OTA upgrade method and OTA upgrade device, and computer-readable storage medium

Abstract

The embodiments of the present application disclose an OTA upgrade method and an OTA upgrade device, and a computer-readable storage medium. The OTA upgrade method includes the steps of: a terminal sending software information of a control unit to an OTA server, the software information including information and instruction information related to the current software version of the control unit, and the instruction information indicating whether there is a rollback package corresponding to the current software version of the control unit; a terminal receiving upgrade information sent by the OTA server, the upgrade information including software installation package download information of the current version and software installation package download information of the target version belonging to the control unit when there is no rollback package corresponding to the current software version of the control unit, or the upgrade information is software installation package download information of the target version when there is a rollback package corresponding to the current software version of the control unit; and a terminal performing a first operation on the control unit based on the upgrade information. According to the embodiments of the present application, the problem of rollback processing caused by the failure of OTA upgrade can be better solved.

Description

[Technical field]

[0001] This application claims priority to Chinese Patent Application No. 202110699630.2, entitled "OTA upgrade method and OTA upgrade device, and computer-readable storage medium," filed with the China State Intellectual Property Office on June 23, 2021, the entire contents of which are incorporated herein by reference.

[0002] The present application relates to the field of Internet of Vehicles and communication technologies, and in particular to an OTA upgrade method and an OTA upgrade device, and a computer-readable storage medium. [Background technology]

[0003] With the continuous development of computer technology, network technology, etc., currently, terminals are usually configured with various hardware and software (applications). For example, an intelligent cockpit, a sensing system, and an autonomous driving system are configured in a vehicle, and a vehicle-mounted operating system, a navigation application, and an audio / video playback application are also installed in the vehicle. Although the hardware and software enhance the functions of the terminal, the hardware and software are more prone to vulnerabilities, or the hardware and software need to be replaced with more advanced versions, etc. Therefore, the hardware and software (applications) of the terminal need to be upgraded.

[0004] Over-the-air (OTA) technology is a technology for downloading data over wireless networks, and this technology is widely used to upgrade devices such as vehicles, televisions, mobile phones, tablet computers, and set-top boxes. In OTA technology, automatic upgrades are mainly carried out by downloading OTA upgrade packages (or the OTA upgrade package can be copied to an SD card for upgrade). OTA upgrades are fast and have little impact on data. Therefore, OTA upgrades become the main method for upgrading terminal functions. For example, for vehicles, original equipment manufacturers (OEMs) upgrade the relevant hardware or software of the vehicle by using OTA technology. This helps manufacturers reduce recall costs, respond quickly to requirements, and improve user experience.

[0005] During the OTA upgrade, the upgrade may fail. In order to restore the version status before the upgrade when the upgrade fails, the terminal needs to be able to perform a rollback operation. For example, in the Automotive Open System Architecture (AutoSar) standard, an A / B partition upgrade and backup solution may be used. Some manufacturers also use this solution. However, the use of the A / B partition upgrade and backup solution leads to higher costs of electronic control units (ECUs), and many ECUs do not have the function of A / B partition upgrade and backup. How to better solve the rollback processing problem caused by the failure of the OTA upgrade is an urgent technical problem to be solved by those skilled in the art. Summary of the Invention [Means for solving the problem]

[0006] The present application provides an OTA upgrade method and an OTA upgrade device, and a computer-readable storage medium, for better solving the problem of rollback processing caused by the failure of OTA upgrade.

[0007] According to a first aspect, the present application provides an OTA upgrade method, the method comprising: A step of the terminal sending software information of the control unit to the OTA server, where the software information includes information about a current software version of the control unit and instruction information, and the instruction information indicates whether there is a rollback package corresponding to the current software version of the control unit; A step of the terminal receiving upgrade information sent by the OTA server, in which the upgrade information includes software installation package download information of the current version of the control unit and software installation package download information of the target version when there is no rollback package corresponding to the current software version of the control unit, or the upgrade information is software installation package download information of the target version when there is a rollback package corresponding to the current software version of the control unit; the terminal performing a first operation on the control unit based on the upgrade information; Includes.

[0008] In one embodiment of the present application, when a terminal interacts with an OTA server, regardless of whether the control unit to be upgraded supports A / B partition upgrade and backup, indication information is sent to the OTA server to indicate whether there is a rollback package corresponding to the current software version of the control unit, so that the OTA server identifies whether to deliver installation package download information used for rollback, and implements on-demand delivery of the rollback package, thereby effectively reducing traffic consumption.

[0009] In one possible implementation, the control units include a control unit that supports A / B partition upgrade and backup, or a control unit that does not support A / B partition upgrade and backup.

[0010] In one embodiment of the present application, when both a control unit supporting A / B partition upgrade and backup and a control unit not supporting A / B partition upgrade and backup exist on a terminal, the upgrade rollback procedure can be simplified and unified, and the control unit not supporting A / B partition upgrade and backup does not need to be reconstructed. In particular, in a scenario in which a terminal (e.g., a vehicle) replaces a component, regardless of whether the newly replaced component supports A / B partition upgrade and backup, the rollback function in the OTA upgrade process can be automatically compatible, thereby reducing costs.

[0011] In one possible embodiment, if the control unit supports A / B partition upgrade and backup, the indication information indicates that there is a rollback package corresponding to the current software version of the control unit; or When the control unit does not support A / B partition upgrade and backup, and the terminal stores a backup installation package for the current software version of the control unit, the indication information indicates that there is a rollback package corresponding to the current software version of the control unit, or when the control unit does not support A / B partition upgrade and backup, and the terminal does not store a backup installation package for the current software version of the control unit, the indication information indicates that there is no rollback package corresponding to the current software version of the control unit.

[0012] If it is determined that the control unit supports A / B partition upgrade and backup, the instruction information is directly generated to indicate that there is a corresponding rollback package. Alternatively, if it is determined that the control unit does not support A / B partition upgrade and backup, it is specifically detected whether the backup installation package of the current software version of the control unit is stored. In this way, the upgrade rollback procedure can be simplified and unified, and the rollback processing problem caused by the failure of the OTA upgrade can be better solved.

[0013] In another possible embodiment, the step of the terminal performing a first operation on the control unit based on the upgrade information includes: When the control unit supports A / B partition upgrade and backup, the terminal downloads a target version software installation package according to the target version software installation package download information of the control unit, and performs upgrade installation on the control unit in the backup partition according to the target version software installation package. Includes.

[0014] In one embodiment of the present application, if the control unit supports A / B partition upgrade and backup, after the target version software installation package is downloaded, the A / B partition upgrade and backup function can be used to perform an upgrade installation on the control unit in the backup partition based on the target version software installation package to perform an OTA upgrade or rollback. If the upgrade is successful, the downloaded software installation package of the target version of the control unit can be deleted, which saves storage space.

[0015] In another possible embodiment, the step of the terminal performing a first operation on the control unit based on the upgrade information includes: When the control unit does not support A / B partition upgrade and backup, when there is a rollback package corresponding to the current software version of the control unit, the terminal downloads a target version software installation package of the control unit according to the target version software installation package download information, and performs an upgrade installation on the control unit according to the target version software installation package; or when there is no rollback package corresponding to the current software version of the control unit, the terminal downloads a software installation package of a target version of the control unit according to the software installation package download information of the target version, downloads a software installation package of a current version of the control unit according to the software installation package download information of the current version of the control unit, and performs an upgrade installation on the control unit according to the software installation package of the target version. Includes.

[0016] In one embodiment of the present application, when the control unit does not support A / B partition upgrade and backup, the target version software installation package is downloaded when there is no corresponding rollback package, and after the control unit's current version software installation package is downloaded, the terminal performs upgrade according to the target version software installation package, and performs rollback processing according to the control unit's current version software installation package, which better solves the rollback processing problem caused by the failure of OTA upgrade.

[0017] In another possible embodiment, the OTA upgrade method in the present application includes: If the upgrade is successful, the terminal deletes the software installation package of the current version of the control unit and stores the software installation package of the target version of the control unit as a rollback package; Further includes:

[0018] In one embodiment of the present application, when the control unit does not support A / B partition upgrade and backup, after the upgrade is successful, the software installation package of the current version of the control unit is deleted, and the software installation package of the target version of the control unit is stored as a new rollback package, which better solves the rollback processing problem caused by the failure of the OTA upgrade.

[0019] In another possible embodiment, when the control unit supports A / B partition upgrade and backup, in the process of performing upgrade installation on the control unit in the backup partition based on the target version software installation package, the upgrade fails, and the method includes: Steps for the device to restore the failed upgrade partition to the mirror backup partition Further includes:

[0020] In one embodiment of the present application, if the control unit supports A / B partition upgrade and backup, after an upgrade failure, the partition that failed to be upgraded is restored to the mirror backup partition. Specifically, data in the partition in use is mirrored and backed up to the partition that failed to be upgraded, and the partition currently in use continues to be used. In this way, a rollback is implemented. Furthermore, the downloaded software installation package of the target version of the control unit may be deleted, which saves storage space.

[0021] In another possible embodiment, in the process of performing an upgrade installation on the control unit based on the target version software installation package, if the control unit does not support A / B partition upgrade and backup, the upgrade fails, and the method includes: The terminal performs a rollback operation based on the current version of the software installation package of the control unit, and deletes the target version of the software installation package. Further includes:

[0022] In one embodiment of the present application, if the control unit does not support A / B partition upgrade and backup, after the upgrade fails, the terminal may perform a rollback operation based on the stored software installation package of the current version of the control unit to solve the problem of rollback processing caused by the failure of the OTA upgrade.

[0023] In another possible embodiment, before the step of performing the upgrade based on the software installation package of the target version of the control unit, the method further includes the steps of the terminal receiving a first key sent by the first server and decrypting the software installation package of the target version of the control unit based on the first key. The software installation package of the target version of the control unit is generated after the first server encrypts the upgrade data of the control unit based on the second key. The first key is a decryption key corresponding to the second key.

[0024] In one embodiment of the present application, the first server may be a component supplier of the terminal, and the software installation package of the target version of the control unit is encrypted by the first server, which can prevent the core technology of the component supplier from being leaked or related data from being obtained by the OTA server, and can prevent attackers from tampering with the upgrade data, thereby improving the security of the OTA upgrade.

[0025] In another possible embodiment, the step of receiving the first key transmitted by the first server by the terminal comprises: A terminal establishing a secure channel with a first server; receiving, by the terminal, via a secure channel, a first key sent by the first server; Includes.

[0026] The secure channel may be a transmission channel based on the Secure Sockets Layer (SSL) protocol or the Transport Layer Security (TLS) protocol, and is used for secure transmission of data. Because the secure channel is a secure and reliable channel, the first server transmits the first key to the terminal through the secure channel, which can guarantee the security of the first key.

[0027] According to a second aspect, the present application provides an over-the-air (OTA) upgrade method, the method comprising: an OTA server of the control unit receiving software information sent by the terminal, the software information including information on a current software version of the control unit and instruction information, the instruction information indicating whether there is a rollback package corresponding to the current software version of the control unit; The OTA server sends upgrade information to the terminal based on the software information, where the upgrade information includes software installation package download information of the current version of the control unit and software installation package download information of the target version when there is no rollback package corresponding to the current software version of the control unit, or the upgrade information is software installation package download information of the target version of the control unit when there is a rollback package corresponding to the current software version of the control unit; Includes.

[0028] In one possible implementation, the control units include a control unit that supports A / B partition upgrade and backup, or a control unit that does not support A / B partition upgrade and backup.

[0029] In one embodiment of the present application, when the terminal interacts with the OTA server, regardless of whether the control unit to be upgraded supports A / B partition upgrade and backup, instruction information is sent to the OTA server to indicate whether there is a rollback package corresponding to the current software version of the control unit, so that the OTA server identifies whether to deliver the installation package download information used for rollback, and implements on-demand delivery of the rollback package, effectively reducing traffic consumption. When both a control unit supporting A / B partition upgrade and backup and a control unit not supporting A / B partition upgrade and backup exist on the terminal, the upgrade rollback procedure can be simplified and unified, and the control unit not supporting A / B partition upgrade and backup does not need to be reconstructed. In particular, in a scenario in which a terminal (e.g., a vehicle) replaces a component, regardless of whether the newly replaced component supports A / B partition upgrade and backup, the rollback function in the OTA upgrade process can be automatically compatible, thereby reducing costs.

[0030] According to a third aspect, an embodiment of the present application provides an over-the-air (OTA) upgrade device, the device comprising: A first sending unit configured to send software information of the control unit to an OTA server, the software information including information about a current software version of the control unit and instruction information, the instruction information indicating whether there is a rollback package corresponding to the current software version of the control unit; and A first receiving unit configured to receive upgrade information sent by an OTA server, the upgrade information including software installation package download information of a current version of the control unit and software installation package download information of a target version when there is no rollback package corresponding to the current software version of the control unit, or the upgrade information being software installation package download information of a target version when there is a rollback package corresponding to the current software version of the control unit; an execution unit configured to perform a first action on the control unit based on the upgrade information; Includes.

[0031] In one possible implementation, the control units include a control unit that supports A / B partition upgrade and backup, or a control unit that does not support A / B partition upgrade and backup.

[0032] In one possible embodiment, if the control unit supports A / B partition upgrade and backup, the indication information indicates that there is a rollback package corresponding to the current software version of the control unit; or When the control unit does not support A / B partition upgrade and backup, and the device stores a backup installation package for the current software version of the control unit, the instruction information indicates that there is a rollback package corresponding to the current software version of the control unit, or when the control unit does not support A / B partition upgrade and backup, and the device does not store a backup installation package for the current software version of the control unit, the instruction information indicates that there is no rollback package corresponding to the current software version of the control unit.

[0033] In one possible implementation, the execution unit comprises: a first download and upgrade unit configured to download a target version software installation package for the control unit according to the target version software installation package download information when there is a rollback package corresponding to the current software version of the control unit, when the control unit does not support A / B partition upgrade and backup, and perform an upgrade installation on the control unit based on the target version software installation package; a second download and upgrade unit configured to download a software installation package of a target version for the control unit based on the software installation package download information of the target version when there is no rollback package corresponding to the current software version of the control unit, download a software installation package of a current version for the control unit based on the software installation package download information of the current version of the control unit, and perform an upgrade installation on the control unit based on the software installation package of the target version. Includes.

[0034] In one possible embodiment, the device comprises: A recovery unit configured to recover a failed upgrade partition to a mirror backup partition when the upgrade fails in the process of performing an upgrade installation on a control unit with a backup partition based on a target version software installation package. Further includes:

[0035] In one possible embodiment, the device comprises: a rollback unit configured to perform a rollback operation based on the software installation package of the current version of the control unit and delete the software installation package of the target version when the upgrade fails in a process of performing an upgrade installation on the control unit in the backup partition based on the software installation package of the target version; Further includes:

[0036] According to a fourth aspect, an embodiment of the present application provides an over-the-air (OTA) server. The OTA server includes: a second receiving unit of the control unit, configured to receive software information sent by the terminal, the software information including information about a current software version of the control unit and indication information, the indication information indicating whether there is a rollback package corresponding to the current software version of the control unit; a second sending unit configured to send upgrade information to the terminal based on the software information, the upgrade information including software installation package download information of a current version of the control unit and software installation package download information of a target version when there is no rollback package corresponding to the current software version of the control unit, or the upgrade information being software installation package download information of a target version of the control unit when there is a rollback package corresponding to the current software version of the control unit; Includes.

[0037] According to a fifth aspect, the present application provides a terminal. The terminal includes a processor, and the processor is configured to support the terminal in performing a corresponding function in the OTA upgrade method according to the first aspect or any one of the possible implementations of the first aspect. The terminal may further include a memory. The memory is coupled to the processor and stores program instructions and data required for the terminal. The terminal may further include a communication interface used for communication between the terminal and another device or a communication network.

[0038] According to a sixth aspect, the present application provides an OTA server. The server includes a processor, and the processor is configured to support the server in performing a corresponding function in the OTA upgrade method according to the second aspect or any one of the possible implementations of the second aspect. The server may further include a memory. The memory is coupled to the processor and stores program instructions and data required for the server. The server may further include a communication interface used for communication between the server and another device or a communication network.

[0039] It should be noted that the program instructions and data in the memory of the present application may be pre-stored or downloaded from the Internet when the device is used and then stored. The source of the program instructions and data in the memory is not particularly limited in the present application. The coupling in the embodiments of the present application may be an indirect coupling or connection between devices, units, or modules, and may be in an electrical form, a mechanical form, or another form, and is used to exchange information between devices, units, or modules.

[0040] According to a seventh aspect, the present application provides a computer readable storage medium having stored thereon a computer program, the computer program being executed by a processor to perform a method according to the first or second aspect.

[0041] According to an eighth aspect, the present application provides a computer program product which, when read and executed by a processor, performs a method according to the first or second aspect.

[0042] The solutions provided in the second to eighth aspects can be used to implement or cooperate with the method provided in the first aspect, and thus achieve the same or corresponding beneficial effects as the first aspect, and will not be described again in detail here.

[0043] The following describes the accompanying drawings which should be used in the embodiments of this application. [Brief description of the drawings]

[0044] [Figure 1a] FIG. 1 is a diagram of a system architecture for OTA upgrade according to an embodiment of the present application. [Figure 1b] FIG. 2 is a diagram of a system architecture for OTA upgrade according to another embodiment of the present application. [Figure 1c] FIG. 1 is a functional block diagram of a vehicle 10 according to an embodiment of the present application. [Diagram 2] 1 is a schematic flowchart of an OTA upgrade method according to an embodiment of the present application; [Diagram 3] FIG. 2 is a schematic diagram of the structure of an OTA upgrade device according to an embodiment of the present application; [Figure 4] FIG. 2 is a schematic diagram of the structure of an OTA server according to an embodiment of the present application. [Diagram 5] FIG. 1 is a schematic diagram of the structure of a device according to an embodiment of the present application. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0045] The following describes embodiments of the present application with reference to the accompanying drawings in the embodiments of the present application.

[0046] In the specification, claims, and accompanying drawings of this application, the terms "first", "second", etc. are intended to distinguish different objects and do not indicate a particular order. In addition, the terms "comprise" and "have", as well as any other variations thereof, are intended to include non-exclusive inclusions. For example, a process, method, system, product, or device that includes a series of steps or units may optionally further include unlisted steps or units, or may optionally further include other inherent steps or units of the process, method, product, or device.

[0047] An "embodiment" as described herein means that a particular feature, structure, or characteristic described with reference to this embodiment may be included in at least one embodiment of the present application. Phrases appearing in various places in this specification do not necessarily refer to the same embodiment, nor do they refer to optional embodiments that are independent or incompatible with another embodiment. It is explicitly and implicitly understood by those skilled in the art that an embodiment described in this specification may be combined with another embodiment.

[0048] As used herein, terms such as "component," "module," and "system" refer to computer-related entities, hardware, firmware, a combination of hardware and software, software, or software in execution. For example, a component may be, but is not limited to, a process running on a processor, a processor, an object, an executable file, a thread of execution, a program, and / or a computer. As illustrated by the use of diagrams, both computing devices and applications running on computing devices may be components. One or more components may reside within a process and / or thread of execution, and the components may be located on one computer and / or distributed among two or more computers. Additionally, these components may execute from various computer-readable media that store various data structures. For example, the components may communicate based on signals having one or more data packets by using local and / or remote processes (e.g., data from two components interacting with another component in a local system, in a distributed system, and / or over a network such as the Internet that interacts with another system by using signals).

[0049] To aid those skilled in the art in better understanding, some terms in this application are first explained.

[0050] (1) Over-the-Air (OTA) technology is a technology for firmware or software upgrades via the air interface of mobile communications. OTA technology is widely used for network upgrades of devices such as smart TVs, mobile phones, tablet computers, and set-top boxes. With the development of intelligent connected vehicles, OTA online upgrades will become an important function of automobiles or vehicles.

[0051] (2) Telematics Box, also called T-BOX, is a compound word of Telecommunications and Informatics. T-BOX can be literally defined as a service system that provides information by using computer systems, wireless communication technologies, satellite navigation devices, or Internet technologies to exchange information such as text and voice, built into transportation tools such as automobiles, aircraft, ships, or trains. In short, the vehicle is connected to the Internet through a wireless network to provide the vehicle owner with various information necessary for driving and life.

[0052] (3) Electronic Control Unit (ECU) is a vehicle-specific microcomputer controller from a usage standpoint. Similar to a general computer, the ECU includes a microprocessor (CPU), memory (ROM and RAM), input / output (I / O) interfaces, analog-to-digital (A / D) converters, shapers, drivers, and other large scale integrated circuits. The vehicle control unit in the embodiment of this application is an electronic control unit.

[0053] (4) Vehicle control unit (VCU), sometimes called the vehicle control unit VCU of an electric vehicle, is the assembly controller of the power system of the electric vehicle. The VCU is responsible for coordinating the operation of components such as the engine, drive motor, gearbox, and power battery, and has the function of improving the power performance, safety performance, economic efficiency, etc. of the vehicle. The VCU is the core component of the vehicle control system of an electric vehicle, and is a core controller configured to control the motor of the electric vehicle in starting, operating, forward / reverse, speed change, and stopping, and control other electronic components of the electric vehicle. As the core component of the control system of a pure electric vehicle, the VCU is responsible for tasks such as data exchange, safety management, driver intention interpretation, and power stream management. The VCU collects signals of the motor control system, accelerator pedal signals, brake pedal signals, and signals of other components, determines and responds to the driver's driving intention after comprehensive analysis, and monitors the operation of the controllers of the lower layer components. The VCU plays a key role in functions such as normal vehicle driving, braking and regeneration of battery energy, network management, fault diagnosis and handling, and vehicle status monitoring.

[0054] (5) Human Machine Interface (HMI), also known as user interface, is the medium for interaction and information exchange between a system and a user, and performs the conversion between the internal form of information and a form acceptable to humans.

[0055] (6) The Controller Area Network (CAN) bus is one of the most widely used field buses in the world. The high reliability and strong error detection capabilities of the CAN bus have attracted much attention, and therefore the CAN bus is widely used in vehicle computer control systems and industrial environments with harsh ambient temperatures, strong electromagnetic radiation, and severe vibration. The CAN bus is a widely used field bus and has great application prospects in fields such as industrial measurement and control and industrial automation. CAN is a serial communication bus network. The CAN bus has the advantages of reliability, real-time, and flexibility in data communication. In order to ensure transparent design and flexible implementation, the structure of the CAN bus is divided into a physical layer and a data link layer (including a logical link control LLC sublayer and a medium access control MAC sublayer) according to the ISO / OSI standard model.

[0056] In order to better understand the OTA upgrade method provided in the embodiment of the present application, the following will first describe the system architecture and service scenarios in the embodiment of the present application. It should be noted that the system architecture and service scenarios described in the present application are intended to more clearly describe the technical solutions in the present application, and do not constitute limitations on the technical solutions provided in the present application. Those skilled in the art will understand that with the evolution of system architecture and the emergence of new service scenarios, the technical solutions provided in the present application can also be applied to similar technical problems.

[0057] 1a is a diagram of a system architecture for OTA upgrade according to an embodiment of the present application. The system architecture may include a terminal 101 and an OTA server 102.

[0058] The OTA server 102 is a server that exchanges information with the terminal 101 in the OTA upgrade process. The OTA server 102 may include an OTA service management service module 1020 and an OTA upgrade package download service module 1021. Typically, the OTA server may instruct the terminal to upgrade a specific control unit. Optionally, the OTA server may alternatively send ECU upgrade data to the terminal by using the OTA upgrade package download service module 1021. In some specific implementation scenarios, the OTA server is also referred to as an OTA cloud server or an OTA cloud-side server.

[0059] Optionally, the OTA upgrade package download service module 1021 and the OTA service management service module 1020 may be two separate hardware. Specifically, the OTA upgrade package download service module 1021 may be an independent server and provide the terminal 101 with a service for downloading an installation package.

[0060] The terminal 101 is a terminal, such as a vehicle, in which a control unit is disposed. The terminal 101 may obtain upgrade data by using the OTA server 102 to upgrade the control unit.

[0061] The control unit in the embodiments of the present application may include all units in the terminal to which OTA upgrade is applicable, such as ECU. In the following embodiments, ECU is used as an example for explanation.

[0062] Optionally, the terminal 101 may include an OTA device side upgrade management unit 1010, an OTA device side ECU upgrade package management module 1011, and an OTA device side ECU upgrade management unit 1012. The OTA device side upgrade management unit 1010 may interact with the OTA service management service module 1020, obtain upgrade information from the OTA service management service module 1020 based on software information collected by the OTA device side ECU upgrade management unit 1012, which belongs to each ECU in the terminal 101, and then trigger the OTA device side ECU upgrade package management module 1011 to download an installation package. The OTA device side ECU upgrade package management module 1011 may interact with the OTA upgrade package download service module 1021 to download and manage the installation package. The OTA device side ECU upgrade management unit 1012 is responsible for a specific ECU upgrade (rollback) process.

[0063] In some specific implementation scenarios, FIG. 1b is a diagram of a system architecture of OTA upgrade according to another embodiment of the present application. For example, the terminal 101 is a vehicle. The vehicle may be a vehicle Electrical / Electronic Architecture (E / E) based vehicle. The vehicle may include the following components: a Mobile Data Center (MDC), a Human-Machine Interaction (HMI), a device-side upgrade management unit gateway (GW), a Telematics BOX (T-Box), an Electronic Control Unit (ECU), and other modules. The GW is a core component in the vehicle's electronic / electrical architecture. As a data exchange hub of the vehicle network, the GW may route network data in different networks, such as Controller Area Network (CAN), Local Interconnect Network (LIN), Media Oriented System Transport (MOST), etc. The OTA device-side ECU upgrade package management module 1011 and the OTA device-side ECU upgrade management unit MDC are the vehicle's intelligent on-board computing platform. The T-BOX is configured to communicate with the vehicle's exterior, background system, and applications (APPs) in the mobile phone. The HMI is the vehicle's information and entertainment system. The ECU may be a vehicle-specific microcomputer controller.

[0064] For example, the OTA device side upgrade management unit 1010, the OTA device side ECU upgrade package management module 1011, and the OTA device side ECU upgrade management unit 1012 in the terminal 101 may be units in the MDC. The OTA device side upgrade management unit 1010 may specifically establish a connection to the OTA service management service module 1020 by using a T-BOX. The OTA device side ECU upgrade package management module 1011 may also specifically establish a connection to the OTA upgrade package download service module 1021 by using a T-BOX.

[0065] There is usually only one OTA device side upgrade management unit 1010 in the terminal 101, and the OTA device side upgrade management unit 1010 may be disposed in a T-BOX or a gateway. The OTA device side ECU upgrade package management module 1011 may be disposed independently in the terminal 101. Optionally, function-related ECUs in the terminal 101 may be integrated and then managed by disposing the OTA device side ECU upgrade package management module 1011 and the OTA device side ECU upgrade management unit 1012 together. The OTA device side ECU upgrade package management module 1011 and the OTA device side ECU upgrade management unit 1012 are interconnected by using a GW.

[0066] 1c is a functional block diagram of a vehicle 10 according to one embodiment of the present application. The vehicle 10 may include various subsystems, such as a driving system 110, a sensor system 120, a control system 130, one or more peripheral devices 140, a power source 150, a computer system 160, and a user interface 170. Optionally, the vehicle 10 may include more or fewer subsystems, and each subsystem may include multiple components. In addition, all subsystems and components of the vehicle 10 may be interconnected in a wired or wireless manner.

[0067] The traction system 110 may include components that provide power for the vehicle 10 to move. In one embodiment, the traction system 110 may include an engine 111, a transmission 112, an energy source 113, and wheels 114. The engine 111 may be an internal combustion engine, a motor, an air compression engine, or a combination of other types of engines, such as a hybrid engine including a gasoline engine and a motor, or a hybrid engine including an internal combustion engine and an air compression engine. The engine 111 converts the energy source 113 into mechanical energy. Examples of the energy source 113 include gasoline, diesel, other petroleum-based fuels, propane, other compressed gas-based fuels, anhydrous alcohol, solar panels, batteries, and other power sources. The energy source 113 may provide energy to other systems of the vehicle 10. The transmission 112 may transmit mechanical power from the engine 111 to the wheels 114. The transmission 112 may include a gearbox, a differential, and a drive shaft. In one embodiment, the transmission 112 may further include other components, such as a clutch. The drive shaft may include one or more shafts that may be coupled to one or more wheels 114.

[0068] The sensor system 120 may include several sensors that sense information about the surrounding environment of the vehicle 10. For example, the sensor system 120 may include a global positioning system 121 (the positioning system may be a GPS system, a Beidou system, or another positioning system), an inertial measurement unit (IMU) 122, a radar 123, a laser range finder 124, and a camera 125. The sensor system 120 may further include sensors of the internal systems of the vehicle 10 being monitored (e.g., an interior air quality monitor, a fuel gauge, and an oil temperature gauge). The sensor data from one or more of these sensors can be used to detect objects and corresponding characteristics of the objects (position, shape, orientation, speed, etc.). Such detection and identification are important functions for the safe operation of the vehicle 10. The global positioning system 121 may be configured to estimate the geographic position of the vehicle 10. The IMU 122 is configured to sense changes in the position and head orientation of the vehicle 10 based on inertial acceleration. In one embodiment, the IMU 122 may be a combination of an accelerometer and a gyroscope. The radar 123 may sense objects in the vehicle 10's environment by using radio signals. In some embodiments, in addition to sensing objects, the radar 123 may be further configured to sense the object's speed and / or direction of travel. The laser range finder 124 may sense objects in the vehicle 10's environment by using lasers. In some embodiments, the laser range finder 124 may include one or more laser sources, a laser scanner, one or more detectors, and other system components. The camera 125 may be configured to capture multiple images of the vehicle 10's environment. The camera 125 may be a still camera or a video camera.

[0069] The control system 130 controls the operation of the vehicle 10 and the components of the vehicle 10. The control system 130 may include various components, namely, a steering system 131, a throttle 132, a braking unit 133, a computer vision system 134, a route control system 135, and an obstacle avoidance system 136. The steering system 131 may be operated to adjust the direction of travel of the vehicle 10. For example, in one embodiment, the steering system 131 may be a steering wheel system. The throttle 132 is configured to control the operating speed of the engine 111 to further control the speed of the vehicle 10. The braking unit 133 is configured to control the deceleration of the vehicle 10. The braking unit 133 may decelerate the wheels 114 using friction. In another embodiment, the braking unit 133 may convert the kinetic energy of the wheels 114 into an electric current. The braking unit 133 may alternatively reduce the rotational speed of the wheels 114 in other forms to control the speed of the vehicle 10. The computer vision system 134 may be operated to process and analyze images captured by the camera 125 to identify objects and / or features in the vehicle 10's surrounding environment. The objects and / or features may include traffic lights, road boundaries, and obstacles. The computer vision system 134 may use object identification algorithms, Structure from Motion (SFM) algorithms, video tracking, and other computer vision techniques. In some embodiments, the computer vision system 134 may be configured to draw a map of the environment, track objects, and estimate object speeds. The route control system 135 is configured to determine a driving path for the vehicle 10. In some embodiments, the route control system 135 may determine a driving path for the vehicle 10 with reference to data from the sensor system 120 and one or more predefined maps. The obstacle avoidance system 136 is configured to identify, evaluate, and avoid or otherwise circumvent potential obstacles in the vehicle 10's environment.

[0070] Of course, in one example, control system 130 may include additional or alternative components in addition to those shown and described, or may omit some of the above components.

[0071] The control unit in the embodiment of the present application may be one or more control units in the control system 130. The control unit usually controls the vehicle by using an application or program instructions. The original equipment manufacturer upgrades the application in the control unit based on the actual situation and provides the user with an OTA upgrade service.

[0072] The vehicle 10 interacts with external sensors, other vehicles, other computer systems, or a user by using peripheral devices 140. The peripheral devices 140 may include a wireless communication system 141, an on-board computer 142, a microphone 143, and / or a speaker 144.

[0073] In some embodiments, the peripheral devices 140 provide a means for a user of the vehicle 10 to interact with the user interface 170. For example, the on-board computer 142 may provide information to the user of the vehicle 10. The user interface 170 may further operate the on-board computer 142 to receive input from the user. The on-board computer 142 may operate a touch screen. In other cases, the peripheral devices 140 may provide a means for the vehicle 10 to communicate with another device located within the vehicle. For example, the microphone 143 may receive audio (e.g., voice commands or other audio input) from the user of the vehicle 10. Similarly, the speaker 144 may output audio to the user of the vehicle 10. The wireless communication system 141 may wirelessly communicate with one or more devices, either directly or via a communication network. For example, the wireless communication system 141 may use 3G cellular communications, such as Code Division Multiple Access (CDMA), Evolution-Data Optimized (EVDO), Global System for Mobile Communications (GSM) / General packet radio service (GPRS), or the 4th generation mobile networks (4G) cellular communications, such as Long Term Evolution (LTE), or the 5th generation mobile networks or 5th generation wireless systems (5th-Generation, 5G) cellular communications. The wireless communication system 141 may communicate with a wireless local area network (WLAN) by using Wi-Fi.In some embodiments, the wireless communication system 141 may communicate directly with the devices by using infrared links, Bluetooth, or ZigBee. Other wireless protocols, such as various vehicle communication systems, may also be used. For example, the wireless communication system 141 may include one or more Dedicated Short Range Communications (DSRC) devices, which may include public and / or private data communications between vehicles and / or roadside stations.

[0074] The power source 150 may provide power to the various components of the vehicle 10. In one embodiment, the power source 150 may be a rechargeable lithium ion battery or a lead acid battery. One or more battery packs of such batteries may be configured as a power source to power the components of the vehicle 10. In some embodiments, the power source 150 and the energy source 113 may be implemented together, for example in some purely electric vehicles.

[0075] Some or all of the functionality of the vehicle 10 is controlled by a computer system 160. The computer system 160 may include at least one processor 161. The processor 161 executes instructions 163 stored in a non-transitory computer-readable medium, such as a memory 162. The computer system 160 may alternatively be multiple computing devices controlling individual components or subsystems of the vehicle 10 in a distributed manner.

[0076] The processor 161 may be any conventional processor, such as a commercially available Central Processing Unit (CPU). Alternatively, the processor may be a dedicated device, such as an Application Specific Integrated Circuit (ASIC) or another hardware-based processor. Although FIG. 1c illustrates the processor, memory, and other components of the computer system 160 functionally in the same block, one skilled in the art should understand that the processor, computer system, or memory may actually include multiple processors, computers, or memories that may or may not be housed in the same physical housing. For example, the memory may be a hard disk drive or another storage medium located in a housing different from that of the computer system 160. Thus, reference to a processor or computer is understood to include reference to a set of processors or computers or memories that may or may not operate in parallel. Unlike using a single processor to perform the steps described herein, some components, such as the steering component and the deceleration component, may include respective processors. The processors only perform computations related to the component's specific functions.

[0077] In various aspects described herein, the processor may be located remotely from the vehicle and in wireless communication with the vehicle, In other aspects, some processes described herein are performed on a processor located within the vehicle, while other processes, including performing steps necessary for a single operation, are performed by a remote processor.

[0078] In some embodiments, memory 162 may include instructions 163 (e.g., program logic) that may be executed by processor 161 to perform various functions of vehicle 10, including those described above. Memory 162 may also include additional instructions, including instructions for transmitting data to, receiving data from, interacting with, and / or controlling one or more of travel system 110, sensor system 120, control system 130, and peripheral devices 140.

[0079] In addition to instructions 163, memory 162 may further store data, such as software installation packages, target files, and other information that may be used by vehicle 10 and computer system 160 when software is installed on vehicle 10 or a target function is performed.

[0080] User interface 170 is configured to provide information to or receive information from a user of vehicle 10. Optionally, user interface 170 may include one or more input / output devices in a set of peripheral devices 140, such as, for example, wireless communication system 141, on-board computer 142, microphone 143, and speaker 144.

[0081] Computer system 160 may control the functions of vehicle 10 based on inputs received from various subsystems (e.g., traction system 110, sensor system 120, and control system 130) and user interface 170. For example, computer system 160 may generate target requests by using target service information from external devices. In some embodiments, computer system 160 may be operated to provide control over many aspects of vehicle 10 and its subsystems.

[0082] Optionally, one or more of the components may be installed separately from or associated with the vehicle 10. For example, the memory 162 may be partially or completely separate from the vehicle 10. The aforementioned components may be communicatively coupled to each other in a wired and / or wireless manner.

[0083] Optionally, the above components are merely examples. In practical applications, components in the above modules may be added or removed based on practical requirements. Figure 1c is not to be construed as a limitation on the embodiments of the present application.

[0084] The vehicle 10 may be a car, truck, motorcycle, bus, boat, airplane, helicopter, lawn mower, recreational vehicle, playground ride, construction equipment, trolley, golf cart, train, push cart, etc. This is not a limiting embodiment of the present application.

[0085] In the existing OTA upgrade process of the control unit, some terminals use an A / B partition upgrade and backup solution to restore the version status before the upgrade when the upgrade fails. However, the use of the A / B partition upgrade and backup solution leads to a higher cost of the ECU. Therefore, many ECUs do not have the function of A / B partition upgrade and backup. When some ECUs in a vehicle support A / B partition upgrade and backup, but other ECUs do not support A / B partition upgrade and backup, how to implement OTA upgrade for terminals that do not have the function of A / B partition upgrade and backup, and how to solve the problem of rollback processing caused by the failure of OTA upgrade are urgent technical problems to be solved by those skilled in the art. The following describes the OTA upgrade method provided in one embodiment of the present application with reference to FIG. 2.

[0086] 2 is a schematic flowchart of an OTA upgrade method according to an embodiment of the present application. In this embodiment, an example in which the control unit is an ECU is used for explanation. The method includes the following steps:

[0087] Step S200: The OTA server sends request information to the terminal.

[0088] Specifically, the request information is used to request to obtain software information of an ECU on the terminal. The OTA server may periodically send the request information to the terminal, or may send the request information when the software version of the ECU is updated.

[0089] For example, the OTA server may send the request information to an OTA device-side upgrade management unit in the terminal by using an OTA service management service module.

[0090] It should be understood that the terminal may include multiple ECUs. According to the OTA upgrade method in this embodiment of the present application, the OTA upgrade may be performed synchronously or asynchronously on multiple ECUs. For ease of explanation, an example in which the ECU is a single ECU to be upgraded is used in the following description.

[0091] Step S202: The terminal receives the request information, and generates instruction information for the ECU to be upgraded in response to the request information.

[0092] Specifically, in response to the request information, the terminal may collect current version information of the ECU, and then detect, based on the current version information, whether the terminal has stored a backup installation package of the current software version of the ECU, and generate indication information based on the detection result.

[0093] Optionally, in response to the request information, the terminal may first determine whether the ECU supports A / B partition upgrade and backup. If the ECU supports A / B partition upgrade and backup, the terminal may directly generate instruction information indicating that there is a corresponding rollback package. If the ECU does not support A / B partition upgrade and backup, the terminal may further collect current version information of the ECU, and then detect whether the terminal stores a backup installation package of the current software version of the ECU based on the current version information, and generate instruction information based on the detection result.

[0094] The step of generating instruction information based on the detection result may specifically be a step of generating instruction information indicating that a corresponding rollback package is available, when it is detected that the terminal has stored a backup installation package for the current software version of the ECU, or a step of generating instruction information indicating that a corresponding rollback package is not available, when it is detected that the terminal has not stored a backup installation package for the current software version of the ECU.

[0095] For example, the indication information may be a negotiated specific identifier, for example, an identifier "00" represents indication information indicating that there is no corresponding rollback package, and an identifier "01" represents indication information indicating that there is a corresponding rollback package.

[0096] For example, an OTA device side upgrade management unit in a terminal may collect current version information of an ECU by using an OTA device side ECU upgrade management unit, and then generate instruction information for an ECU to be upgraded based on the collected current version information.

[0097] It should be noted that in this embodiment of the present application, the step of the terminal generating the instruction information of the ECU to be upgraded is not limited to being triggered by using the step S200 of the OTA server sending request information to the terminal, or being triggered in another form. For example, the terminal generates the instruction information of the ECU to be upgraded based on a preset period, or generates the instruction information of the ECU to be upgraded based on a preset time node.

[0098] Step S204: The terminal transmits the software information of the ECU to the OTA server.

[0099] Specifically, after generating the instruction information of the ECU to be upgraded, the terminal may assemble software information of the ECU. The software information generated through the assembly may include information about the current software version of the ECU and instruction information. For example, assembling the software information of the ECU may specifically be assembling a software information tree for the information about the current software version of the ECU and instruction information.

[0100] The software tree may include node branches stacked by layers. Specifically, the software tree may be assembled by integrating the same or similar ECUs into modules based on functions and then associating the modules with terminals (e.g., vehicles). Specifically, the software may include multiple modules. Each module corresponds to a node in the software tree. In other words, each module included in the software can find a corresponding node in the software tree. The software information tree may include information and instruction information about the current software version corresponding to each of the multiple ECUs. Information and instruction information about the current software version corresponding to different ECUs may be in nodes of the same layer or different layers.

[0101] For example, after completing the assembly of the software information of the ECU by using the OTA device-side upgrade management unit, the terminal returns the software information of the ECU to the OTA service management service module in the OTA server by using the OTA device-side upgrade management unit.

[0102] Step S206: The OTA server receives the software information of the ECU.

[0103] For example, the OTA server may receive ECU software information returned by an OTA device-side upgrade management unit in the terminal by using an OTA service management service module.

[0104] Step S208: The OTA server sends upgrade information to the terminal based on the software information of the ECU.

[0105] Specifically, the OTA server may analyze the software information of the ECU to obtain the current version information and instruction information of the ECU to be upgraded. Then, the OTA server determines or selects a corresponding target version software installation package (corresponding to the software installation package upgraded to the target version) based on the current version information of the ECU to be upgraded, obtains the target version software installation package download information, and determines whether to provide the terminal with the installation package download information corresponding to the current version information of the ECU to be upgraded based on the instruction information. After the target version software installation package download information (or including the installation package download information corresponding to the current version information) is encapsulated into the upgrade information, the upgrade information is sent to the terminal. For example, the current version is V1.0 and the target version is V1.5.

[0106] The OTA server analyzes the instruction information to know whether the terminal stores a rollback package corresponding to the current software version of the ECU. For example, when the instruction information is a certain identifier, for example, the aforementioned identifier "00" or "01". In this case, after obtaining the value of the identifier by analysis, the OTA server knows whether the terminal stores a rollback package corresponding to the current software version of the ECU. If the instruction information indicates that there is no rollback package corresponding to the current software version of the ECU on the terminal side, the encapsulated upgrade information includes installation package download information corresponding to the current version information. If the instruction information indicates that there is a rollback package corresponding to the current software version of the ECU on the terminal side, the encapsulated upgrade information is the target version software installation package download information, and does not include installation package download information corresponding to the current version information.

[0107] The target version software installation package download information may specifically be address information for downloading the target version software installation package. The installation package download information corresponding to the current version information of the ECU to be upgraded may specifically be address information for downloading the installation package corresponding to the current version information of the ECU to be upgraded.

[0108] For example, the OTA server may analyze the software information of the ECU by using the OTA service management service module. After determining or selecting the corresponding software installation package of the target version, the OTA service management service module may upload the software installation package of the target version to the OTA upgrade package download service module, and obtain address information of the software installation package that is of the target version and is stored in the OTA upgrade package download service module. If the OTA service management service module determines to provide the installation package download information corresponding to the current version information of the ECU to be upgraded to the terminal based on the instruction information, the OTA service management service module may also upload the installation package corresponding to the current version information to the OTA upgrade package download service module, and obtain address information of the installation package that corresponds to the current version information and is stored in the OTA upgrade package download service module. Then, after encapsulating the software installation package download information of the target version (or including the installation package download information corresponding to the current version information) into upgrade information, the OTA service management service module sends the upgrade information to the terminal.

[0109] Step S210: The terminal receives the upgrade information, and downloads an installation package according to the upgrade information.

[0110] Specifically, when the upgrade information includes software installation package download information of the current version of the ECU and software installation package download information of the target version of the ECU. Specifically, the ECU does not support A / B partition upgrade and backup, and the terminal does not locally store the backup installation package of the current software version of the ECU as a rollback package. In this case, the terminal respectively downloads the backup installation package of the current software version of the ECU and the software installation package of the target version of the ECU based on the software installation package download information of the current version of the ECU and the software installation package download information of the target version of the ECU.

[0111] If the upgrade information is software installation package download information of the target version of the ECU, that is, the ECU supports A / B partition upgrade and backup, or the ECU does not support A / B partition upgrade and backup and the terminal locally stores the backup installation package of the current software version of the ECU as a rollback package. In this case, the terminal only needs to download the software installation package of the target version of the ECU according to the software installation package download information of the target version of the ECU.

[0112] For example, after receiving the upgrade information by using the OTA device-side upgrade management unit, the terminal may trigger the OTA device-side ECU upgrade package management module to download the installation package based on the upgrade information.

[0113] Step S212: The terminal performs an upgrade based on the downloaded software installation package of the target version of the ECU.

[0114] Specifically, if the ECU supports A / B partition upgrade and backup, the terminal may directly perform upgrade installation on the backup partition based on the downloaded software installation package of the target version of the ECU. If the ECU does not support A / B partition upgrade and backup, the terminal may upgrade the ECU in the currently running system environment based on the downloaded software installation package of the target version of the ECU.

[0115] For example, the terminal may use the OTA device-side upgrade management unit to trigger the OTA device-side ECU upgrade management unit to upgrade the ECU to be upgraded based on the downloaded software installation package of the target version of the ECU. After completing the upgrade, the OTA device-side ECU upgrade management unit may return upgrade completion information to the OTA device-side upgrade management unit. The OTA device-side upgrade management unit may query the OTA device-side ECU upgrade management unit for the upgrade result.

[0116] When the upgrade result is upgrade successful, if the ECU supports A / B partition upgrade and backup, the terminal may directly delete the software installation package of the target version of the ECU and switch to the backup partition. In this case, the original partition in use becomes the new backup partition. Alternatively, if the ECU does not support A / B partition upgrade and backup, the terminal may delete the software installation package of the current version of the ECU and store the software installation package of the target version of the ECU as a rollback package.

[0117] If the upgrade result is that the upgrade is unsuccessful, step S214 may be performed.

[0118] Step S214: If the upgrade fails, the terminal performs a rollback operation.

[0119] Specifically, if the ECU supports A / B partition upgrade and backup, the terminal restores the partition where the upgrade failed to the mirror backup partition. Specifically, the terminal may mirror and back up the data in the partition in use to the partition where the upgrade failed, continue to use the partition currently in use, and delete the downloaded software installation package of the target version of the ECU. In other words, after an upgrade fails on the backup partition, the terminal does not switch to the mirror backup partition, but continues to mirror and back up the data in the partition in use to the backup partition.

[0120] If the ECU does not support A / B partition upgrade and backup, the terminal may perform a rollback operation based on the stored software installation package of the current version of the ECU (the software installation package is always stored in the terminal or is stored after being downloaded by using step S210), and then delete the software installation package of the target version of the ECU.

[0121] In this embodiment of the present application, when the terminal interacts with the OTA server, regardless of whether the ECU to be upgraded supports A / B partition upgrade and backup, instruction information is sent to the OTA server to indicate whether there is a rollback package corresponding to the current software version of the ECU, so that the OTA server identifies whether to deliver the installation package download information used for rollback, and implements on-demand delivery of the rollback package, effectively reducing traffic consumption. In addition, when both an ECU that supports A / B partition upgrade and backup and an ECU that does not support A / B partition upgrade and backup exist on the terminal, the upgrade rollback procedure can be simplified and unified, and the ECU that does not support A / B partition upgrade and backup does not need to be rebuilt. In particular, in a scenario in which a terminal (e.g., a vehicle) replaces a component, regardless of whether the newly replaced component supports A / B partition upgrade and backup, the rollback function in the OTA upgrade process can be automatically compatible, thereby reducing costs.

[0122] In another possible embodiment, before the step of performing the upgrade based on the software installation package of the target version of the ECU, the method may further include the steps of: the terminal receiving a first key sent by the first server, and decrypting the software installation package of the target version of the ECU based on the first key. The software installation package of the target version of the ECU is generated after the first server encrypts the upgrade data of the ECU based on the second key. The first key is a decryption key corresponding to the second key.

[0123] The existing OTA upgrade model is dominated by the original equipment manufacturer (OEM). The OEM is responsible for reviewing the software version of the upgrade package and distributing the upgrade package. However, with the development of intelligent connected vehicles, when some sensitive components and special applications need to be upgraded, if the upgrade package is submitted to the OEM for review and then downloaded by using the OTA server, the core technology of the component supplier may be leaked or related data may be exposed.

[0124] The first server in this embodiment of the present application may be a component supplier of the terminal. Specifically, the first server may encrypt the upgrade data by using the second key to obtain a target version software installation package (i.e., upgrade package), and then upload the software installation package to the OTA server. Specifically, the target version software installation package of the ECU is encrypted by the first server, and after downloading the target version software installation package, the terminal may decrypt the software installation package by using the corresponding decryption key (first key). This can prevent the core technology of the component supplier from being leaked or related data from being obtained by the OTA server, and can prevent the attacker from tampering with the upgrade data, thereby improving the security of the OTA upgrade.

[0125] It should be noted that the first server in this embodiment of the present application may be a server cluster in which multiple servers are deployed by using a distributed architecture. The cluster may include a cloud computing server, a Content Delivery Network (CDN) server, a Network Time Protocol (NTP), a Domain Name System (DNS) server, etc.

[0126] The second key may be a symmetric key or an asymmetric key. Specifically, when the ciphertext is obtained by encryption using an asymmetric encryption algorithm, the encryption key is usually different from the decryption key. When the ciphertext is obtained by encryption using a symmetric encryption algorithm, the encryption key is the same as the decryption key.

[0127] In another possible embodiment, the step of receiving the first key transmitted by the first server by the terminal comprises: A terminal establishing a secure channel with a first server; receiving, by the terminal, via a secure channel, a first key sent by the first server; Includes.

[0128] The secure channel may be a transmission channel based on the Secure Sockets Layer (SSL) protocol or the Transport Layer Security (TLS) protocol, and is used for secure transmission of data. Because the secure channel is a secure and reliable channel, the first server transmits the first key to the terminal through the secure channel, which can guarantee the security of the first key.

[0129] The above describes in detail the method in the embodiment of the present application, and the following provides the related apparatus in the embodiment of the present application.

[0130] 3 is a schematic diagram of the structure of an OTA upgrade device according to an embodiment of the present application. The OTA upgrade device 30 corresponds to the terminal in the above-mentioned method embodiment, and may include: a first sending unit 300, a first receiving unit 302, and an executing unit 304.

[0131] The first sending unit 300 is configured to send software information of the control unit to the OTA server. The software information includes information about a current software version of the control unit and indication information, and the indication information indicates whether there is a rollback package corresponding to the current software version of the control unit.

[0132] The first receiving unit 302 is configured to receive upgrade information sent by the OTA server, where the upgrade information includes software installation package download information of the current version of the control unit and software installation package download information of the target version when there is no rollback package corresponding to the current software version of the control unit, or the upgrade information is software installation package download information of the target version when there is a rollback package corresponding to the current software version of the control unit.

[0133] The execution unit 304 is configured to perform a first action on the control unit based on the upgrade information.

[0134] In one possible implementation, the control units include a control unit that supports A / B partition upgrade and backup, or a control unit that does not support A / B partition upgrade and backup.

[0135] In one possible embodiment, if the control unit supports A / B partition upgrade and backup, the indication information indicates that there is a rollback package corresponding to the current software version of the control unit; or When the control unit does not support A / B partition upgrade and backup, and the device stores a backup installation package for the current software version of the control unit, the instruction information indicates that there is a rollback package corresponding to the current software version of the control unit, or when the control unit does not support A / B partition upgrade and backup, and the device does not store a backup installation package for the current software version of the control unit, the instruction information indicates that there is no rollback package corresponding to the current software version of the control unit.

[0136] In one possible implementation, the execution unit 304 may include: a first download and upgrade unit configured to, when the control unit does not support A / B partition upgrade and backup, download a software installation package of a target version according to software installation package download information of the target version when there is a rollback package corresponding to the current software version of the control unit, and perform an upgrade installation on the control unit based on the software installation package of the target version; or a second download and upgrade unit configured to download a software installation package of a target version based on the software installation package download information of the target version when there is no rollback package corresponding to the current software version of the control unit, download a software installation package of a current version of the control unit based on the software installation package download information of the current version of the control unit, and perform an upgrade installation on the control unit based on the software installation package of the target version. It may particularly include:

[0137] In one possible embodiment, the OTA upgrade device 30 may further include a restore unit 306 configured to restore the partition where the upgrade has failed to the mirror backup partition when the upgrade fails in the process of performing an upgrade installation on the control unit on the backup partition based on the target version software installation package.

[0138] In one possible embodiment, the OTA upgrade device 30 may further include a rollback unit 308 configured to perform a rollback operation based on the current version software installation package of the control unit and delete the target version software installation package when the upgrade fails in the process of performing upgrade installation on the control unit in the backup partition based on the target version software installation package.

[0139] In one possible embodiment, the first receiving unit 302 in the OTA upgrade device 30 may be further configured to receive a first key sent by the first server before the upgrade is performed based on the software installation package of the target version of the ECU, and decrypt the software installation package of the target version of the ECU based on the first key. The software installation package of the target version of the ECU is generated after the first server encrypts the upgrade data of the ECU based on the second key. The first key is a decryption key corresponding to the second key.

[0140] The OTA upgrade device 30 may further include an establishing unit configured to establish a secure channel with the first server. Then, the first receiving unit 302 may receive the first key sent by the first server through the secure channel.

[0141] Please note that for the implementation of the units in the OTA upgrade device 30 described in this embodiment of the present application, please refer to the relevant description of the terminal in the preceding method embodiment, and the details will not be described again here.

[0142] It should be understood that the OTA upgrade device 30 may further integrate functions such as an intelligent driving system, a life service system, a security protection system, a location information service system, a vehicle service system, etc., by using technologies such as computers, modern sensing, information fusion, communication, artificial intelligence, and automatic control, etc. This is not particularly limited in this application, and the details will not be described again.

[0143] 4 is a schematic diagram of the structure of an OTA server according to an embodiment of the present application. The OTA server 40 corresponds to the OTA server in the above method embodiment, and may include: a second receiving unit 400 and a second sending unit 402.

[0144] The second receiving unit 400 is of the control unit and is configured to receive software information sent by the terminal. The software information includes information about the current software version of the control unit and indication information, and the indication information indicates whether there is a rollback package corresponding to the current software version of the control unit.

[0145] The second sending unit 402 is configured to send upgrade information to the terminal based on the software information, where the upgrade information includes the software installation package download information of the current version of the control unit and the software installation package download information of the target version when there is no rollback package corresponding to the current software version of the control unit, or the upgrade information is the software installation package download information of the target version when there is a rollback package corresponding to the current software version of the control unit.

[0146] Please note that for the implementation of the units in the OTA server 40 described in this embodiment of the present application, please refer to the relevant description of the OTA server in the preceding method embodiment, and the details will not be described again here.

[0147] Figure 5 is a schematic diagram of the structure of a device according to an embodiment of the present application. Both the terminal and the server in the embodiment of the present application may be implemented by using the structure of Figure 5. The device 50 includes at least one processor 501, at least one memory 502, and at least one communication interface 503. In addition, the device may further include general-purpose components such as an antenna. Details will not be described again here.

[0148] The processor 501 may be a general purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling program execution of the aforementioned solutions.

[0149] The communication interface 503 is configured to communicate with another device or communication network, for example, an OTA server, a key server, or an in-vehicle device.

[0150] The memory 502 may be, but is not limited to, a read-only memory (ROM) or another type of static storage device capable of storing static information and instructions, a random access memory (RAM) or another type of dynamic storage device capable of storing information and instructions, an Electrically Erasable Programmable Read-Only Memory (EEPROM), a Compact Disc Read-Only Memory (CD-ROM) or another optical disk storage, an optical disk storage (including compact disks, laser disks, optical disks, digital versatile disks, Blu-ray disks, etc.), a magnetic disk storage medium or another magnetic storage device, or any other medium that can be used to hold or store expected program code in the form of instructions or data structures and that can be accessed by a computer. The memory may exist independently or be connected to the processor via a bus. The memory may alternatively be integral to the processor.

[0151] The memory 502 is configured to store application code for carrying out the aforementioned solution, and the processor 501 controls the execution. The processor 501 is configured to execute the application code stored in the memory 502.

[0152] When the device 50 shown in FIG. 5 is a terminal, the code stored in the memory 502 may be used to perform terminal-side processing steps in the OTA upgrade method provided in FIG. 2, including the steps of sending software information of the control unit to an OTA server, receiving upgrade information sent by the OTA server, and performing a first operation on the control unit based on the upgrade information.

[0153] The control unit includes a control unit that supports A / B partition upgrade and backup, or a control unit that does not support A / B partition upgrade and backup.

[0154] If the control unit supports A / B partition upgrade and backup, the indication information indicates that there is a rollback package corresponding to the current software version of the control unit; or When the control unit does not support A / B partition upgrade and backup, and the terminal stores a backup installation package of the current software version of the control unit, the indication information indicates that there is a rollback package corresponding to the current software version of the control unit, or when the control unit does not support A / B partition upgrade and backup, and the terminal does not store a backup installation package of the current software version of the control unit, the indication information indicates that there is no rollback package corresponding to the current software version of the control unit.

[0155] The step of the terminal performing a first operation on the control unit based on the upgrade information includes: When the control unit supports A / B partition upgrade and backup, the terminal downloads a software installation package of the target version according to the software installation package download information of the target version, and performs an upgrade installation on the control unit in the backup partition according to the software installation package of the target version. Includes.

[0156] The step of the terminal performing a first operation on the control unit based on the upgrade information includes: When the control unit does not support A / B partition upgrade and backup, when there is a rollback package corresponding to the current software version of the control unit, the terminal downloads a software installation package of the target version according to the software installation package download information of the target version, and performs an upgrade installation on the control unit according to the software installation package of the target version; or when there is no rollback package corresponding to the current software version of the control unit, the terminal downloads a software installation package of the target version according to the software installation package download information of the target version, downloads a software installation package of the current version of the control unit according to the software installation package download information of the current version of the control unit, and performs an upgrade installation on the control unit according to the software installation package of the target version. Includes.

[0157] In the process of performing an upgrade installation on a control unit in a backup partition based on a software installation package of a target version, the upgrade fails, and the method includes: Steps for the device to restore the failed upgrade partition to the mirror backup partition Further includes:

[0158] In the process of performing an upgrade installation on the control unit based on the target version of the software installation package, the upgrade fails, and the method includes: The terminal performs a rollback operation based on the current version of the software installation package of the control unit, and deletes the target version of the software installation package. Further includes:

[0159] Please note that if the device 50 is a terminal, for implementation, please refer to the relevant description of the terminal in the preceding method embodiment, and the details will not be described again here.

[0160] When the device shown in FIG. 5 is an OTA server, the code stored in memory 502 is of a control unit and can be used to perform OTA server-side processing steps in the OTA upgrade method provided in FIG. 2, including receiving software information sent by the terminal and sending upgrade information to the terminal based on the software information.

[0161] Please note that if the device 50 is an OTA server, for implementation, please refer to the relevant description of the OTA server in the preceding method embodiment, and details will not be described again here.

[0162] An embodiment of the present application further provides a computer-readable storage medium, which stores a computer program, which, when executed on one or more processors, performs the method of the embodiment shown in FIG.

[0163] An embodiment of the present application further provides a computer program or computer program product, which, when run on one or more processors, performs the method of the embodiment shown in FIG.

[0164] An embodiment of the present application further provides a chip system. The chip system includes a communication interface and at least one processor. The communication interface is configured to provide information input / output to the at least one processor, and / or the communication interface is configured to transmit or receive data. The processor is configured to call a computer program (or computer instruction) to perform the terminal-side or OTA server-side processing steps in the embodiment shown in FIG. 2.

[0165] All or part of the above-mentioned embodiments may be implemented by using software, hardware, firmware, or any combination thereof. When software is used to implement the embodiments, all or part of the embodiments may be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the procedures or functions according to the embodiments of the present application are generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from a computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website, computer, server, or data center to another website, computer, server, or data center in a wired (e.g., coaxial cable, optical fiber, digital subscriber line) manner or in a wireless (e.g., infrared, radio wave, microwave) manner. The computer-readable storage medium may be any available medium accessible by a computer, or may be a data storage device that integrates one or more available media, such as a server or a data center. The usable media may be magnetic media (eg, floppy disks, hard disks, or magnetic tapes), optical media (eg, DVDs), semiconductor media (eg, solid state drives), and the like.

[0166] Those skilled in the art may understand that all or part of the steps of the method in the embodiment may be implemented by a computer program that instructs relevant hardware. The program may be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiment may be performed. The above-mentioned storage medium includes any medium that can store program code, such as a ROM, a random access memory RAM, a magnetic disk, and an optical disk. [Explanation of symbols]

[0167] 10 Vehicles 30 OTA upgrade device 40 OTA Server 50 Devices 101 Terminal 102 OTA Server 110 Running System 111 Engine 112 Gearbox 113 Energy Sources 114 Wheels 120 Sensor System 121 Global Positioning System 122 Inertial Measurement Unit 123 Radar 124 Laser Rangefinder 125 Camera 130 Control System 131 Steering System 132 Throttle 133 Brake unit 134 Computer Vision Systems 135 Route Control System 136 Obstacle Avoidance System 140 Peripheral Devices 141 Wireless communication systems 142 On-board computer 143 Microphone 144 Speaker 150 Power supply 160 Computer Systems 161 processors 162 Memory 163 Command 170 User Interface 300 First transmitting unit 302 first receiving unit 304 Execution Unit 306 Recovery Unit 308 Rollback Unit 400 Second receiving unit 402 second transmitting unit 501 Processor 502 Memory 503 Communication Interface 1010 OTA device side upgrade management unit 1011 OTA device side ECU upgrade package management module 1012 OTA device side ECU upgrade management unit 1020 OTA Service Management Service Module 1021 OTA upgrade package download service module

Claims

1. 1. An over-the-air (OTA) upgrade method, comprising: sending, by a terminal, software information of a control unit to an OTA server, the software information including information about a current software version of the control unit and instruction information, the instruction information indicating whether there is a rollback package corresponding to the current software version of the control unit; receiving, by the terminal, upgrade information sent by the OTA server, in which if there is no rollback package corresponding to the current software version of the control unit, the upgrade information includes software installation package download information of the current version and software installation package download information of a target version belonging to the control unit, or if there is the corresponding rollback package in the current software version of the control unit, the upgrade information is software installation package download information of a target version; performing, by the terminal, a first operation on the control unit based on the upgrade information; A method comprising:

2. The method of claim 1 , wherein the control unit includes a control unit that supports A / B partition upgrade and backup or a control unit that does not support A / B partition upgrade and backup.

3. If the control unit supports A / B partition upgrade and backup, the indication information indicates that the current software version of the control unit has the corresponding rollback package; or 2. The method of claim 1, wherein, when the control unit does not support A / B partition upgrade and backup, if the terminal stores a backup installation package for the current software version of the control unit, the instruction information indicates that the current software version of the control unit has the corresponding rollback package, or, when the control unit does not support A / B partition upgrade and backup, if the terminal does not store a backup installation package for the current software version of the control unit, the instruction information indicates that there is no rollback package corresponding to the current software version of the control unit.

4. The step of performing a first operation on the control unit based on the upgrade information by the terminal includes: downloading, by the terminal, a software installation package of the target version according to the software installation package download information of the target version, and performing an upgrade installation on the control unit in a backup partition according to the software installation package of the target version, if the control unit supports A / B partition upgrade and backup. The method according to any one of claims 1 to 3, comprising:

5. The step of performing a first operation on the control unit based on the upgrade information by the terminal includes: When the control unit does not support A / B partition upgrade and backup, when the current software version of the control unit has the corresponding rollback package, downloading, by the terminal, a software installation package of the target version according to the software installation package download information of the target version, and performing an upgrade installation on the control unit according to the software installation package of the target version; or downloading, by the terminal, a software installation package of the target version based on the software installation package download information of the target version when there is no rollback package corresponding to the current software version of the control unit, downloading a software installation package of the current version of the control unit based on the software installation package download information of the current version of the control unit, and performing an upgrade installation on the control unit based on the software installation package of the target version. The method according to any one of claims 1 to 3, comprising:

6. In the process of performing an upgrade installation on the control unit in a backup partition based on the software installation package of the target version, the upgrade fails, and the method includes: restoring the upgrade-failed partition to a mirror backup partition by the terminal.

5. The method of claim 4, further comprising:

7. In the process of performing an upgrade installation on the control unit based on the software installation package of the target version, the upgrade fails, and the method includes: performing a rollback operation by the terminal based on the software installation package of the current version of the control unit, and deleting the software installation package of the target version; 6. The method of claim 5, further comprising:

8. The method comprises: If the upgrade is successful, deleting, by the terminal, the software installation package of the current version of the control unit and storing the software installation package of the target version of the control unit as a rollback package.

6. The method of claim 4 or 5, further comprising:

9. Before the terminal performs an upgrade installation based on the software installation package of the target version of the control unit, the method includes: receiving, by the terminal, a first key sent by a first server; decrypting, by the terminal, the software installation package of the target version of the control unit based on the first key, where the software installation package of the target version of the control unit is generated after the first server encrypts the upgrade data of the control unit based on a second key, and the first key is a decryption key corresponding to the second key; 9. The method of claim 4, further comprising:

10. The step of receiving, by the terminal, a first key transmitted by a first server includes: establishing, by the terminal, a secure channel with the first server; receiving, by the terminal, the first key sent by the first server via the secure channel; 10. The method of claim 9, comprising:

11. 1. An over-the-air (OTA) upgrade method, comprising: receiving, by an OTA server, software information of a control unit and sent by a terminal, the software information including information on a current software version of the control unit and instruction information, the instruction information indicating whether there is a rollback package corresponding to the current software version of the control unit; sending upgrade information to the terminal by the OTA server based on the software information, where if there is no rollback package corresponding to the current software version of the control unit, the upgrade information includes software installation package download information of the current version and software installation package download information of a target version belonging to the control unit, or if there is the corresponding rollback package in the current software version of the control unit, the upgrade information is software installation package download information of a target version; A method comprising:

12. The method of claim 11 , wherein the control unit includes a control unit that supports A / B partition upgrade and backup or a control unit that does not support A / B partition upgrade and backup.

13. An over-the-air (OTA) upgrade device, a first sending unit configured to send software information of a control unit to an OTA server, the software information including information about a current software version of the control unit and instruction information, the instruction information indicating whether there is a rollback package corresponding to the current software version of the control unit; a first receiving unit configured to receive upgrade information sent by the OTA server, the upgrade information including software installation package download information of the current version of the control unit and software installation package download information of a target version when the current software version of the control unit does not have a corresponding rollback package, or the upgrade information is software installation package download information of a target version when the current software version of the control unit has the corresponding rollback package; an execution unit configured to perform a first action on the control unit based on the upgrade information; 13. An apparatus comprising:

14. The apparatus of claim 13 , wherein the control unit includes a control unit that supports A / B partition upgrade and backup or a control unit that does not support A / B partition upgrade and backup.

15. If the control unit supports A / B partition upgrade and backup, the indication indicates that there is a rollback package corresponding to the current software version of the control unit; or 14. The apparatus of claim 13, wherein if the control unit does not support A / B partition upgrade and backup and the device stores a backup installation package for the current software version of the control unit, the instruction information indicates that the current software version of the control unit has the corresponding rollback package, or if the control unit does not support A / B partition upgrade and backup and the device does not store a backup installation package for the current software version of the control unit, the instruction information indicates that there is no rollback package corresponding to the current software version of the control unit.

16. The execution unit includes: a first download and upgrade unit configured to, when the control unit does not support A / B partition upgrade and backup, download a software installation package of the target version based on the software installation package download information of the target version when the current software version of the control unit has the corresponding rollback package, and perform an upgrade installation on the control unit based on the software installation package of the target version; or a second download and upgrade unit configured to download a software installation package of the target version based on the software installation package download information of the target version when there is no rollback package corresponding to the current software version of the control unit, download a software installation package of the current version of the control unit based on the software installation package download information of the current version of the control unit, and perform an upgrade installation on the control unit based on the software installation package of the target version.

16. The apparatus of claim 13, further comprising:

17. The apparatus comprises: a restore unit configured to restore the partition where the upgrade has failed to a mirror backup partition when the upgrade fails in a process of performing an upgrade installation on the control unit on a backup partition based on the software installation package of the target version; 16. The apparatus of claim 15, further comprising:

18. The apparatus comprises: a rollback unit configured to perform a rollback operation based on the software installation package of the current version of the control unit and delete the software installation package of the target version when an upgrade fails in the process of performing an upgrade installation on the control unit based on the software installation package of the target version.

17. The apparatus of claim 16, further comprising:

19. 19. The apparatus according to claim 15, wherein the first receiving unit is further configured to receive a first key sent by a first server before an upgrade installation is performed based on the software installation package of the target version of the control unit, and to decrypt the software installation package of the target version of the control unit based on the first key, the software installation package of the target version of the control unit being generated after the first server encrypts upgrade data of the control unit based on a second key, and the first key is a decryption key corresponding to the second key.

20. The apparatus further includes an establishing unit configured to establish a secure channel with the first server; 20. The apparatus of claim 19, wherein the first receiving unit receives the first key sent by the first server via the secure channel.

21. An over-the-air (OTA) server, a second receiving unit of the control unit, configured to receive software information sent by a terminal, the software information including information about a current software version of the control unit and indication information, the indication information indicating whether there is a rollback package corresponding to the current software version of the control unit; a second sending unit configured to send upgrade information to the terminal based on the software information, the upgrade information including software installation package download information of the current version and software installation package download information of a target version belonging to the control unit when there is no rollback package corresponding to the current software version of the control unit, or the upgrade information being software installation package download information of a target version when there is the corresponding rollback package in the current software version of the control unit; Including the OTA server.

22. An over-the-air (OTA) upgrade system, A terminal and an OTA server, The terminal comprises an apparatus according to any one of claims 13 to 20, The OTA server is an OTA server according to claim 21. OTA upgrade system.

23. 13. A computer-readable storage medium having a computer program stored thereon, the computer program being executed by a processor to perform the method of any one of claims 1 to 10 or to perform the method of claim 11 or 12.

24. 13. A computer program comprising instructions which, when executed by a computer, enable the computer to perform the method according to any one of claims 1 to 10 or the method according to claim 11 or 12.

Images