method for remote automotive software upgrades according to claim 1, characterized in that, The secure communication protection module uses TLS 1.2 for communication channel security protection; the symmetric encryption and decryption of the upgrade package uses SM4; the asymmetric encryption uses the server's public key to encrypt the SM4 symmetric key, and the vehicle password module at the vehicle end uses a preset private key to decrypt it.

7. A network security protection method for remote automotive software upgrades according to claim 1, characterized in that, The security upgrade module is equipped with a security event monitoring module and a periodically updated attack identification feature library.

8. A network security protection method for remote automotive software upgrades according to claim 1, characterized in that, The security upgrade module's log storage uses an HSM or a dedicated storage area. The log storage is designed as a separate storage area, which can reject unauthorized access.

9. A network security protection method for remote automotive software upgrades according to claim 1, characterized in that, The vehicle-side is compatible with Linux and QNX in-vehicle operating systems and can be integrated into the in-vehicle T-BOX or in-vehicle gateway; the security upgrade module has a secure boot function, and the system cannot start normally when the certificate chain is damaged; the vehicle password module, secure communication protection module, and security upgrade module are set up independently in layers to achieve three-layer protection in depth of communication channel, communication message, and operating environment.

10. A network security protection system for remote automotive software upgrades, characterized in that, The method for implementing the network security protection method for remote automotive software upgrade as described in any one of claims 1-9 includes a service platform and a vehicle. The service platform is used to issue server SM2 digital certificates, distribute certificate chains, generate SM4 encryption upgrade packages, encrypt SM4 symmetric keys using the server SM2 public key, and distribute encrypted data packets. The vehicle-mounted module integrates a vehicle password module, a secure communication protection module, and a security upgrade module, which, together with a communication module, enable wireless network interaction. The secure communication protection module integrates a TLS 1.2 protocol stack and is responsible for initiating certificate requests, establishing encrypted channels, and encrypting uplink and downlink data transmission. The vehicle password module has a built-in security chip or TEE that meets the GM / T 0008 national cryptographic level 2 security capability, a pre-installed certificate chain issued by the service platform, and independently completes SM2 identity verification, SM3 hash operation, and SM4 encryption and decryption. After decryption, it automatically clears the temporary key, and reports the fault to the security upgrade module if the operation is abnormal. The security upgrade module is used for power-on security self-test, distributing legitimate upgrade packages to each ECU, collecting and reporting upgrade progress, and is equipped with a security event monitoring module to identify DOS, replay, and key brute-force attacks. It is also equipped with an independent dedicated storage area or HSM to store security logs and to block remote upgrade startup when the certificate chain is damaged. The vehicle-side upgrade host is connected to the vehicle's ECU via CAN or in-vehicle Ethernet.

Images