Anti-replacement production method and system for automobile controller chip, and Anti-replacement detection method and system for automobile controller chip

Abstract

The present invention relates to the field of embedded technology. Disclosed are an anti-replacement production method and system for an automobile controller chip, and an anti-replacement detection method and system for an automobile controller chip. The anti-replacement production method comprises: acquiring chip identity feature information; calculating a first hash value, and storing the first hash value; uploading the first hash value; signing the uploaded first hash value, and generating signature information; and storing the signature information. The anti-replacement detection method comprises: creating a detection task; acquiring signature information written during the anti-replacement production method, and performing signature verification to obtain a second hash value; calculating a third hash value and using same as a metric value; and making a comparison. The present invention only requires the consumption of a small amount of FLASH space and a small number of chip computing resources in an automobile controller to achieve real-time detection of anti-replacement of an automobile controller chip without the need for relying on other external devices. By means of the signature and signature verification of a hash value for chip identity feature information, false detection of the replacement of a chip caused by the replacement of an external FLASH of the chip can be prevented, thereby guaranteeing the safety and reliability of a vehicle.

Description

A method and system for preventing replacement of automobile controller chips

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority and benefits of patent application number CN202410368794.0 filed with the State Intellectual Property Office of China on March 28, 2024, and the entire text of which is incorporated herein by reference. Technical Field

[0003] The present invention relates to the field of embedded technology, and in particular to a method and system for preventing the replacement of automobile controller chips. The present invention relates to the field of embedded technology, and in particular to a method and system for preventing the replacement of automobile controller chips. Background Art

[0004] With the continuous development of intelligent automobile technology, automobile controllers have also shifted from the traditional distributed architecture that requires a large number of single-function MCU controllers to a centralized architecture with cockpit domain SOC chips and driving domain SOC chips as core controllers, and the subsequent cockpit integrated SOC chip centralized architecture. In the era of smart cars, the SOC chip that carries the smart cockpit and smart driving business will be the core component of the car. If the core SOC chip of the automobile controller is maliciously replaced, it will affect the safety and reliability of the entire automobile controller. The existing hardware anti-replacement method based on the processor security core has the following shortcomings: (1) It needs to utilize the security core function of the CPU, but not all CPUs have a security core; (2) It can only perform anti-replacement verification on the CPU's external devices, and cannot detect whether the CPU has been replaced; (3) The external device anti-replacement detection occurs during the BIOS startup phase. After the BIOS startup is completed, it is impossible to continue to detect in real time whether the external device has been replaced.

[0005] Prior art discloses a method for permanently protecting smart POS terminals from being tampered with. In this invention, a custom signature for the security processor (hereinafter referred to as SP) is used to prevent the compiled SP firmware from being tampered with or replaced. This tamper-proofing is achieved by calculating a hash value for the compiled firmware program, then signing it with a private key, and packaging the signature information into the firmware. However, this prior art method cannot detect whether the CPU has been replaced. Summary of the Invention

[0006] The purpose of the present invention is to provide a method and system for preventing replacement of automobile controller chips, so as to realize real-time prevention of replacement monitoring of the chips themselves.

[0007] To achieve the above-mentioned object, the present invention provides a method for producing an anti-replacement automobile controller chip, comprising the following steps:

[0008] S1. After the chip is powered on, obtaining chip identity feature information from a one-time programmable memory of the chip;

[0009] S2. Calculate a first hash value using the acquired chip identity feature information and save it to the FLASH of the chip plug-in;

[0010] S3. Uploading the first Hash value generated according to the chip identity feature information to a local computer. The local computer then uploads the first Hash value to a signature server. The signature server uses a private key of an asymmetric algorithm to sign the first Hash value uploaded to the signature server and generate signature information.

[0011] S4. The signature server sends the signature information to the local computer. The local computer then sends the signature information to the chip. The chip saves the received signature information to the FLASH external to the chip.

[0012] Preferably, in step S1, the chip identity feature information is a piece of information written into the one-time programmable memory of the chip when the chip leaves the factory, and the identity feature information of each chip is unique.

[0013] Preferably, in step S2, the first hash value (hash value) is calculated from the acquired chip identity feature information using a secure hash algorithm and saved in the FLASH of the chip plug-in. The secure hash algorithm includes SHA-1, SHA-224, SHA-256, SHA-384 and SHA512.

[0014] Preferably, the first hash value is of a fixed length, and the fixed length is determined by the selected secure hash algorithm; the secure hash algorithm is SHA-1, SHA-224, SHA-256, SHA-384 or SHA-512, the fixed length of SHA-1 is 1, the fixed length of SHA-224 is 224, the fixed length of SHA-256 is 256, the fixed length of SHA-384 is 384, and the fixed length of SHA-512 is 512.

[0015] The present invention also provides an anti-replacement production system for automobile controller chips, including a signature server, a local computer and an automobile controller chip. A first hash value is calculated based on the identity feature information of the automobile controller chip and saved in the FLASH external to the automobile controller chip. The first hash value is uploaded to the local computer, and the local computer uploads it to the signature server. The signature server uses a private key of an asymmetric algorithm to sign the first hash value, and then transmits the signature information of the first hash value to the local computer. The local computer sends the signature information to the automobile controller chip and saves it in the FLASH external to the automobile controller chip.

[0016] Preferably, the automobile controller chip includes an identity feature information acquisition module, a secure hash algorithm module, a signature information acquisition module and a signature information storage module;

[0017] The identity feature information acquisition module is responsible for acquiring the identity feature information in the one-time programmable memory of the vehicle controller chip;

[0018] The secure hash algorithm module provides a secure hash algorithm for generating a fixed-length hash value from the identity feature information obtained from the one-time programmable memory of the vehicle controller chip;

[0019] The signature information acquisition module is used to obtain the signature information after the server signs the hash value using the private key of the asymmetric algorithm;

[0020] The signature information storage module is used to store the signature information in the FLASH external to the automobile controller chip.

[0021] Preferably, the secure hash algorithm includes SHA-1, SHA-224, SHA-256, SHA-384 and SHA512.

[0022] Preferably, the hash value is of fixed length, and the fixed length is determined by the selected secure hash algorithm; the secure hash algorithm is SHA-1, SHA-224, SHA-256, SHA-384 or SHA-512, the fixed length of SHA-1 is 1, the fixed length of SHA-224 is 224, the fixed length of SHA-256 is 256, the fixed length of SHA-384 is 384, and the fixed length of SHA-512 is 512.

[0023] Preferably, the chip identity feature information is a piece of information written into the one-time programmable memory of the chip when the chip leaves the factory, and the identity feature information of each chip is unique.

[0024] The present invention also provides an anti-replacement detection method for an automobile controller chip, which is based on the signature information obtained in the above-mentioned anti-replacement production method for an automobile controller chip and specifically includes the following steps:

[0025] SA. Verify the signature information using the public key of the asymmetric algorithm to obtain a second hash value. If the verification fails, it indicates that the signature information stored in the external FLASH of the chip is incorrect and there is a risk that the external FLASH of the chip may be replaced. Execute step SB. If the verification passes, use the second hash value as the reference value and execute step SC.

[0026] SB, uploading the risk information of the FLASH of the external chip being replaced to the vehicle system, and then the vehicle system uploads the risk information to the cloud through the Internet of Vehicles system;

[0027] SC, obtaining identity feature information stored in a one-time programmable memory of the chip, and calculating a third hash value as a metric value using a secure hash algorithm;

[0028] SD, compare the measurement value with the reference value. If the comparison result is consistent, it means that the chip has not been replaced. After waiting for a fixed period of time, execute step SA to continue the anti-replacement detection of the chip. If the comparison result is inconsistent, it means that there is a risk of the chip being replaced. The risk information is first uploaded to the vehicle system, and then uploaded to the cloud by the vehicle system through the Internet of Vehicles system.

[0029] Preferably, in step SD, the fixed time period is set to 8 hours or 24 hours.

[0030] The present invention also provides an anti-replacement detection system for an automobile controller chip, comprising an automobile controller chip, a cloud, and a vehicle-mounted system. The system obtains signature information obtained through an anti-replacement production method for the automobile controller chip and stored in the FLASH external to the automobile controller chip, and verifies the signature information using a public key of an asymmetric algorithm. If the signature verification fails, it indicates that the signature information stored in the FLASH external to the automobile controller chip is incorrect, and the risk information is reported to the vehicle-mounted system and the cloud. If the signature verification passes, the second hash value is used as a reference value, the identity feature information stored in the one-time programmable memory of the automobile controller chip is obtained, and a third hash value is calculated as a metric value using a secure hash algorithm. The metric value is compared with the reference value. If the comparison result is inconsistent, it indicates that the chip is at risk of being replaced, and the risk information is reported to the vehicle-mounted system and the cloud.

[0031] Preferably, the automobile controller chip includes an identity feature information acquisition module, a secure hash algorithm module, a signature information storage module, a signature information verification module, a hash value comparison module and an anti-substitution result reporting module;

[0032] The identity feature information acquisition module is responsible for acquiring the identity feature information in the one-time programmable memory of the vehicle controller chip;

[0033] The secure hash algorithm module provides a secure hash algorithm for generating a fixed-length hash value from the identity feature information obtained from the one-time programmable memory of the vehicle controller chip;

[0034] The signature information acquisition module is used to obtain the signature information after the server signs the hash value using the private key of the asymmetric algorithm;

[0035] The signature information storage module is used to store the signature information in the FLASH external to the vehicle controller chip;

[0036] The signature information verification module verifies the signature information stored in the FLASH using the public key of the asymmetric algorithm solidified in the one-time programmable memory of the vehicle controller chip and the production method, and obtains the corresponding hash value as a reference value;

[0037] The hash value comparison module recalculates the hash value of the identity feature information in the one-time programmable memory of the vehicle controller chip using a secure hash algorithm as a metric value, and compares it with the reference value obtained by signature verification to determine whether it is consistent;

[0038] The anti-replacement result reporting module reports information on whether the automobile controller chip has a risk of being replaced to the vehicle system and the cloud.

[0039] Compared with the prior art, the present invention has the following beneficial effects:

[0040] The present invention only consumes a small amount of FLASH space and chip computing resources in the automobile controller, and does not require the help of other external devices. It can realize real-time detection of anti-replacement of the automobile controller chip. By signing and verifying the hash value of the identity feature information of the chip, it can prevent the false detection of chip replacement caused by the replacement of the chip's external FLASH, thereby ensuring the safety and reliability of the vehicle. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] FIG1 is a schematic flow chart of a method for producing an anti-replacement automotive controller chip according to an embodiment of the present invention;

[0042] FIG2 is a flow chart of an anti-replacement detection method for an automobile controller chip according to an embodiment of the present invention;

[0043] FIG3 is an architecture diagram of an anti-replacement production system for automotive controller chips according to an embodiment of the present invention;

[0044] FIG4 is an architecture diagram of an anti-replacement detection system for an automotive controller chip according to an embodiment of the present invention;

[0045] 5 is a schematic diagram of the information flow of the anti-replacement production method of the automobile controller chip according to an embodiment of the present invention;

[0046] FIG6 is a schematic diagram of information flow of an anti-replacement detection method for an automobile controller chip according to an embodiment of the present invention. DETAILED DESCRIPTION

[0047] The following embodiments of the present invention are described in further detail with reference to the accompanying drawings and examples. The following examples are used to illustrate the present invention but are not intended to limit the scope of the present invention.

[0048] In the description of the present invention, it should be noted that the terms "center," "longitudinal," "lateral," "upper," "lower," "front," "back," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," and "outer" and the like, indicating orientations or positional relationships, are based on the orientations or positional relationships shown in the accompanying drawings and are intended solely to facilitate the description of the present invention and simplify the description. They are not intended to indicate or imply that the devices or components referred to must have a specific orientation, be constructed, or operate in a specific orientation. Therefore, they should not be construed as limiting the present invention. Furthermore, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0049] In the description of the present invention, it should be noted that, unless otherwise expressly specified or limited, the terms "mounted," "connected," and "connected" should be understood in a broad sense. For example, they may refer to fixed, detachable, or integral connections; mechanical or electrical connections; direct or indirect connections through an intermediate medium; and internal communication between two components. Those skilled in the art will understand the specific meanings of the above terms in the present invention based on the specific circumstances.

[0050] Furthermore, in the description of the present invention, unless otherwise specified, “plurality” means two or more.

[0051] Example 1

[0052] As shown in FIG1 and FIG5 , a method for preventing replacement of an automobile controller chip according to a preferred embodiment of the present invention includes the following steps:

[0053] S1. After the chip is powered on, the chip identity information is obtained from the chip's one-time programmable memory (electronic fuse, eFuse);

[0054] S2. Calculate a first hash value using the acquired chip identity feature information and save it to the FLASH of the chip plug-in;

[0055] S3. Upload the first hash value generated according to the chip identity feature information to the local computer. The local computer then uploads the first hash value to the signature server. The signature server uses the private key of the asymmetric algorithm to sign the first hash value uploaded to the signature server and generate signature information.

[0056] S4. The signature server sends the signature information to the local computer, which then sends the signature information to the chip. The chip saves the received signature information to the FLASH memory outside the chip.

[0057] As shown in FIG1 , FIG2 , and FIG5 , in step S1 , the chip identity feature information is a piece of information written into the one-time programmable memory of the chip when the chip leaves the factory, and the identity feature information of each chip is unique.

[0058] In step S2, a secure hash algorithm is used to calculate a first hash value from the acquired chip identity feature information and save it to the FLASH of the chip plug-in. The secure hash algorithm includes SHA-1, SHA-224, SHA-256, SHA-384, and SHA512.

[0059] The first hash value has a fixed length, which is determined by the selected secure hash algorithm; if the secure hash algorithm is SHA-1, SHA-224, SHA-256, SHA-384, or SHA-512, the fixed length for SHA-1 is 1, the fixed length for SHA-224 is 224, the fixed length for SHA-256 is 256, the fixed length for SHA-384 is 384, and the fixed length for SHA-512 is 512.

[0060] In step S3, the private key of the asymmetric algorithm is the private key of the asymmetric algorithm of the publisher of the chip system image file.

[0061] In this embodiment, the secure hash algorithm may also be replaced by a CRC algorithm.

[0062] Example 2

[0063] As shown in Figure 3, this embodiment also provides an anti-replacement production system for automobile controller chips, including a signature server, a local computer (Personal Computer, PC) and an automobile controller chip. A first hash value is calculated based on the identity feature information of the automobile controller chip and saved in the FLASH of the chip plug-in. The first hash value is uploaded to the local computer, and the local computer uploads it to the signature server. The signature server uses the private key of the asymmetric algorithm to sign the first hash value, and then transmits the signature information of the first hash value to the local computer. The local computer sends the signature information to the chip and saves it in the FLASH of the chip plug-in.

[0064] Among them, the automobile controller chip includes an identity feature information acquisition module, a secure hash algorithm module, a signature information acquisition module and a signature information storage module;

[0065] The identity feature information acquisition module is responsible for acquiring the identity feature information in the one-time programmable memory of the chip;

[0066] A secure hash algorithm module, providing a secure hash algorithm for generating a fixed-length hash value from the identity feature information obtained from the one-time programmable memory of the chip;

[0067] The signature information acquisition module is used to obtain the signature information of the server after signing the hash value using the private key of the asymmetric algorithm;

[0068] The signature information storage module is used to store the hash value signature information in the FLASH plug-in of the chip.

[0069] Example 3

[0070] As shown in FIG2 and FIG6, the present invention also provides an anti-replacement detection method for an automobile controller chip. Based on the signature information obtained in the above-mentioned anti-replacement production method for an automobile controller chip, after the chip is powered on, a periodic chip anti-replacement detection task is created, and the signature information written in the anti-replacement production method is obtained from the FLASH memory plug-in of the chip. It is recommended that the detection period be set to 8 hours. A shorter detection period will consume CPU performance and may affect the execution of other services. The method specifically includes the following steps:

[0071] SA: When implementing the secure boot function, the chip will fix the public key of the asymmetric algorithm into the chip eFuse, and use the public key of the asymmetric algorithm to verify the signature information to obtain the second hash value. If the signature verification fails, it means that the signature information stored in the chip's external FLASH is incorrect and there is a risk that the chip's external FLASH may be replaced. Step SB is executed. If the signature verification passes, the second hash value is used as the reference value and step SC is executed.

[0072] SB, upload the risk information of the chip's external FLASH being replaced to the vehicle computer system, which then uploads the risk information to the cloud via the telematics box (TBOX) for the car manufacturer to review;

[0073] SC, obtains the identity feature information stored in the chip's one-time programmable memory and uses a secure hash algorithm to calculate a third hash value as a measurement value; the anti-substitution detection method regenerates the hash value to obtain the measurement value. If the chip is replaced after production, the generated measurement value will be inconsistent with the baseline value generated by the production method, thereby proving that there is a risk of chip substitution;

[0074] SD, compare the measurement value with the reference value. If the comparison results are consistent, it means that the chip has not been replaced. After waiting for a fixed period of time, execute step SA to continue chip anti-replacement detection. If the comparison results are inconsistent, it means that there is a risk of chip replacement. The risk information is first uploaded to the vehicle system, and then uploaded to the cloud by the vehicle system through the Internet of Vehicles system for the automobile manufacturer to view.

[0075] In step SD, the fixed time period is set to 8 hours or 24 hours.

[0076] This embodiment only consumes a small amount of FLASH space and chip computing resources in the automobile controller, and does not require the help of other external devices. It can achieve real-time detection of anti-replacement of the automobile controller chip. By signing and verifying the hash value of the chip's identity feature information, it can prevent the false detection of chip replacement caused by the replacement of the chip's external FLASH, thereby ensuring the safety and reliability of the vehicle.

[0077] Example 4

[0078] As shown in FIG4 , this embodiment also provides an anti-replacement detection system for an automobile controller chip, comprising an automobile controller chip, a cloud, and a vehicle-mounted system. The system obtains signature information stored in the FLASH external to the chip, obtained through the anti-replacement production method of the automobile controller chip, and verifies the signature information using the public key of the asymmetric algorithm. If the signature verification fails, it indicates that the signature information stored in the FLASH external to the chip is incorrect, and the risk information is reported to the vehicle-mounted system and the cloud. If the signature verification passes, the second hash value is used as a reference value, the identity feature information stored in the one-time programmable memory of the chip is obtained, and a third hash value is calculated as a measurement value using a secure hash algorithm. The measurement value is compared with the reference value. If the comparison result is inconsistent, it indicates that the chip is at risk of being replaced, and the risk information is reported to the vehicle-mounted system and the cloud.

[0079] The car controller chip includes an identity feature information acquisition module, a secure hash algorithm module, a signature information storage module, a signature information verification module, a hash value comparison module, and an anti-substitution result reporting module;

[0080] The identity feature information acquisition module is responsible for acquiring the identity feature information in the one-time programmable memory of the chip;

[0081] A secure hash algorithm module, providing a secure hash algorithm for generating a fixed-length hash value from the identity feature information obtained from the one-time programmable memory of the chip;

[0082] The signature information acquisition module is used to obtain the signature information of the server after signing the hash value using the private key of the asymmetric algorithm;

[0083] The signature information storage module is used to store the hash value signature information in the FLASH of the chip;

[0084] The signature information verification module uses the public key of the asymmetric algorithm solidified in the one-time programmable memory of the chip and the signature information stored in the FLASH by the production method to verify the signature and obtain the corresponding hash value as the reference value;

[0085] The hash value comparison module uses a secure hash algorithm to recalculate the hash value of the identity feature information in the chip's one-time programmable memory as a measurement value, and compares it with the reference value obtained by signature verification to see if they are consistent;

[0086] The anti-replacement result reporting module reports whether there is a risk of chip replacement to the vehicle system and the cloud.

[0087] In summary, an embodiment of the present invention provides an anti-replacement production and detection method and system for an automobile controller chip. The anti-replacement production method includes obtaining chip identity feature information, calculating a first hash value and saving and uploading it, signing the uploaded first hash value and generating signature information and saving it. The anti-replacement production system includes a signature server, a local computer and an automobile controller chip. The anti-replacement detection method includes creating a detection task, obtaining the signature information written in the anti-replacement production method and verifying the signature to obtain a second hash value, calculating a third hash value as a measurement value and comparing it. The anti-replacement detection system includes an automobile controller chip, a cloud and a vehicle-machine system. The present invention only needs to consume a small amount of FLASH space and chip computing resources in the automobile controller, and does not require the aid of other external devices to achieve real-time detection of anti-replacement of the automobile controller chip. By signing and verifying the hash value of the chip's identity feature information, it can prevent the chip from being replaced due to the replacement of the chip's external FLASH, thereby ensuring the safety and reliability of the vehicle.

[0088] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and substitutions can be made without departing from the technical principles of the present invention. These improvements and substitutions should also be regarded as the scope of protection of the present invention.

Claims

1. A method for preventing replacement of automobile controller chips, characterized in that: The steps include: S1. After the chip is powered on, obtaining chip identity feature information from a one-time programmable memory of the chip; S2. Calculate a first hash value using the acquired chip identity feature information and save it to the FLASH of the chip plug-in; S3. Uploading the first Hash value generated according to the chip identity feature information to a local computer. The local computer then uploads the first Hash value to a signature server. The signature server uses a private key of an asymmetric algorithm to sign the first Hash value uploaded to the signature server and generate signature information. S4. The signature server sends the signature information to the local computer. The local computer then sends the signature information to the chip. The chip saves the received signature information to the FLASH external to the chip.

2. The method for preventing replacement of automobile controller chips according to claim 1, characterized in that: In step S1, the chip identity feature information is a piece of information written into the one-time programmable memory of the chip when the chip leaves the factory. The identity feature information of each chip is unique.

3. The anti-replacement production method of an automobile controller chip according to claim 1 or 2, characterized in that: In step S2, the first hash value is calculated from the obtained chip identity feature information using a secure hash algorithm and saved in the FLASH of the chip plug-in. The secure hash algorithm includes SHA-1, SHA-224, SHA-256, SHA-384 and SHA512.

4. The method for preventing replacement of automobile controller chips according to claim 3, characterized in that: The first hash value is of a fixed length, and the fixed length is determined by the selected secure hash algorithm; the secure hash algorithm is SHA-1, SHA-224, SHA-256, SHA-384 or SHA-512, the fixed length of SHA-1 is 1, the fixed length of SHA-224 is 224, the fixed length of SHA-256 is 256, the fixed length of SHA-384 is 384, and the fixed length of SHA-512 is 512.

5. A replacement-proof production system for automotive controller chips, characterized in that: The system includes a signature server, a local computer, and a car controller chip. A first hash value is calculated based on the identity feature information of the car controller chip and saved in the FLASH external to the car controller chip. The first hash value is uploaded to the local computer, and the local computer uploads it to the signature server. The signature server uses a private key of an asymmetric algorithm to sign the first hash value, and then transmits the signature information of the first hash value to the local computer. The local computer sends the signature information to the car controller chip and saves it in the FLASH external to the car controller chip.

6. The anti-replacement production system for automobile controller chips according to claim 5, characterized in that: The automobile controller chip includes an identity feature information acquisition module, a secure hash algorithm module, a signature information acquisition module and a signature information storage module; The identity feature information acquisition module is responsible for acquiring the identity feature information in the one-time programmable memory of the vehicle controller chip; The secure hash algorithm module provides a secure hash algorithm for generating a fixed-length hash value from the identity feature information obtained from the one-time programmable memory of the vehicle controller chip; The signature information acquisition module is used to obtain the signature information after the server signs the hash value using the private key of the asymmetric algorithm; The signature information storage module is used to store the signature information in the FLASH external to the automobile controller chip.

7. The anti-replacement production system for automobile controller chips according to claim 6, characterized in that: The secure hash algorithms include SHA-1, SHA-224, SHA-256, SHA-384 and SHA512.

8. The anti-replacement production system for automobile controller chips according to claim 7, characterized in that: The hash value is of a fixed length, and the fixed length is determined by the selected secure hash algorithm; the secure hash algorithm is SHA-1, SHA-224, SHA-256, SHA-384 or SHA-512, the fixed length of SHA-1 is 1, the fixed length of SHA-224 is 224, the fixed length of SHA-256 is 256, the fixed length of SHA-384 is 384, and the fixed length of SHA-512 is 512.

9. The anti-replacement production system for automobile controller chips according to claim 5, characterized in that: The chip identity feature information is a piece of information written into the one-time programmable memory of the chip when the chip leaves the factory, and the identity feature information of each chip is unique.

10. A method for detecting anti-replacement of an automobile controller chip, characterized in that: The signature information obtained in the anti-replacement production method for the automobile controller chip according to any one of claims 1 to 4 specifically comprises the following steps: SA. Verify the signature information using the public key of the asymmetric algorithm to obtain a second hash value. If the verification fails, it indicates that the signature information stored in the external FLASH of the chip is incorrect and there is a risk that the external FLASH of the chip may be replaced. Execute step SB. If the verification passes, use the second hash value as the reference value and execute step SC. SB, uploading the risk information of the FLASH of the external chip being replaced to the vehicle system, and then the vehicle system uploads the risk information to the cloud through the Internet of Vehicles system; SC, obtaining identity feature information stored in a one-time programmable memory of the chip, and calculating a third hash value as a metric value using a secure hash algorithm; SD, compare the measurement value with the reference value. If the comparison result is consistent, it means that the chip has not been replaced. After waiting for a fixed period of time, execute step SA to continue the anti-replacement detection of the chip. If the comparison result is inconsistent, it means that there is a risk of the chip being replaced. The risk information is first uploaded to the vehicle system, and then uploaded to the cloud by the vehicle system through the Internet of Vehicles system.

11. The anti-replacement detection method for automobile controller chip according to claim 10, characterized in that: In step SD, the fixed time period is set to 8 hours or 24 hours.

12. An anti-replacement detection system for automobile controller chips, characterized in that: It includes an automobile controller chip, a cloud and a car system, obtains the signature information obtained by the anti-replacement production method of the automobile controller chip stored in the FLASH external to the automobile controller chip, and verifies the signature information using the public key of the asymmetric algorithm. If the signature verification fails, it means that the signature information stored in the FLASH external to the automobile controller chip is incorrect, and the risk information is reported to the car system and the cloud. If the signature verification passes, the second hash value is used as the reference value, the identity feature information stored in the one-time programmable memory of the automobile controller chip is obtained, and the third hash value is calculated as the measurement value using the secure hash algorithm, and the measurement value is compared with the reference value. If the comparison result is inconsistent, it means that the chip is at risk of being replaced, and the risk information is reported to the car system and the cloud.

13. The anti-replacement detection system for automobile controller chips according to claim 12, characterized in that: The car controller chip includes an identity feature information acquisition module, a secure hash algorithm module, a signature information storage module, a signature information verification module, a hash value comparison module, and an anti-substitution result reporting module; The identity feature information acquisition module is responsible for acquiring the identity feature information in the one-time programmable memory of the vehicle controller chip; The secure hash algorithm module provides a secure hash algorithm for generating a fixed-length hash value from the identity feature information obtained from the one-time programmable memory of the vehicle controller chip; The signature information acquisition module is used to obtain the signature information after the server signs the hash value using the private key of the asymmetric algorithm; The signature information storage module is used to store the signature information in the FLASH external to the vehicle controller chip; The signature information verification module verifies the signature information stored in the FLASH using the public key of the asymmetric algorithm solidified in the one-time programmable memory of the vehicle controller chip and the production method, and obtains the corresponding hash value as a reference value; The hash value comparison module recalculates the hash value of the identity feature information in the one-time programmable memory of the vehicle controller chip using a secure hash algorithm as a metric value, and compares it with the reference value obtained by signature verification to determine whether it is consistent; The anti-replacement result reporting module reports information on whether the automobile controller chip has a risk of being replaced to the vehicle system and the cloud.

Images