Security management method and apparatus, lidar, and terminal device

Abstract

The present disclosure provides a security management method and apparatus, a lidar, and a terminal device. The security management method is used for a lidar. The lidar has a security configuration used for security verification of a security event of the lidar. The security event includes one or more of the following events: inter-board authentication, communication, startup, data storage, and upgrade. The security management method comprises: performing security verification on a security event on the basis of a security configuration; and performing security processing on the basis of a security verification result.

Description

Safety management methods and devices, lidar and terminal equipment

[0001] This disclosure claims priority to Chinese patent application No. 202410509074.1, filed on April 25, 2024, entitled "Security Management Method and Apparatus, LiDAR and Terminal Equipment", the contents of which are incorporated herein by reference in their entirety. Technical Field

[0002] This disclosure relates to the field of lidar, and more particularly to a security management method and apparatus, lidar, and terminal equipment. Background Technology

[0003] LiDAR (Light Detection and Ranging) uses laser light as a medium for object detection and is applied in many fields, such as intelligent driving (e.g., assisted driving or autonomous driving), drones, robot recognition, geographic mapping, and environmental monitoring. In these applications, LiDAR acts as a sensing device, providing the system with sensory data. This sensory data serves as the system's input and is crucial for the system's functionality. The security of LiDAR is directly related to the security of the applied system; therefore, improving LiDAR security is essential. Summary of the Invention

[0004] This disclosure provides a security management method and apparatus, a lidar, and a terminal device to improve the security performance of lidar.

[0005] In a first aspect, this disclosure provides a security management method for a lidar, the lidar having a security configuration, for security verification of security events of the lidar, the security events including one or more of the following events: inter-board authentication, communication, startup, data storage, or upgrade, and the method includes: performing security verification of security events based on the security configuration; and performing security processing based on the results of the security verification.

[0006] By configuring security at the security event level within the lidar, attacks from outside the lidar can be monitored and defended, improving the lidar's security performance and giving it better defense capabilities when facing attacks.

[0007] Optionally, the security configuration includes a first configuration for security verification of inter-board authentication; and security verification of security events based on the security configuration includes: performing inter-board security verification between the first and second circuit boards of the LiDAR based on the first configuration, wherein an inter-board authentication anomaly occurs when the inter-board security verification fails. Through inter-board security verification, unverified circuit boards can be identified, ensuring authentication before inter-board collaboration, thereby improving the security of the LiDAR.

[0008] Optionally, inter-board security verification is performed on the first and second circuit boards of the LiDAR based on the first configuration, including: verifying the first circuit board on the second circuit board based on a first encryption result, a first random number, and a first identifier stored in the second circuit board, wherein the first configuration includes a first identifier for identifying the first circuit board and stored in both the first and second circuit boards; the first encryption result is determined on the first circuit board based on the first identifier and the first random number stored in the first circuit board; or, authenticating the first circuit board on the second circuit board based on a second encryption result, an authentication public key, and an authentication signature; wherein the first configuration includes an authentication public key stored in the second circuit board and an authentication signature, authentication data, and a first identifier stored in the first circuit board; the second encryption result is determined on the first circuit board based on the authentication data and the first identifier, wherein the first identifier is used to identify the first circuit board.

[0009] Inter-board security verification through circuit board identification enables the identification of unauthorized circuit boards, further enhancing the security of LiDAR. Furthermore, introducing authentication data can further strengthen the security of inter-board authentication, making malicious attacks more difficult.

[0010] Optionally, the authentication data includes the configuration data of the LiDAR. By reusing the LiDAR's data resources for inter-board authentication, storage space and data resources are saved.

[0011] Optionally, the security configuration includes a second configuration for secure communication verification; and security verification of security events is performed based on the security configuration, including: performing secure communication verification between the LiDAR and the terminal device based on the second configuration; wherein, when the secure communication verification fails, a communication anomaly occurs; or when the secure communication verification succeeds, data is transmitted to the terminal device. The secure communication verification using the second configuration can improve the communication security of the LiDAR.

[0012] Optionally, the lidar also features a secure transmission configuration for secure communication transmission, and the security management method further includes: encrypting data transmission to the terminal device based on the secure transmission configuration, wherein the secure transmission configuration includes a transmission key stored in the lidar's first secure storage space; the session key used for encrypted transmission is determined based on the transmission key and a second random number, the second random number being determined interactively by the lidar and the terminal device. This ensures the security of data transmitted from the lidar to the terminal device.

[0013] Optionally, the data also includes a sequence number to indicate the number of data packets transmitted after the lidar is activated. Adding sequence numbers and other information to the data helps prevent the risk of data replay and improves the security of data communication.

[0014] Optionally, the security configuration includes a third configuration for security verification at startup; and security verification of security events is performed based on the security configuration, including: performing startup security verification on the LiDAR's program data based on the third configuration when the LiDAR starts up; if the startup security verification fails, an anomaly occurs during startup. This ensures that the LiDAR is securely protected during use, reducing the risk of attacks on the LiDAR.

[0015] Optionally, when the lidar is started, a startup security verification is performed on the lidar program data based on a third configuration, including: decrypting the program data using a startup key, wherein a startup exception occurs when decryption fails; the third configuration includes a startup key, stored in the lidar's second secure storage space, and the program data is encrypted and stored using the startup key; or, verifying the program data using a startup public key, wherein a startup exception occurs when verification fails, the third configuration includes a startup public key, stored in the lidar's third secure storage space, and the program data is signed and stored using a startup private key.

[0016] Using a startup key for encryption and decryption operations can prevent decompilation attacks. This method is simple to implement and offers faster encryption and decryption speeds. Using a startup public key and a startup private key for encryption and decryption operations can verify the integrity and authenticity of the program data. This method offers higher security and can prevent the LiDAR program data from being tampered with or counterfeited.

[0017] Optionally, the security configuration includes a fourth configuration for secure verification of data storage; and security verification of security events is performed based on the security configuration, including: performing storage security verification of the LiDAR configuration data based on the fourth configuration; when storage security verification fails, data storage anomaly occurs. This can prevent the LiDAR from using illegal configuration data during use.

[0018] Optionally, the configuration data of the LiDAR is stored securely based on the fourth configuration, including: decrypting the configuration data using a storage key, wherein an abnormal data storage occurs when decryption fails; the fourth configuration includes a storage key stored in the fourth secure storage space of the LiDAR, and the configuration data is encrypted using the storage key; or, the configuration data is signed using a storage public key, wherein an abnormal data storage occurs when the signing fails, the fourth configuration includes a storage public key stored in the fifth secure storage space of the LiDAR, and the configuration data is signed using a storage private key.

[0019] Optionally, the security configuration includes a fifth configuration for security verification during upgrades; and security verification of security events is performed based on the security configuration, including: performing upgrade security verification on the LiDAR upgrade package based on the fifth configuration; wherein, if the upgrade security verification fails, an upgrade anomaly occurs; or, if the upgrade security verification succeeds, the application corresponding to the upgrade package is upgraded. Performing security verification on upgrades helps improve the security of the LiDAR.

[0020] Optionally, the LiDAR includes a first memory and a second memory, wherein the application's pre-upgrade program data is stored in the first memory, and the upgrade package's program data is stored in the second memory. The security management method further includes booting the application from the second memory. This allows the LiDAR to directly load and run the updated software version from the second memory during startup, reducing the update process performed during the write of the upgrade package to the first memory, thus facilitating more efficient program upgrades. This approach supports program upgrades for different applications and offers better scalability.

[0021] Optionally, security processing is performed based on the security verification result, including: when the security event includes a first event of security verification failure, obtaining abnormal data of the first event; and performing security processing based on the abnormal data.

[0022] Optionally, security processing can be performed based on the abnormal data, including: logging the data. The log includes abnormal data from the first event, which may include one or more of the following: the LiDAR version number at the time of the anomaly, the time of the anomaly, the anomaly event identifier, or the anomaly level. This can help locate the anomaly and provide richer information input, reduce the time spent tracing back historical data, and allow for different levels of security management for different levels of events.

[0023] Optionally, a security event may include multiple events and be logged, including one or more log entries based on the anomaly level of the multiple events or the time of the anomaly occurrence.

[0024] Optionally, a security event includes multiple events, each corresponding to a different storage space. The logging process includes recording abnormal data from the first event in the first storage space, which is the storage space among the multiple storage spaces corresponding to the first event. By reading data from multiple storage spaces, it is possible to determine at once whether multiple security events have occurred abnormally, thus comprehensively assessing the security status of the LiDAR.

[0025] Optionally, based on the abnormal data, security processing is performed, including: sending security information, which includes alarm indications or some or all of the abnormal data in the logs, wherein the alarm indications are used to indicate that there is a security anomaly with the LiDAR. This allows users or remote maintainers to promptly identify the security anomaly with the LiDAR and perform timely remote maintenance or return-to-factory maintenance; alternatively, the terminal device can promptly identify the security anomaly with the LiDAR, disregard the LiDAR's sensing data, or shut down the LiDAR, thereby improving the operational security of the terminal device.

[0026] Optionally, security information can be sent, including sending security information when the anomaly level of the first event is a preset anomaly level. This allows for timely handling of high-level anomaly events, achieving timely response to security incidents while saving external resources.

[0027] Secondly, this disclosure provides a security management device for LiDAR. The security management device includes: a storage unit configured to store a security configuration for security verification of security events of the LiDAR, the security events including one or more of the following events: inter-board authentication, communication, startup, data storage, or upgrade; a security verification unit configured to perform security verification of the security events based on the security configuration; and a processing unit configured to perform security processing based on the results of the security verification.

[0028] Thirdly, this disclosure provides a security management device for lidar, the security management device comprising: a storage circuit for storing a security configuration, the security configuration being used for security verification of security events of the lidar, the security events including one or more of the following events: inter-board authentication, communication, startup, data storage, or upgrade; and a processing circuit for executing a security management method as described above.

[0029] Optionally, the security management device further includes a debugging interface, wherein the debugging interface is disabled.

[0030] This can prevent attackers from using external tools to attack the lidar, thus improving the lidar's security.

[0031] Fourthly, this disclosure provides a lidar that includes the security management devices provided in the second and third aspects above.

[0032] Fifthly, this disclosure provides a terminal device, including: the lidar provided in the fourth aspect above.

[0033] In a sixth aspect, this disclosure provides a computer program product including instructions that, when executed by a processor, execute the security management method provided in the first aspect above.

[0034] In a seventh aspect, this disclosure provides a computer storage medium having instructions stored thereon, wherein when the instructions are invoked by a processor, the security management method provided in the first aspect above is executed. Attached Figure Description

[0035] The accompanying drawings used in the description of the embodiments of this disclosure will be briefly introduced below.

[0036] Figure 1 shows an example structural block diagram of a lidar consistent with some embodiments of this disclosure.

[0037] Figure 2 shows an example architecture diagram of a security management system consistent with some embodiments of this disclosure;

[0038] Figure 3 shows an example flowchart of a security management method consistent with some embodiments of this disclosure;

[0039] Figure 4 shows an example flowchart of a security management method consistent with some embodiments of this disclosure;

[0040] Figure 5 shows an example diagram of a method for inter-board security verification consistent with some embodiments of this disclosure;

[0041] Figure 6 shows an example diagram of another factory setup process for inter-board security verification that is consistent with some embodiments of this disclosure;

[0042] Figure 7 shows an example diagram of another method for inter-board security verification consistent with some embodiments of this disclosure;

[0043] Figure 8 shows an example flowchart of another security management method consistent with some embodiments of this disclosure;

[0044] Figure 9 shows an example signaling flowchart for encrypted data transmission consistent with some embodiments of this disclosure;

[0045] Figure 10 shows an example flowchart of a lidar upgrade process consistent with some embodiments of this disclosure;

[0046] Figure 11 shows an example flowchart of another security management method consistent with some embodiments of this disclosure;

[0047] Figure 12 shows an example block diagram of a security management device consistent with some embodiments of this disclosure;

[0048] Figure 13 shows an example block diagram of another security management device consistent with some embodiments of this disclosure;

[0049] Figure 14 shows an example block diagram of a debugging interface for a lidar consistent with some embodiments of this disclosure;

[0050] Figure 15 shows an example block diagram of a debugging interface for another lidar that is consistent with some embodiments of this disclosure. Detailed Implementation

[0051] The specific embodiments of this disclosure will now be described in conjunction with the accompanying drawings. The drawings described below are only some embodiments of this disclosure. For those skilled in the art, other drawings and other embodiments can be obtained based on these drawings without creative effort. Any adjustments and improvements made without departing from the concept of this disclosure are within the protection scope of this disclosure.

[0052] To keep the drawings simple, only the parts related to the corresponding embodiments are shown schematically in each figure, and they do not represent the actual structure of the product. In addition, to make the drawings simple and easy to understand, some parts with the same structure or function are only shown schematically in some figures, and there may actually be more or fewer parts with the same structure or function.

[0053] LiDAR (Lidar) uses laser light as a medium for object detection. During object detection, the lidar emits a laser beam. When the laser encounters an object, it is reflected from the object's surface, and a portion of the reflected light (called the echo) is received by the lidar and converted into an electrical signal. The lidar then processes this electrical signal to determine information about the object, such as its distance, position, or velocity, and generates point cloud data.

[0054] Please refer to Figure 1, which shows an example structural block diagram of a lidar consistent with some embodiments of this disclosure. As shown in Figure 1, the lidar 100 includes a laser emitting system 110, a laser receiving system 120, and a control and processing system 130. Optionally, the lidar 100 also includes a scanning system 140. For example, a mechanical lidar or a semi-solid-state lidar may also include a scanning system 140. The scanning system 140 may include a rotating optical engine, a unidirectional rotating polygonal mirror, a reciprocating oscillating mirror or galvanometer, or other components that can direct the laser beam to different directions in the environment.

[0055] The laser emitting system 110 emits a laser beam. Upon encountering object 10, the laser beam is reflected from the surface of object 10 to the lidar 100. The laser receiving system 120 receives the reflected echo and converts it into an electrical signal. This electrical signal is pre-processed to determine the echo data, which is then provided to the control and processing system 130. The control and processing system 130 processes the echo data to determine information about object 10, such as its distance, position, or velocity; and also generates point cloud data.

[0056] The laser emitting system 110 may include an excitation source (e.g., a driving circuit), a laser, and emitting optical elements. The laser emits laser light under the drive of the excitation source, and the laser light exits through the emitting optical elements. The laser receiving system 120 may include receiving optical elements and a detector. The receiving optical elements collect the echo reflected from an object and focus it onto the photosensitive surface of the detector. The detector uses the photoelectric effect to convert the optical signal into an electrical signal. The lidar 100 may also include a preprocessing circuit. This preprocessing circuit may, for example, include a digitization circuit, such as an analog-to-digital converter (ADC), to convert analog signals into digital signals for supply to the control and processing system 130. Alternatively, the preprocessing circuit may include a time-to-digital converter (TDC). When the control and processing system 130 controls the laser to emit laser light through the driving circuit, it can synchronously send a signal to the TDC to start timing. Subsequently, the echo is converted into an electrical signal by the detector, and this electrical signal can be converted (e.g., converted and amplified into a voltage and compared with a reference voltage to determine whether light is incident) and supplied to the TDC. Based on the received electrical signal, the TDC can time the echo arrival time and provide the time information to the control and processing system 130. This preprocessing circuit may also include analog front-end circuitry for channel selection and analog signal amplification. The transmitting and receiving optical elements include, for example, one or more optical elements such as lenses, lens groups, mirrors, filters, beam splitters, and apertures. The transmitting and receiving optical elements can be independently configured, or one of them can be wholly or partially multiplexed with the other.

[0057] The control and processing system 130 may include an information processing circuit and a light source control circuit. The information processing circuit processes electrical signals to determine information about the object. This information processing circuit may include, for example, an application-specific integrated circuit (ASIC) or a hardware circuit implemented using a programmable logic device (PLD). Examples include a field-programmable gate array (FPGA), a microcontroller unit (MCU), or a digital signal processor (DSP); this improves the efficiency of information processing. Alternatively, the information processing circuit may include a central processing unit (CPU). The light source control circuit sends control commands (or signals) to the excitation source to control the excitation source to drive the laser to emit light, achieving pulsed laser emission. For example, timing signals can be sent to control the laser emission timing. Furthermore, by configuring one or more of the pulse interval, pulse intensity, and pulse width, pulse coding functionality can be added to enhance the anti-interference capability of the lidar. The light source control circuit and the information processing circuit can be integrated together, for example, integrated into a main control chip, or they can each be independent or partially independent chips. When the lidar 100 includes a scanning system 140, the control and processing system 130 can also include a scanning control circuit for controlling the scanning system. The scanning control circuit can be integrated with one or all of the light source control circuit and the information processing circuit; for example, the scanning control circuit, the light source control circuit, and the information processing circuit can be integrated into a main control chip; or they can each be independent or partially independent chips. This disclosure does not impose limitations on the embodiments. In one implementation, the control and processing system 130 can be implemented as a system-on-chip (SOC) or an application-specific integrated circuit (ASIC).

[0058] In applications, lidar can be installed on terminal devices to transmit the detected sensing data. The terminal devices then use this data to perform one or more functions, such as analysis, decision-making, or control. Terminal devices include, for example, vehicles, ships, aircraft (e.g., flying vehicles or drones), and robots (e.g., industrial robots or home robots).

[0059] Taking LiDAR installed in vehicles as an example, it is used in the field of intelligent driving to provide perception data input for intelligent driving systems. Security attacks on LiDAR could cause vehicle safety accidents.

[0060] To improve the security of lidar, this disclosure provides a security management method and apparatus, as well as a lidar, etc. The security management method is used for lidar, which has a security configuration for security verification of security events. These security events include one or more of the following: inter-board authentication, communication, startup, data storage, or upgrade. The security management method includes: performing security verification of security events based on the security configuration; and performing security processing based on the results of the security verification. By using security configuration at the security event level in the lidar, external attacks can be monitored and defended against, improving the lidar's security performance and giving it better defense capabilities against attacks.

[0061] The following description is in conjunction with the accompanying drawings.

[0062] Please refer to Figure 2, which illustrates an example architecture diagram of a security management system consistent with some embodiments of this disclosure. As shown in Figure 2, the security management system 200 is used for LiDAR and monitors events related to the LiDAR, which can be referred to as security events, including one or more of the following events: inter-board authentication, communication, startup, data storage, or upgrade. When the security management system 200 detects an anomaly, it centrally manages the anomaly. The security management system 200 may include a security management unit 210 and a monitoring unit 220. For the above one or more security events, the LiDAR has a security configuration, and the monitoring unit 220 performs security verification based on the security configuration at the event granularity. For example, the security configuration includes one or more of the following configurations: a first configuration, a second configuration, a third configuration, a fourth configuration, or a fifth configuration, wherein the first configuration is used for security verification of inter-board authentication; the second configuration is used for security verification of communication; the third configuration is used for security verification of startup; the fourth configuration is used for security verification of data storage; and the fifth configuration is used for security verification of upgrades. The security management unit 210 performs security processing based on the results of the security verification. Security processing includes, but is not limited to, one or more of the following processing: logging, or external transmission of security information, etc.

[0063] In some embodiments of this disclosure, security events may include multiple events, and monitoring unit 220 may include a collection of monitoring subunits for multiple events. Multiple monitoring subunits can be configured or implemented independently. The monitoring unit 220 in Figure 2 is merely a schematic representation of a logical function and may include multiple independently implemented monitoring subunits. For example, for startup, monitoring unit 220 may include a secure startup subunit. For upgrades, monitoring unit 220 may include a secure upgrade subunit. For communication, monitoring unit 220 may include a secure communication subunit. For data storage, monitoring unit 220 may include a secure data storage subunit. For inter-board authentication, monitoring unit 220 may include an inter-board security subunit. For a specific event of the LiDAR, the security management system 200 can configure it independently to monitor that event if it wants to be configured as a security event. The monitoring data for that event can be reported to the security management unit 210. This facilitates flexible expansion or reconfiguration of security events. The LiDAR security management system of this disclosure has low complexity and is conducive to flexible expansion or reconfiguration. For example, security events can be further expanded to further improve LiDAR security. For example, resetting or reconfiguring security events can make the LiDAR security suitable for different scenarios.

[0064] In some embodiments of this disclosure, the monitoring data reported by the monitoring unit 220 may include, for example, abnormal data. For instance, please refer to FIG3, which shows an example flowchart of a security management method consistent with some embodiments of this disclosure. As shown in FIG3, the monitoring unit 220 monitors event status at the event level. When an abnormal event is detected (for distinction, the abnormal event is referred to as the first event, and the first event may include one or more), the abnormal data of the first event is latched and sent to the security management unit 210. The security management unit 210 performs security processing based on the abnormal data, including, but not limited to, one or more of the following: logging, or sending out security information. The log may include abnormal data, which may include, or include, one or more of the following: the version number of the LiDAR when the abnormality occurred, the time of the abnormality, the abnormal event identifier, or the abnormality level. Security information may include, for example, alarm indications or some or all of the abnormal data in the log, wherein the alarm indications are used to indicate that there is a security abnormality in the LiDAR.

[0065] In some embodiments of this disclosure, the monitoring data reported by the monitoring unit 220 includes, for example, event data. Event data includes, for example, abnormal data for abnormal events (e.g., verification failure events) and data for normal events (e.g., verification success events). Abnormal data for abnormal events may include one or more of the following: anomaly identifier, the version number of the LiDAR when the anomaly occurred, the time of the anomaly, an anomaly event identifier, or anomaly level. Data for normal events may include one or more of the following: normal identifier, the version number of the LiDAR, the time of the security event or the verification time, a security event identifier, or a security event level, etc. An anomaly identifier is used to identify that the data for that event corresponds to an abnormal event; a normal identifier is used to identify that the data for that event corresponds to a normal event.

[0066] The above unit division is only a logical functional division. In actual implementation, all or part of it can be integrated into a single physical entity, or they can be physically separated. Units (e.g., sub-units of a security management unit or monitoring unit) can be implemented by a processor calling software. The processor includes, for example, a general-purpose processor, such as a CPU, and the memory can be integrated with the processor or implemented independently. Alternatively, units (e.g., sub-units of a security management unit or monitoring unit) can be implemented as hardware circuits. For example, the function of the unit is implemented through the design of a hardware circuit. In some embodiments, the hardware circuit includes an application-specific integrated circuit (ASIC), and the function of the unit is implemented by designing the logical relationships between the components within the circuit. In some embodiments, the hardware circuit can be implemented using a programmable logic device (PLD). For example, the hardware circuit may include a large number of logic gates, and the logical relationships between the logic gates are configured through a configuration file to achieve the function of the unit. The units of the above security management system can be implemented entirely by a processor calling program, entirely by hardware circuits, or partially by a processor calling program with the remaining portion implemented by hardware circuits.

[0067] A processor is a circuit with signal processing capabilities. For example, a processor includes circuits capable of instruction fetching and execution, such as a CPU, microprocessor, graphics processing unit (GPU), or digital signal processor (DSP). Alternatively, a processor can be implemented through the logical relationships of hardware circuits, which can be fixed or reconfigurable. For instance, a processor may include hardware circuits implemented using ASICs or PLDs, such as those implemented using field-programmable gate arrays (FPGAs). In reconfigurable hardware circuits, the process of the processor loading a configuration document and configuring the hardware circuit can be understood as the processor loading instructions to implement the functions of the corresponding units. Furthermore, a processor may include hardware circuits designed for artificial intelligence, such as, but not limited to, one or more of the following: neural network processing unit (NPU), tensor processing unit (TPU), or deep learning processing unit (DPU).

[0068] In some embodiments of this disclosure, the security management system 200 further includes a defense unit. This defense unit can also be configured at the event level, such as by trimming the functionality of interfaces or the operating system, thereby enhancing security through defensive measures. For example, regarding interface access, some interfaces can be disabled to prevent rewriting of the LiDAR data and improve security. Similarly, regarding the operating system, disabling one or more unused services and ports during software design can prevent attackers from exploiting known vulnerabilities in the operating system to launch cybersecurity attacks on the LiDAR, such as stealing software design, firmware design, and security configurations.

[0069] The above-described security management system can operate with processing circuitry and storage circuitry as hardware. The processing circuitry may include one or more processors, and the storage circuitry may include one or more memories. The processing circuitry or storage circuitry may be part of the control and processing system 130 or independent of the control and processing system 130.

[0070] Monitoring event status at the event level can be achieved by configuring events securely and then performing security verification on the events based on these configurations. This allows for flexible expansion or reconfiguration of security events, and the complexity of this LiDAR security management approach is relatively low, balancing flexibility and cost reduction in LiDAR security management.

[0071] This disclosure also provides a security management method. Please refer to Figure 4, which shows an example flowchart of a security management method consistent with some embodiments of this disclosure. As shown in Figure 4, this security management method is used for a lidar system, which has a security configuration for security verification of security events related to the lidar. This security management method can be executed by at least one processor of the lidar and includes at least the following steps.

[0072] S410: Perform security verification on security events based on security configuration.

[0073] S420: Perform security processing based on the results of security verification.

[0074] When the lidar is started or running, security verification is performed on security events occurring within the lidar based on the security configuration; security processing is then carried out according to the results of the security verification. This allows the lidar to achieve event-granular security verification during the event execution phase, improving the security of lidar use.

[0075] The following describes the security verification process for different security incidents.

[0076] In some embodiments of this disclosure, the security configuration includes a first configuration for security verification of inter-board authentication. Step S410 further includes: performing inter-board security verification on the first and second circuit boards of the LiDAR based on the first configuration, wherein an inter-board authentication anomaly occurs when the inter-board security verification fails.

[0077] Inter-board certification refers to the testing and certification process for the interconnection, communication, or compatibility between different circuit boards or electronic modules. Its purpose is to ensure that different boards or subsystems can stably and reliably meet design specifications or industry standards when working together. A LiDAR system may include multiple circuit boards. If it is maliciously attacked during use, such as by replacing one of the circuit boards, the boards can still work together, but the quality of the output sensing data (e.g., point cloud data) may degrade or even become erroneous, potentially leading to safety incidents. Inter-board certification, through security verification, can identify unverified circuit boards, ensuring certification before boards collaborate, thus improving the security of the LiDAR system.

[0078] The following description uses the first and second circuit boards as examples, without limiting the number of circuit boards in the lidar system. The lidar system may include two or more circuit boards, such as the circuit boards in the photoelectric detection module and the circuit boards in the rotating support platform of a mechanical lidar system. This example can be used as a reference when performing inter-board authentication between any two circuit boards. This disclosure does not limit the number of circuit boards used for inter-board authentication in the lidar system. The determination of which circuit boards perform inter-board authentication can be based on the impact of the data stored on the circuit boards on the lidar's security or the inter-board cooperation relationship.

[0079] In some embodiments of this disclosure, inter-board security verification can be performed using the identification of a circuit board, which is the board to be certified. Taking a first circuit board as the board to be certified and a second circuit board as the board performing the certification as an example, a first configuration may include a first identifier for identifying the first circuit board, and this identifier is stored in both the first and second circuit boards before the LiDAR leaves the factory. The LiDAR or security management system 200 performs inter-board security verification between the first and second circuit boards of the LiDAR based on the first configuration, including: verifying the first circuit board on the second circuit board based on an encryption result (referred to as a first encryption result for distinction), a random number (referred to as a first random number for distinction), and the first identifier stored in the second circuit board. The first encryption result is determined on the first circuit board based on the first identifier and the first random number stored in the first circuit board. The first random number may be sent from the second circuit board to the first circuit board; or, the first random number includes a random number generated by the first circuit board and a random number generated by the second circuit board, and the first and second circuit boards exchange their respective generated random numbers with each other.

[0080] For example, please refer to Figure 5, which illustrates an example diagram of a method for inter-board security verification consistent with some embodiments of this disclosure. As shown in Figure 5, the lidar includes a first circuit board 510 and a second circuit board 520. Taking the second circuit board 520 as a trusted circuit board, the security verification of the first circuit board 510 by the second circuit board 520 is taken as an example. The identifier of the first circuit board 510 is written into the storage space of the first circuit board 510 and the second circuit board 520 at the factory end, wherein the identifier stored in the first circuit board 510 is identifier A, and the identifier stored in the second circuit board 520 is identifier A'. The first circuit board 510 performs encryption processing using a random number and identifier A to determine the encryption result H1; this encryption processing is, for example, a hash processing, and the encryption result H1 includes, for example, a hash value. The second circuit board 520 performs encryption processing using a random number and identifier A' to determine the encryption result H2; this encryption processing is, for example, a hash processing, and the encryption result H2 includes, for example, a hash value. The second circuit board 520 compares the encrypted result H1 and the encrypted result H2; if the encrypted result H1 and the encrypted result H2 are the same, the security verification is successful; if the encrypted result H1 and the encrypted result H2 are different, the security verification fails. The encrypted result is also called a digest or digest value. A random number can be sent from the second circuit board 520 to the first circuit board 510, for example.

[0081] In some embodiments of this disclosure, security verification can be performed using the identification and authentication data of the circuit board. Authentication data is stored in the circuit board being authenticated. Taking a first circuit board as the circuit board being authenticated and a second circuit board as the circuit board performing authentication as an example, the first configuration may include a public key (referred to as the authentication public key for distinction) stored in the second circuit board, and a signature (referred to as the authentication signature for distinction), authentication data, and a first identifier stored in the first circuit board. The LiDAR or security management system 200 performs inter-board security verification between the first and second circuit boards of the LiDAR based on the first configuration, including: authenticating the first circuit board on the second circuit board based on an encryption result (referred to as the second encryption result for distinction), the first public key, and the authentication signature. The second encryption result is determined on the first circuit board based on the authentication data and the first identifier, whereby the first identifier is used to identify the first circuit board.

[0082] For example, referring to Figures 6 and 7, Figure 6 shows an example diagram of a factory-side setup process for another inter-board security verification consistent with some embodiments of this disclosure; Figure 7 shows an example diagram of another inter-board security verification method consistent with some embodiments of this disclosure. The lidar includes a first circuit board 610 and a second circuit board 620. Taking the second circuit board 620 as a trusted circuit board, and the second circuit board 620 performing security verification on the first circuit board 610 as an example. As shown in Figure 6, at the factory side, the authentication data of the first circuit board 610 is signed and written into the storage space M1 of the first circuit board 610; and the identifier A of the first circuit board is written into the storage space M2 of the first circuit board. During the signing process, the authentication data and the identifier A of the first circuit board can be encrypted to determine the encryption result H11; then, the encryption result H11 is encrypted using the private key K1 to determine the signature S, and the signature S and the authentication data are jointly stored in the storage space M1 of the first circuit board 610.

[0083] As shown in Figure 7, during the use of the lidar, the second circuit board 620 can perform security verification on the first circuit board 610. The first circuit board 610 uses authentication data and identifier A for encryption processing to determine the encryption result H12. This encryption processing is, for example, hash processing, and the encryption result includes, for example, a hash value. The first circuit board 610 sends the stored signature S to the second circuit board 620, and also sends the encryption result H12 to the second circuit board 620. The second circuit board 620 uses the stored public key K2 to decrypt the signature S, determining the decryption result H13. Since the encryption processing of the encryption result H11 was, for example, hash processing, and the encryption result includes, for example, a hash value, the decryption result also includes a hash value. The second circuit board 620 compares the decryption result H13 with the encryption result H12; if the decryption result H13 and the encryption result H12 are consistent, the security verification is successful; if the decryption result H13 and the encryption result H12 are inconsistent, the security verification fails. The encryption result is also, for example, called a digest or digest value; the decryption result is also, for example, called a digest or digest value.

[0084] The introduction of authentication data can further enhance the security of inter-board authentication, making it more difficult for malicious attacks to be carried out; or, during the security verification process, unauthorized circuit boards can be identified, further improving the security of LiDAR.

[0085] In some embodiments of this disclosure, the authentication data may include data set for inter-board authentication. Alternatively, in some embodiments of this disclosure, the authentication data may include LiDAR configuration data; this allows for the reuse of LiDAR data resources for inter-board authentication, saving storage space and data resources. Optionally, the configuration data may be used for secure configuration and security verification during data storage events. Therefore, inter-board authentication and data storage can be combined for secure configuration, reducing data resources and storage space required for secure configuration. The configuration data may include, for example, one or more of factory configuration data or user configuration data.

[0086] The above description uses the example of the second circuit board being the trusted circuit board and the first circuit board being the circuit board to be authenticated. In other embodiments, the first circuit board can be the trusted circuit board and the second circuit board can be the circuit board to be authenticated. Alternatively, the first circuit board and the second circuit board can perform mutual authentication, using the identifier of the second circuit board when authenticating it, with an implementation similar to the above description. This disclosure does not limit the algorithm for obtaining the encryption result, nor does it limit the algorithm for obtaining the decryption result; for example, it may include hash operations.

[0087] The trusted circuit board can be selected as a circuit board with lidar control functions, such as a circuit board including information processing circuitry. In some embodiments of this disclosure, the lidar scanning system achieves laser scanning by rotating 360 degrees; the lidar includes, for example, a rotor, and the circuit board to be authenticated is fixed relative to the rotor, for example, it may be referred to as the upper plate; the trusted circuit board is fixed relative to the stator, for example, it may be referred to as the lower plate.

[0088] In some embodiments of this disclosure, the security configuration includes a second configuration for secure verification of communication. Step S410 further includes: performing communication security verification between the LiDAR and the terminal device based on the second configuration, wherein a communication anomaly occurs when the communication security verification fails. When the communication security verification is successful, data is transmitted to the terminal device.

[0089] This communication refers, for example, to communication between the lidar and external devices, such as the terminal device that carries the lidar. Communication can expose the lidar to external attacks; therefore, performing security verification during communication can improve the lidar's communication security.

[0090] Communication security authentication is used, for example, for identity verification to establish a secure communication connection. Both communicating parties can provide their respective digital certificates for mutual verification. The LiDAR performs communication security authentication based on a second configuration, which can reduce the risks posed by unauthorized access or connection to the LiDAR. This second configuration may include, for example, a Transport Layer Security (TLS) protocol configuration or a Secure Sockets Layer (SSL) protocol configuration. Taking TLS as an example, it may include one or more of the following: TLS version information, cipher suites, random number generation configuration, or a digital certificate. The server also sends the digital certificate to the client for authentication. If the handshake fails when the LiDAR and the terminal device establish a communication connection based on the TLS or SSL protocol configuration, the communication security authentication will also fail.

[0091] The second configuration can be set according to the communication protocol followed during LiDAR communication. Communication protocols include, but are not limited to, one or more of Hypertext Transfer Protocol (HTTP), Transmission Control Protocol (TCP), or User Datagram Protocol (UDP). For HTTP or TCP, the TLS protocol is configured for authentication between the communicating parties (LiDAR and the terminal device). Optionally, the LiDAR can receive a digital certificate from the terminal device and verify it. For example, digital certificate authenticity verification: decrypt the digital signature using the public key in the digital certificate to determine the digest; encrypt the certificate content using the encryption algorithm (e.g., hash algorithm) within the digital certificate to determine the digest; compare the two digests; if they match, the digital certificate is authentic; if they differ, the digital certificate is not authentic. Another example is digital certificate validity verification: determine if the certificate is on an invalidation list; if it is, the digital certificate is invalid.

[0092] Communication security authentication is also used, for example, for user authentication to achieve secure user access and prevent unauthorized access. For instance, for HTTP, a username and password can be used to authenticate a user. If the username or password is incorrect, the communication security authentication fails.

[0093] During communication between lidar and terminal equipment, the transmitted data can be configured securely to enhance data security. For example, for UDP, message authentication codes (MACs) can be used to protect the integrity and authenticity of the transmitted data.

[0094] In some embodiments of this disclosure, the lidar also has a secure transmission configuration for secure communication transmission, thereby protecting the security of data transmitted by the lidar to the terminal device. Please refer to Figure 8, which shows an example flowchart of another security management method consistent with some embodiments of this disclosure. As shown in Figure 8, this security management method includes the following steps.

[0095] S810: Performs communication security verification between the lidar and the terminal device based on the second configuration.

[0096] S820: When communication security authentication is successful, data is encrypted and transmitted to the terminal device based on the secure transmission configuration.

[0097] When communication security authentication fails, an anomaly occurs, allowing for security handling. When communication security authentication succeeds, data can be encrypted and transmitted to the terminal device using the methods described above. The session key for encrypted transmission can be generated based on a master key and a salt value. For example, the shared key between the terminal device and the LiDAR can be used as the master key, and a random number generated through interaction between the two parties can be used as the salt value.

[0098] In some embodiments of this disclosure, data can be encrypted and transmitted using a session key determined during the TLS handshake process. This TLS handshake process includes, for example, the following: a communicating client initiates a TLS handshake with a server by sending a client hello message, which includes, for example, TLS version information, a cipher suite, and a client random number. The server sends a server hello message to the client. This server hello message is a response to the client hello message. This server hello message includes, for example, TLS version information, a cipher suite selected by the server, or a server random number. The server also sends a digital certificate to the client for authentication. The client uses a random number generator to generate a pre-master key to establish a shared key between the client and the server, and derives a session key from the shared key. The client encrypts the pre-master key using its public key and sends it to the server. The server decrypts the pre-master key using its private key to obtain the pre-master key. The server and client generate a session key based on the client random number, the server random number, and the pre-master key. The client and server send a message to each other indicating that the handshake process is complete. The client may include, for example, a terminal device, and the server may include, for example, a LiDAR; or, the client may include, for example, a LiDAR, and the server may include, for example, a terminal device.

[0099] In some embodiments of this disclosure, the shared key can be pre-stored in a secure storage space within the lidar. For example, the security management system can also securely transmit configurations, in which case, in step S830, data can be further encrypted and transmitted to the terminal device based on the secure transmission configuration. The secure transmission configuration includes a key (referred to as the transmission key for distinction) stored in the lidar's secure storage space (referred to as the first secure storage space for distinction); the session key used for encrypted transmission is determined based on the transmission key and a random number (referred to as the second random number for distinction), the second random number being determined interactively by the lidar and the terminal device.

[0100] Please refer to Figure 9, which illustrates an example signaling flowchart for encrypted data transmission consistent with some embodiments of this disclosure. As shown in Figure 9, the determination of the second random number can refer to the TLS handshake process described above, including the terminal device sending its random number to the LiDAR, and the LiDAR sending its random number to the terminal device. Optionally, this random number exchange process can be encrypted using the session key generated during the TLS protocol setup. This allows for flexible resetting of the session key during LiDAR communication. The terminal device can determine the session key based on its random number, the LiDAR's random number, and the transmission key. Similarly, the LiDAR can determine the session key based on the terminal device's random number, the LiDAR's random number, and the transmission key. The transmission key, for example, is a shared key that can be shared by the terminal device and the LiDAR.

[0101] During the data transmission process from a LiDAR to a terminal device, it may be vulnerable to cyberattacks. For example, while the LiDAR is operating, an attacker could illegally obtain (e.g., listen to and save) point cloud data for a period of time and send this data to the terminal device to perform a replay attack. The terminal device might mistakenly believe that the received point cloud data is the real-time sensing data of the LiDAR, leading to incorrect decisions. For instance, a vehicle might make a misjudgment based on incorrect sensing data, resulting in driving risks. Using the encrypted transmission method described above, a new session key is generated after the LiDAR starts up. The session key for data illegally obtained during the LiDAR's previous operation will differ from the terminal device's session key. The terminal device can identify the attack data based on the session key, reducing the impact on its functional security. Alternatively, after the LiDAR and terminal device establish a communication connection, a new session key can be generated based on a newly exchanged random number and transmission key. The session key for previously eavesdropped data will also differ from the terminal device's session key. The terminal device can identify the attack data based on this session key, further reducing the impact on its functional security.

[0102] In some embodiments of the present disclosure, information such as sequence numbers can also be added to the data to prevent the risk of data replay. For example, the data transmitted by the lidar includes a sequence number, which is used to indicate the number of data packets transmitted after the lidar is started. For example, the initial value of the sequence number is 0, and each time the lidar sends a data packet, the value of the sequence number is incremented by 1. In this way, the terminal device can determine whether the received data is valid based on the sequence number in the data. For example, if the sequence number of the data received last time is N1, and the sequence number of the data received this time is N2, and N2 < N1, the terminal device can determine that the data may be at risk and discard it or report it. The present disclosure does not limit the size of the initial value of the sequence number. For example, it can also be set to other values, such as 1, 2, or other values such as 3. Or, it can be set to the maximum value that can be expressed by the number of bits occupied by the sequence number. The terminal device determines that the data may have a replay risk when the sequence number of the received data packet becomes larger by comparing the sequence numbers of the received data packets. The number of bits occupied by the sequence number can be set according to the number of data packets that may be transmitted within the time of one operation of the lidar. For example, it can be set to 24bit - 64bit. When the number of bits is small, when the sequence number value is about to reverse, an indication message can be sent to indicate to the terminal device or the user of the terminal device to restart the lidar; or the lidar can be automatically restarted. In this way, the lidar can re - establish a secure communication connection with the terminal device and negotiate a new session key, further reducing the risk of data replay.

[0103] In some embodiments of the present disclosure, the security configuration includes a third configuration for startup security verification. Step S410 further includes: performing startup security verification on the program data of the lidar based on the third configuration when the lidar is started. When the startup security verification fails, an abnormality occurs in the startup.

[0104] The program includes, for example, one or more of software programs or firmware programs. The program also includes, for example, one or more of the programs initially burned into the lidar and the programs written after an upgrade. The program is used to implement one or more functions of the lidar, such as including but not limited to implementing the processing of echo data, generating point cloud data, implementing communication with the terminal device, implementing light emission control, implementing scanning control, or implementing detector gating control, etc. The present disclosure does not limit the content of the program. As the type, model, function, etc. of the lidar change, the content of the program can be different.

[0105] By setting up security verification during the LiDAR startup process, the internal program of the LiDAR can be prevented from being tampered with, counterfeited, or decompiled. As a sensing device for terminal equipment, LiDAR can be installed in the external space of the terminal equipment. Taking a vehicle as an example, the LiDAR can be installed on the vehicle roof (e.g., the front, rear, or other roof locations), near the headlights, hidden inside the headlights, on both sides of the vehicle, on the front bumper, inside the grille, above the windshield, above the rear window, on the side fenders, on the front wheel arches, on the hood, on the trunk lid, or under the trunk. Therefore, when the vehicle is parked, the LiDAR may be attacked. For example, an attacker could disassemble the LiDAR and tamper with or counterfeit its program, causing the LiDAR to generate incorrect perception data during use, creating a security risk. Another example is an attacker could disassemble the LiDAR and decompile it to steal its critical data. By configuring secure startup for the LiDAR, the LiDAR can be protected during startup, reducing the risk of attacks.

[0106] The program data is securely stored in the lidar and can employ one or more methods, such as symmetric encryption or asymmetric encryption. In some embodiments of this disclosure, symmetric encryption is used to encrypt and store the program data, for example, by using a key (referred to as a startup key for distinction). The third configuration includes the startup key, which is stored in the lidar's secure storage space (referred to as the second secure storage space for distinction). When the lidar starts up, the lidar or security management system 200 performs startup security verification on the lidar's program data based on the third configuration, including decrypting the program data using the startup key, and if decryption fails, a startup anomaly occurs.

[0107] In some embodiments of this disclosure, asymmetric encryption is used to securely store program data, including, for example, signing and storing the program data using a startup private key. The third configuration includes a startup public key, stored in the secure storage space of the LiDAR (referred to as the third secure storage space for distinction). When the LiDAR starts up, the LiDAR or the security management system 200 performs startup security verification on the LiDAR's program data based on the third configuration, including: verifying the signature of the program data using the startup public key, and if the signature verification fails, a startup anomaly occurs.

[0108] Optionally, secure storage of program data can include both of the above secure storage methods. For example, one encryption method or two encryption methods can be used for a specific piece of program data. Furthermore, the same or different encryption methods can be used for different pieces of program data.

[0109] For example, the program data can be encrypted and written to the lidar's storage space before it leaves the factory. Alternatively, the program data can be obtained through an upgrade after the lidar leaves the factory, encrypted, and written to the lidar's storage space. When the lidar starts up, the program data is decrypted using a startup key. If decryption fails, the startup security verification fails. This symmetric encryption method can prevent decompilation attacks, is simple to implement, and has faster encryption and decryption speeds.

[0110] For example, before the LiDAR leaves the factory, the program data is encrypted to determine a digest, and the digest is then encrypted again using the startup private key to determine a signature. This signature is written to the LiDAR's storage space along with the program data. Alternatively, after the LiDAR leaves the factory, program data is obtained through an upgrade. The program data is then encrypted to determine a digest, and the digest is encrypted again using the private key to determine a signature. This signature is written to the LiDAR's storage space along with the program data. When the LiDAR starts up, the program data is verified using the startup public key based on the signature. For example, the signature is decrypted using the startup public key to determine a first digest of the program data, and the program data is then encrypted to determine a second digest. Verification is achieved by comparing the first and second digests. Encryption processing may include hash operations, for example. In this asymmetric encryption method, the private key, public key, program data, and signature value are corresponding; if any one of them is changed, the signature value will be different, which can verify the integrity and authenticity of the program data. Therefore, the LiDAR has higher security and can prevent the LiDAR's program data from being tampered with or counterfeited.

[0111] During the LiDAR startup process, the startup of the LiDAR can be controlled based on the startup security verification result. For example, if the startup security verification is successful, the LiDAR can be started; if the startup security verification fails, the LiDAR can be prevented from starting or its startup can be stopped.

[0112] In some embodiments of this disclosure, the security configuration includes a fourth configuration for security verification of data storage. Step S410 further includes: the LiDAR or security management system 200 performing storage security verification on the LiDAR configuration data based on the fourth configuration; if the storage security verification fails, a data storage anomaly occurs. The configuration data includes, for example, one or more of factory configuration data or user configuration data.

[0113] The leakage of LiDAR configuration data (such as any security configuration) through an attack poses a significant security risk to the LiDAR. Therefore, security verification of the configuration data during use prevents the LiDAR from using unauthorized configuration data, thus avoiding security issues. If the storage and retrieval locations of this configuration data are on different circuit boards, inter-board authentication as described in the above embodiments can be further employed to enhance security.

[0114] Secure storage of configuration data can employ one or more methods, such as symmetric encryption or asymmetric encryption. In some embodiments of this disclosure, symmetric encryption is used to encrypt and store the configuration data, for example, by encrypting the configuration data using a key (referred to as the storage key for distinction). The fourth configuration includes the storage key, stored in the secure storage space of the LiDAR (referred to as the fourth secure storage space for distinction). Storage security verification of the LiDAR configuration data based on the fourth configuration includes decrypting the configuration data using the storage key, and if decryption fails, a data storage anomaly occurs.

[0115] In some embodiments of this disclosure, asymmetric encryption is used to securely store configuration data, including, for example, signing and storing the configuration data using a private key (referred to as the stored private key for distinction). The fourth configuration includes a stored public key, stored in the secure storage space of the LiDAR (referred to as the fifth secure storage space for distinction). Based on the fourth configuration, the storage security of the LiDAR configuration data is verified, including: verifying the signature of the configuration data using the stored public key, and if the signature verification fails, data storage anomaly occurs.

[0116] Optionally, secure storage of configuration data can include the two secure storage methods mentioned above. For example, one encryption method or two encryption methods can be used for a specific configuration data. Alternatively, the same or different encryption methods can be used for different configuration data.

[0117] In some embodiments of this disclosure, the security configuration includes a fifth configuration for security verification during upgrades. Step S410 further includes: performing upgrade security verification on the LiDAR upgrade package based on the fifth configuration; if the upgrade security verification fails, an upgrade anomaly occurs. If the upgrade security verification succeeds, the application corresponding to the upgrade package is upgraded.

[0118] During operation, LiDAR systems can be upgraded via a remote server, allowing for the modification of one or more of its programs (e.g., software or firmware). If an attacker sends an incorrect upgrade package to the LiDAR during the upgrade process, the upgraded LiDAR may malfunction or generate incorrect sensing data, thus compromising the security of the terminal device. Therefore, performing security verification on upgrades is beneficial for improving the security of LiDAR systems.

[0119] In some embodiments of this disclosure, the upgrade can be implemented based on asymmetric encryption. The upgrade package is signed by a private key (which can be referred to as the signing private key for distinction) at the LiDAR server (e.g., a remote server, which may include the server of the LiDAR manufacturer or the server of the terminal device manufacturer where the LiDAR is located) and sent to the LiDAR for upgrade. Upon receiving the upgrade package, the LiDAR verifies the integrity and authenticity of the upgrade package using a public key (which can be referred to as the signing public key for distinction) and a signature (which can be referred to as the upgrade signature for distinction). The fifth configuration includes the upgrade public key, stored in the LiDAR's secure storage space (referred to as the sixth secure storage space for distinction). Based on the fifth configuration, the upgrade package of the LiDAR is subjected to upgrade security verification, including: verifying the upgrade package using the signing public key and the upgrade signature carried in the upgrade package; if the verification fails, an upgrade anomaly occurs.

[0120] In some embodiments of this disclosure, a Message Authentication Code (MAC) can be used to verify the integrity and authenticity of the upgrade package. The upgrade package includes, for example, a first MAC value, determined based on the content of the upgrade package and a key (which, for distinction, may be referred to as the upgrade key). The LiDAR uses the upgrade key and the content of the received upgrade package to determine a second MAC value and compares it with the first MAC value in the upgrade package. If they match, the verification is successful. If they do not match, the verification fails. A fifth configuration includes an upgrade key, stored in the LiDAR's secure storage space (referred to as the seventh secure storage space for distinction). Upgrade security verification of the LiDAR's upgrade package based on the fifth configuration includes: verifying the upgrade package using the upgrade key and the MAC carried in the upgrade package, and when verification fails, an upgrade anomaly occurs.

[0121] In some embodiments of this disclosure, hardware verification can also be performed on the upgrade package to determine whether the upgrade package is compatible with the LiDAR hardware.

[0122] For example, please refer to Figure 10, which shows an example flowchart of a lidar upgrade process consistent with some embodiments of this disclosure. As shown in Figure 10, the upgrade process includes at least the following steps.

[0123] S101: Receive upgrade package.

[0124] The upgrade package is sent from the LiDAR server to the terminal device, and the terminal device then transmits the upgrade package to the LiDAR. The upgrade package may include version data, program data, etc.

[0125] S102: Perform upgrade package verification.

[0126] The process can be referred to the above description; if the upgrade package verification is successful, step S103 is executed; if the upgrade package verification fails, the upgrade fails.

[0127] S103: Perform hardware verification.

[0128] For example, the upgrade package includes version information, which is used to determine whether the LiDAR hardware supports the version of the upgrade package. If hardware verification is successful, step S104 is executed; if upgrade package verification fails, the upgrade fails.

[0129] S104: Write the upgrade package into the LiDAR's memory.

[0130] LiDAR can call the memory management component to write program data from the upgrade package into the memory, including steps such as erasing old data, programming new data, or verifying the integrity of the new data.

[0131] For example, the memory could be a flash read-only memory (flash ROM). The LiDAR uses the flash interface toolbox (FIT) to write program data.

[0132] S105: Update bootloader (bootloader or boot1).

[0133] The bootloader is the first piece of code that starts the system, executing the initial stages of system startup, including but not limited to: checking hardware status, initializing hardware resources, and loading and executing the operating system or applications. Updating the bootloader can introduce new features, fix known issues, or improve system performance.

[0134] S106: Set upgrade identifier.

[0135] By setting an upgrade flag, it can be indicated that the data packets and bootloader in the memory have been updated. Thus, when the lidar restarts, it loads the updated bootloader and program data based on this upgrade flag.

[0136] In some embodiments of this disclosure, the lidar program can be upgraded using partitioned storage, for example, storing the program data before the upgrade and the program data in the upgrade package in different storage spaces. If problems occur during the upgrade process, the program can be rolled back to the previous version, improving the stability and security of the lidar system.

[0137] In some embodiments of this disclosure, the program data before the upgrade and the program data in the upgrade package can be stored in different memories. For example, a lidar system includes a first memory and a second memory. The application's program data before the upgrade is stored in the first memory, and the processor controlling the program's execution uses the first memory as its main memory, while the second memory is the processor's external memory. When the lidar receives an upgrade package, it can store the upgrade package's program data in the second memory. When the lidar starts up, the second memory starts up, while the original area in the first memory remains inactive. During startup, the lidar directly loads and runs the updated software version in the second memory, reducing the update process performed during the upgrade package writing process in the first memory, which facilitates more efficient program upgrades. This approach can support program upgrades for different applications and has better scalability.

[0138] For example, please refer to Figure 11, which shows an example flowchart of another security management method consistent with some embodiments of this disclosure. As shown in Figure 11, the security management method includes the following steps.

[0139] S111: Receive application upgrade package.

[0140] S112: Perform security verification on the upgrade package for the LiDAR based on the fifth configuration.

[0141] S113: When the upgrade security verification is successful, the program data in the upgrade package is stored in the second memory; wherein, the application's program data before the upgrade is stored in the first memory.

[0142] S114: Start the application corresponding to the upgrade package from the second memory.

[0143] The following describes some embodiments of this disclosure that perform security processing based on the results of security verification.

[0144] In step S420, when the security event includes a first event of security verification failure, abnormal data for the first event is obtained. Based on the abnormal data, security processing is performed.

[0145] Security procedures may include, for example, one or more of the following operations: logging or sending security information. Logs may include, for example, anomalous data of the first event. This anomalous data may include one or more of the following: the LiDAR version number at the time of the anomalous event, the time of the anomalous event, the anomalous event identifier, or the anomalous level. Security information may include, for example, alarm indications or some or all of the anomalous data in the logs, wherein the alarm indications are used to indicate that a security anomaly exists in the LiDAR.

[0146] The LiDAR version number indicates the current software or firmware version of the LiDAR. During use, the software or firmware may be upgraded. Recording the LiDAR version number at the time of an anomaly helps determine the software or firmware version at the time of the anomaly, facilitating problem localization and providing richer information input. The anomaly occurrence time indicates the time the anomaly occurred, and may include, for example, timestamp data. In some embodiments of this disclosure, when recording the anomaly occurrence time, the LiDAR version number may not be recorded; instead, it can be determined from historical upgrade data. Alternatively, both the LiDAR version number and the anomaly occurrence time can be recorded, which helps in locating the anomaly, providing richer information input, and reducing the time spent tracing back historical data. The anomaly event identifier indicates the type of anomaly event, which may include one or more of the following: inter-board authentication, startup, data storage, upgrade, or communication. The anomaly level indicates the level of the anomaly event. By setting the anomaly event level, different events can be classified, facilitating different levels of security management for different event levels. This disclosure does not limit the specific settings of the levels. For example, it may include levels 1 through N, where N is a positive integer greater than 1; or levels 0 through M, where M is a positive integer greater than or equal to 1. Higher numbers represent higher levels, or vice versa. The log entries may include all or part of the above-mentioned abnormal data; it may also include data recording normal events.

[0147] In some embodiments of this disclosure, when a security event includes multiple events, logs can be recorded based on the anomaly level of the multiple events. For example, the anomaly can be classified according to its impact on the LiDAR; a higher level indicates a greater impact on the LiDAR, and a lower level indicates a smaller impact. Prioritizing the recording of anomaly data for high-level anomalies can reduce the possibility of missing data for high-priority anomalies due to external factors. For example, when multiple events are abnormal, prioritizing the recording of anomaly data for high-priority anomalies can prevent information loss due to unexpected power outages, thus avoiding security risks. Furthermore, when storage space is insufficient, priority can be given to recording anomaly data for high-priority anomalies. For example, events such as "startup," "data storage," and "communication" are classified as first-level, and "upgrade" as second-level; anomaly data for first-level anomalies is recorded first; while recording anomaly data for first-level anomalies is complete, anomaly data for second-level anomalies is recorded. Optionally, if storage space is insufficient, anomaly data for first-level anomalies can be used to overwrite anomaly data for second-level anomalies.

[0148] In some embodiments of this disclosure, when a security event includes multiple events, logs can be recorded based on the time of occurrence of the anomalies in the multiple events. Recording based on the time of occurrence is simple to implement and helps reduce complexity.

[0149] In some embodiments of this disclosure, the lidar or security management system 200 can record logs by combining anomaly level and anomaly occurrence time. For example, anomaly data of anomaly events can be recorded according to the anomaly occurrence time. When a high-level anomaly event occurs, the anomaly data of a low-level anomaly event can be overwritten, for example, when storage space is insufficient. Alternatively, when anomalies have the same level, anomaly data of the anomaly events can be recorded according to the anomaly occurrence time.

[0150] In some embodiments of this disclosure, log recording can be performed using partitioned storage. For example, a security event may include multiple events stored in multiple storage spaces, or one event may correspond to one storage space. Log recording can be based on the correspondence between events and storage spaces. For example, abnormal data of a first event can be recorded in a first storage space, which is the storage space corresponding to the first event among multiple storage spaces. For example, if there are S security events, and an abnormality occurs in the i-th event (i∈[1,S]), the abnormal data of the i-th event is recorded in the i-th storage space corresponding to the i-th event among multiple storage spaces. By reading data from multiple storage spaces, it is possible to determine at once whether multiple security events have occurred abnormally, thus comprehensively determining the security status of the LiDAR.

[0151] In some embodiments of this disclosure, log recording can adopt a first-in, first-out (FIFO) approach. When multiple abnormal events exist simultaneously, data of the higher-priority abnormal events can be recorded first, and security processing of the higher-priority abnormal events can be prioritized based on the abnormal event data.

[0152] In some embodiments of this disclosure, security processing based on abnormal data includes, for example, sending security information. The security information includes alarm indications or partial or complete abnormal data in the logs, wherein the alarm indications indicate a security anomaly in the LiDAR. Users or remote maintainers can promptly determine that a security anomaly exists in the LiDAR and perform remote maintenance or return-to-factory maintenance accordingly. Alternatively, the terminal device can promptly determine that a security anomaly exists in the LiDAR, disregard the LiDAR's sensing data, or shut down the LiDAR to improve the operational security of the terminal device. As another example, the security information includes partial or complete abnormal data in the logs. Users or remote maintainers can promptly identify the abnormal data recorded by the LiDAR and determine whether to perform remote maintenance or return-to-factory maintenance based on the abnormal data. Alternatively, the terminal device can promptly identify the abnormal data recorded by the LiDAR and determine whether to accept the LiDAR's sensing data or shut down the LiDAR based on the abnormal data to improve the operational security of the terminal device. For example, for abnormal data of security events that reach the preset level, remote maintenance or factory return maintenance can be performed in a timely manner. Alternatively, for abnormal data of security events that reach the preset level, the sensing data of the lidar can be disregarded or the lidar can be turned off to improve the operational safety of the terminal equipment.

[0153] In some embodiments of this disclosure, security information can be sent based on the anomaly level. For example, when the anomaly level of a first event is a preset anomaly level, security information is sent. The security information is as described above. For example, events such as "inter-board authentication," "startup," "data storage," and "communication" are at the first level, while "upgrade" is at the second level. For anomaly data of first-level events, security information can be sent. For anomaly data of second-level events, no external transmission or alarm may be triggered. High-level anomaly events can be handled promptly, achieving timely response to security events while saving external transmission resources.

[0154] Optionally, for recorded logs (including non-externalized abnormal data), logs can be stored periodically or event-driven (e.g., based on requests from terminal devices) in external storage for the LiDAR. For example, the LiDAR sends logs to the terminal device, which then stores them in its own storage. Alternatively, the LiDAR can send logs to the terminal device, which then forwards them to a remote server, which stores them in storage resources (e.g., cloud storage). Logs can be used to pinpoint the cause of LiDAR anomalies, facilitating further improvements in LiDAR security management after the cause is identified.

[0155] In some embodiments of this disclosure, successful security verification events can also be logged. For example, the log may include one or more of the following data for the security event: security verification result, LiDAR version number, security event occurrence time or verification time, security event identifier, or security event level, etc. Information on both successful and failed security verification events is recorded, allowing for a comprehensive determination of the LiDAR's security status during use at the event granularity.

[0156] Factory configuration data includes data that the user cannot change after the LiDAR leaves the factory, such as, but not limited to, one or more of the following: calibration data, or any security configuration. Calibration data is used for LiDAR calibration, such as point cloud calibration parameters. Security configuration includes, for example, security configurations for one or more of the security events mentioned above, including data such as keys, identifiers, and public keys. User configuration data includes data that the user can configure after the LiDAR leaves the factory, such as, but not limited to, one or more of the following: username used for communication, login password, or shared key used to generate session keys during data transmission.

[0157] In some embodiments of this disclosure, step S420 further includes: entering a security mode based on the security verification result. Different security verification results result in different security modes. For example, when inter-board security verification fails, the LiDAR is controlled to not start or to sleep. When the security verification result fails, the LiDAR is controlled to not start or to sleep; the security mode includes non-working states such as the LiDAR not starting or sleeping. When data storage security verification fails, the LiDAR is controlled to not start or to sleep. The security mode includes: non-working states such as the LiDAR not starting or sleeping when security verification fails, or working states such as the LiDAR operating normally when security verification succeeds.

[0158] When communication security verification fails, the LiDAR is controlled to enter a communication security alarm state, a shutdown state, or a sleep state. In the alarm state, the LiDAR can send a communication security alarm instruction to the terminal device, the user of the terminal device, or the LiDAR server (e.g., a remote server). The terminal device can, based on this instruction, disregard the LiDAR's sensing data or shut down the LiDAR. Alternatively, the terminal device can, based on this instruction, send a communication security alarm instruction to the LiDAR server, enabling the server to promptly address the communication security issue. Alternatively, the LiDAR can send a communication security alarm instruction to the user, allowing the user to confirm the communication security alarm through a human-machine interface (e.g., the human-machine interface of a mobile phone, watch, or vehicle) and take one or more of the following measures: shut down the LiDAR, put the LiDAR into sleep mode, disable the vehicle's driver assistance functions, or take over if the vehicle is in an autonomous driving state. Security modes include: when security verification fails, the LiDAR is in a non-working state such as alarm, shutdown, or sleep; or when security verification succeeds, the LiDAR operates normally.

[0159] In some embodiments of this disclosure, the security mode of the lidar in the event of an upgrade includes: when security verification fails, controlling the lidar to roll back the program to a previous version.

[0160] The security configuration for any of the above security events can be stored in the secure storage space of the LiDAR. Secure storage space may include, but is not limited to, one or more of the following: storage space of the Trusted Platform Module (TPM), also known as a TPM circuit or TPM chip; one-time programmable storage space, such as electronic fuse (eFuse) memory; and storage space of the Hardware Security Module (HSM), also known as an HSM circuit or HSM chip.

[0161] Optionally, different security configurations can be stored in the same or different storage spaces. For example, the first through eighth security storage spaces can be the same, different, or partially the same. For example, the first identifier can be stored in the TPM's storage space. The authentication public key can be stored in a one-time programmable storage space. The second configuration can be stored in the HSM's storage space. The transmission key can be stored in the TPM's storage space. The startup key can be stored in the TPM's storage space. The startup public key can be stored in a one-time programmable storage space. The storage key can be stored in the TPM's storage space. The storage public key can be stored in a one-time programmable storage space. The upgrade public key and upgrade key can be stored in the TPM's storage space. The startup private key can, for example, be stored at the factory level in the HSM's storage space of the LiDAR.

[0162] This disclosure also discloses a security management device for LiDAR. Please refer to FIG12, which shows an example block diagram of a security management device consistent with some embodiments of this disclosure. As shown in FIG12, the security management device 1200 includes: a storage unit 1210, a security verification unit 1220, and a processing unit 1230. The storage unit 1210 can store security configurations for security verification of security events of the LiDAR. Security events include one or more of the following events: inter-board authentication, communication, startup, data storage, and upgrade. The security verification unit 1220 can perform security verification of security events based on the security configurations. The processing unit 1230 can perform security processing based on the results of the security verification.

[0163] For security verification and security processing, please refer to the description in the above embodiments.

[0164] The security verification unit 1220 is merely a schematic representation of a logical function and may include multiple independently implemented verification subunits. For example, for inter-board authentication, the security verification unit 1220 may include an inter-board security verification subunit. For communication, the security verification unit 1220 may include a communication security verification subunit. For startup, the security verification unit 1220 may include a startup security verification subunit. For data storage, the security verification unit 1220 may include a storage security verification subunit. For upgrades, the security verification unit 1220 may include an upgrade security verification subunit.

[0165] The above unit division is only a logical functional division. In actual implementation, all or part of it can be integrated into a single physical entity, or they can be physically separated. Units (e.g., processing units or sub-units of security verification units) can be implemented by a processor calling software. The processor may include, for example, a general-purpose processor, such as a CPU, and the memory may be integrated with the processor or implemented independently. Alternatively, units (e.g., processing units or sub-units of security verification units) can be implemented as hardware circuits. For example, the function of the unit is implemented through the design of hardware circuits, such as application-specific integrated circuits (ASICs), where the function of the unit is implemented by designing the logical relationships between components within the circuit. Furthermore, the hardware circuit can be implemented using programmable logic devices (PLDs). For example, the hardware circuit may include a large number of logic gates, and the logical relationships between the logic gates are configured through configuration files to achieve the function of the unit. The units of the above security management device can be implemented entirely by a processor calling program, entirely by hardware circuits, or partially by a processor calling program with the remaining parts implemented by hardware circuits.

[0166] A processor is a circuit with signal processing capabilities. For example, a processor includes circuits capable of instruction fetching and execution, such as a CPU, microprocessor, graphics processing unit (GPU), or digital signal processor (DSP). Alternatively, a processor can be implemented through the logical relationships of hardware circuits, which can be fixed or reconfigurable. For instance, a processor may include hardware circuits implemented using ASICs or PLDs, such as those implemented using Field-Programmable Gate Arrays (FPGAs). In reconfigurable hardware circuits, the process of the processor loading a configuration document and configuring the hardware circuit can be understood as the processor loading instructions to implement the functions of the corresponding units. Furthermore, a processor may include hardware circuits designed for artificial intelligence, such as, but not limited to, one or more of neural network processors (NPUs), tensor processors (TPUs), or deep learning processors (DPUs).

[0167] Storage units may include, for example, one or more types of memory. This disclosure does not limit the type of memory used in non-secure storage spaces; for example, the memory may include read-only memory (ROM) or random access memory (RAM). It may include, for example, non-volatile or volatile memory. ROM may include, for example, mask ROM, programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash ROM; RAM may include, for example, static random-access memory (SRAM) or dynamic random-access memory (DRAM). The description of secure storage spaces refers to the embodiments described above.

[0168] In some embodiments of this disclosure, please refer to FIG13, which shows an example block diagram of another security management device consistent with some embodiments of this disclosure. As shown in FIG13, the security management device 1300 includes a storage circuit 1310 and a processing circuit 1320, which communicate via a bus 1330. The storage circuit 1310 is used to store a security configuration for security verification of security events of the LiDAR, including one or more of the following events: inter-board authentication, communication, startup, data storage, or upgrade. The processing circuit 1320 is used to execute any of the above security management methods. For example, any of the above security management methods are executed based on the security configuration stored in the storage circuit 1310.

[0169] The processing circuitry may include, for example, one or more processors, and the storage circuitry may include, for example, one or more memories. The processing circuitry or storage circuitry may be part of the control and processing system 130 or independent of the control and processing system 130.

[0170] In some embodiments of this disclosure, the security management device further includes a debugging interface, such as interface unit 1240 or interface circuit 1340. This debugging interface is configured to be disabled.

[0171] For example, please refer to Figure 14, which shows an example block diagram of a LiDAR debugging interface consistent with some embodiments of this disclosure. Taking a Universal Asynchronous Receiver Transmitter (UART) interface as an example, as shown in Figure 14, the UART interface is disabled via software. Disabling the UART software driver in the software code prevents access between the LiDAR 1400's UART interface circuit and processing circuit, preventing attackers from intruding into the LiDAR via the UART interface and obtaining internal data such as software data, firmware data, configuration data, or one or more. Furthermore, the secure boot and secure upgrade configurations prevent the burning of software programs that enable the UART interface, further preventing attackers from obtaining internal LiDAR data via the UART interface. A factory version of the software is available at the LiDAR factory, allowing the UART software driver to be re-enabled after the LiDAR is returned to the factory for debugging via the UART interface to locate problems.

[0172] Taking the debugging interface, which includes the Joint Test Action Group (JTAG) interface, as an example, please refer to Figure 15, which shows an example block diagram of another LiDAR debugging interface consistent with some embodiments of this disclosure. As shown in Figure 15, the JTAG interface is disabled at the LiDAR factory. For example, the interface is disabled using an electronic control fuse (control eFuse). At the LiDAR factory, the value of the JTAG interface's electronic control fuse can be set to 1, enabling the JTAG debugging function for LiDAR debugging; before the LiDAR is debugged and shipped, the control eFuse is programmed to 0 to disable the JTAG interface. The eFuse has a one-time programmable characteristic; once programmed from "1" to "0", it cannot be programmed back to "1", thus disabling the JTAG interface.

[0173] Disabling the interface prevents attackers from using external tools to compromise the LiDAR 1500 and obtain internal data such as software data, firmware data, configuration data, or one or more other types. This improves the security of the LiDAR.

[0174] This disclosure also discloses a lidar, which includes any of the above-mentioned security management devices.

[0175] This disclosure also discloses a terminal device, which includes a lidar.

[0176] This disclosure also discloses a computer storage medium storing instructions, wherein any of the above security management methods are executed when the instructions are invoked by a processor.

[0177] This disclosure also discloses a computer program product, including instructions, which, when invoked by a processor, execute any of the above security management methods.

[0178] In this disclosure, unless otherwise expressly specified and limited, ordinal numbers, such as "first," "second," etc., are used only to distinguish and describe related objects, and should not be construed as indicating or implying the relative importance or order between related objects. Furthermore, ordinal numbers do not represent the quantity of related objects. For example, "first lidar" may include one lidar or multiple lidars.

[0179] "Multiple" includes two or more, and other classifiers are similar.

[0180] The terms "or" and "and / or" in this disclosure are used to describe relationships between related objects, indicating a non-exclusive inclusion. For example, "A and / or B" and "A or B" can both include: "A alone," "B alone," or "A and B," where "A" and "B" can include a single object or multiple objects. Similarly, "A, B and / or C," "A, B or C," and "A, B and C" can both include: "A alone," "B alone," "C alone," "A and B," "A and C," "B and C," or "A, B and C," where "A," "B," and "C" can include a single object or multiple objects. Additionally, the " / " in this disclosure is used to indicate an "or" relationship between related objects. The meanings of "at least one of A or B" and "one or more of A and B" in this disclosure are the same as the meaning of "A or B" above. The meanings of "one or more of A, B, and C" and "at least one of A, B, or C" are the same as the meaning of "A, B, or C" above. The meaning of "one or more of A, B, and C" is the same as the meaning of "A, B, or C" above.

[0181] In the above embodiments, the descriptions of each embodiment have their own emphasis. Parts not described in detail or in a particular embodiment can be referred to in the relevant descriptions of other embodiments. Furthermore, the above embodiments can be freely combined as needed.

Claims

1. A safety management method, characterized in that, For use with a lidar system, the lidar system has a security configuration for security verification of security events of the lidar system, the security events including one or more of the following events: inter-board authentication, communication, startup, data storage, or upgrade, and the method includes: The security event is verified based on the security configuration. Based on the results of the security verification, security processing is performed.

2. The safety management method according to claim 1, characterized in that, The security configuration includes a first configuration for security verification of the inter-board authentication; Furthermore, the security verification of the security event based on the security configuration includes: Based on the first configuration, inter-board security verification is performed between the first and second circuit boards of the LiDAR. When the inter-board security verification fails, the inter-board authentication is abnormal. The first configuration performs inter-board security verification on the first and second circuit boards of the lidar, including: The first circuit board is verified on the second circuit board based on a first encryption result, a first random number, and a first identifier stored on the second circuit board, wherein the first configuration includes the first identifier, which is used to identify the first circuit board and is stored on both the first and second circuit boards; the first encryption result is determined on the first circuit board based on the first identifier and the first random number stored on the first circuit board; or... The second circuit board authenticates the first circuit board based on the second encryption result, the authentication public key, and the authentication signature; wherein, the first configuration includes the authentication public key stored in the second circuit board and the authentication signature, authentication data, and first identifier stored in the first circuit board; the second encryption result is determined on the first circuit board based on the authentication data and the first identifier, and the first identifier is used to identify the first circuit board.

3. The safety management method according to any one of claims 1-2, characterized in that, The security configuration includes a second configuration for security verification of the communication; and the security verification of the security event based on the security configuration includes: Based on the second configuration, a communication security verification is performed between the lidar and the terminal device; Specifically, when the communication security verification fails, the communication becomes abnormal; or when the communication security verification succeeds, data is transmitted to the terminal device. The lidar also has a secure transmission configuration for secure transmission of the communication, and the security management method further includes: The data is encrypted and transmitted to the terminal device based on the secure transmission configuration, wherein the secure transmission configuration includes a transmission key stored in the first secure storage space of the lidar; the session key used for the encrypted transmission is determined based on the transmission key and a second random number, the second random number being determined interactively by the lidar and the terminal device.

4. The safety management method according to any one of claims 1-3, characterized in that, The security configuration includes a third configuration for the security verification during startup; and the security verification of the security event based on the security configuration includes: When the lidar is started, a startup security verification is performed on the lidar's program data based on the third configuration. If the startup security verification fails, the startup is abnormal. The step of performing startup security verification on the lidar's program data based on the third configuration when the lidar is started includes: The program data is decrypted using the startup key, wherein an exception occurs during startup if decryption fails; the third configuration includes the startup key, which is stored in the second secure storage space of the lidar, and the program data is encrypted and stored using the startup key; or... The program data is verified using the startup public key. If the verification fails, the startup is abnormal. The third configuration includes the startup public key, which is stored in the third secure storage space of the lidar. The program data is signed and stored using the startup private key.

5. The safety management method according to any one of claims 1-4, characterized in that, The security configuration includes a fourth configuration for security verification of the data storage; Furthermore, the security verification of the security event based on the security configuration includes: Based on the fourth configuration, the configuration data of the LiDAR is stored for security verification. When the storage security verification fails, the data storage is abnormal. The storage security verification of the lidar configuration data based on the fourth configuration includes: The configuration data is decrypted using a storage key, wherein an anomaly occurs in data storage if decryption fails; the fourth configuration includes the storage key, is stored in the fourth secure storage space of the lidar, and the configuration data is encrypted using the storage key; or, The configuration data is verified using a stored public key. If the verification fails, the data storage is abnormal. The fourth configuration includes the stored public key, which is stored in the fifth secure storage space of the lidar. The configuration data is signed and stored using a stored private key.

6. The safety management method according to any one of claims 1-5, characterized in that, The security configuration includes a fifth configuration for security verification of the upgrade; Furthermore, the security verification of the security event based on the security configuration includes: Based on the fifth configuration, perform upgrade security verification on the upgrade package of the lidar; Specifically, if the upgrade security verification fails, the upgrade is considered abnormal; or if the upgrade security verification succeeds, the application corresponding to the upgrade package is upgraded.

7. The safety management method according to any one of claims 1-6, characterized in that, Based on the results of the security verification, security processing is performed, including: When the security event includes a first event of security verification failure, obtain the abnormal data of the first event; Based on the abnormal data, security measures will be taken.

8. The safety management method according to claim 7, characterized in that, The security processing based on the abnormal data includes: Record a log, the log including abnormal data of the first event, the abnormal data including one or more of the following: the version number of the LiDAR when the abnormality occurred, the time of the abnormality, the abnormal event identifier, or the abnormality level; and / or, Send security information, which includes alarm indications or some or all of the abnormal data in the log, wherein the alarm indications are used to indicate that there is a security anomaly in the lidar.

9. A safety management device, characterized in that, For use with lidar, the security management device includes: A storage circuit is provided for storing a security configuration for security verification of security events of the lidar, the security events including one or more of the following: inter-board authentication, communication, startup, data storage, and upgrade; A processing circuit for performing the security management method as described in any one of claims 1-8.

10. A lidar, characterized in that, Includes the security management device as described in claim 9.

Images