OTA software integrity validation system

Abstract

The present invention relates to an OTA software integrity validation system comprising an OTA server for updating, through wireless communication, software of an EV-OTA terminal connected thereto.

Description

OTA Software Integrity Verification System

[0001] The present invention relates to an OTA software integrity verification system.

[0002] Today, embedded systems are widely used in products like automobiles and mobile phones, enhancing product performance while also creating new features. To ensure the smooth operation and reliability of these embedded systems, verification procedures for the software applied to them are essential.

[0003] However, current software verification methods have several inherent problems. Specifically, existing verification methods may require modifications to the software code being verified.

[0004] That is, in addition to the software code to be verified designed by the developer, additional test codes required for testing must be inserted into the software code, which may require time and effort.

[0005] Meanwhile, the background technology described above is technical information that the inventor possessed for the purpose of deriving the present invention or acquired in the process of deriving the present invention, and cannot necessarily be said to be publicly known technology disclosed to the general public prior to the application for the present invention.

[0006] The purpose of the present invention is to propose an OTA software integrity verification system that detects and verifies integrity when past software version (old version) information is corrupted, when new software version (new version) information is corrupted, and when time information is corrupted.

[0007] The technical problems of the present invention are not limited to the technical problems mentioned above, and other technical problems not mentioned will be clearly understood by those skilled in the art from the description below.

[0008] An OTA software integrity verification system according to one embodiment of the present invention may include an OTA server that wirelessly updates software of a connected EV-OTA terminal.

[0009] According to one embodiment, the OTA server may include a key generation unit that generates a public key and a private key for the OTA server, and generates a symmetric key with the EV-OTA terminal when the issuance of a certificate requested from a certification authority (CA) is completed, and shares the generated symmetric key with the EV-OTA terminal; a data generation unit that generates a metadata information MAC and transmits the generated MAC value to the EV-OTA terminal; and a verification value generation unit that generates a software data integrity verification value and transmits the generated integrity verification value to the EV-OTA terminal.

[0010] According to one embodiment, the OTA server may perform a metadata MAC value generation and verification procedure when an OTA software update occurs, and then perform a software integrity verification value (signature value) generation and verification procedure to update the software version information of the EV-OTA terminal shared with the symmetric key generated by the key generation unit to the latest software version information.

[0011] According to one embodiment, the metadata MAC value generation and verification procedure may be performed in a step in which the data generation unit of the OTA server loads metadata information and generates a metadata information MAC, the OTA server transmits a new software notification and metadata information MAC generated by the OTA server to the EV-OTA terminal, the EV-OTA terminal verifies the current software version received from the OTA server and the metadata information MAC value, and the EV-OTA transmits the metadata and MAC verification result to the OTA server as Success or Fail.

[0012] According to one embodiment, the software integrity verification value (signature value) generation and verification procedure may be performed in a step in which, when the OTA server receives the metadata and MAC verification result as Success from the EV-OTA, the verification value generation unit of the OTA server generates a software data integrity verification value, the OTA server transmits the software data integrity verification value and the certificate of the OTA server to the EV-OTA terminal, the EV-OTA terminal verifies the validity of the OTA certificate transmitted from the OTA server and the software data integrity verification value, the EV-OTA terminal transmits the software data download and update result as Success or Fail to the OTA server, and, when the OTA receives the software data download and update result as Success from the EV-OTA terminal, the procedure is performed in a step in which the EV-OTA terminal updates the EV-OTA terminal with the latest software version information.

[0013] According to one embodiment, the EV-OTA terminal includes an electric vehicle registered with the OTA server, verifies a MAC value transmitted from the OTA server, and transmits an OTA software download result.

[0014] According to one embodiment, the certification authority (CA) can generate a CA public key and a private key and issue a certificate to the OTA server.

[0015] According to one embodiment, the OTA server may use the following [mathematical formula] as a basis for determining a user's satisfaction with the OTA server, based on the update cycle of the OTA software, the time taken to update the OTA software, the user's satisfaction with the updated OTA software, the user's satisfaction with the result transmission between the OTA server and the EV-OTA terminal, and the user's satisfaction with the verification result between the OTA server and the EV-OTA terminal.

[0016] [Mathematical formula]

[0017]

[0018] (S s means satisfaction with updated OTA software, and S r means the satisfaction level for the result transmission between the OTA server and the EV-OTA terminal, and S v means the satisfaction level with the verification results of the OTA server and the EV-OTA terminal, and P u refers to the update cycle of the above OTA software, and T u refers to the time taken to update the OTA software, and S1 refers to the standard value for judging the user's satisfaction with the OTA server.)

[0019] According to one aspect of the present invention described above, the OTA software integrity verification system proposed by the present invention can verify integrity by detecting when past software version (old version) information is corrupted, when new software version (new version) information is corrupted, and when time information is corrupted.

[0020] Additionally, the OTA software integrity verification system can verify integrity by detecting if the message authentication code (MAC) of the metadata is corrupted, if a different server certificate is used, or if a certificate issued by a different certificate authority is used.

[0021] Additionally, the OTA software integrity verification system can verify the integrity by detecting if an expired certificate is used, if a revoked certificate is used, if the OTA software is contaminated, or if the OTA software and verification value (signature value) are contaminated.

[0022] The effects of the present invention are not limited to the effects mentioned above, and various effects may be included within a range obvious to those skilled in the art from the contents described below.

[0023] FIG. 1 is a conceptual diagram of an OTA software integrity verification system according to one embodiment of the present invention.

[0024] FIG. 2 is a conceptual diagram of an OTA server according to one embodiment of the present invention.

[0025] FIGS. 3 to 12 are diagrams illustrating an OTA software integrity verification scenario according to one embodiment of the present invention.

[0026] The detailed description of the present invention, which follows, refers to the accompanying drawings, which illustrate specific embodiments in which the present invention may be practiced. These embodiments are described in sufficient detail to enable those skilled in the art to practice the present invention. It should be understood that the various embodiments of the present invention, while different from each other, are not necessarily mutually exclusive. For example, specific shapes, structures, and characteristics described herein may be implemented in other embodiments without departing from the spirit and scope of the present invention.

[0027] When it is said that a component is "connected" or "fastened" to another component, it should be understood that it may be directly connected or fastened to that other component, but that there may be other components in between. Conversely, when it is said that a component is "directly connected" or "fastened" to another component, it should be understood that there are no other components in between.

[0028] Furthermore, it should be understood that the location or arrangement of individual components within each disclosed embodiment may be modified without departing from the spirit and scope of the present invention. Therefore, the following detailed description is not intended to be limiting, and the scope of the present invention, if properly described, is defined solely by the appended claims, along with the full scope equivalents thereof. Similar reference numerals in the drawings designate the same or similar functions throughout.

[0029] Hereinafter, preferred embodiments of the present invention will be described in more detail with reference to the drawings.

[0030]

[0031] FIG. 1 is a conceptual diagram of an OTA software integrity verification system according to one embodiment of the present invention.

[0032] Figure 1 is a conceptual diagram of a system according to one embodiment of the present invention.

[0033] Referring to FIG. 1, an OTA software integrity verification system according to one embodiment of the present invention may include an OTA server (100), an EV-OTA terminal (300), and a certification authority (CA, 500).

[0034] The OTA server (100) can update the software of an EV-OTA terminal connected according to the present invention through wireless communication.

[0035] The EV-OTA terminal (300) may include an electric vehicle registered in the OTA server (100), verify the MAC value transmitted from the OTA server (100), and transmit the OTA software download result.

[0036] A certification authority (CA) can generate a CA public key and private key and issue a certificate to an OTA server (500).

[0037] The OTA server (100) and the certification authority (CA, 500) may be an own server for providing a service according to the present invention, a cloud server, or a p2p (peer-to-peer) collection of distributed nodes.

[0038] The OTA server (100) can perform one or more of the operations, storage, reference, input / output, and control functions of a general computer, and can include an artificial neural network to be described later based on input data.

[0039] The OTA server (100) may include a processor and memory. The processor may wirelessly update the software of a connected EV-OTA terminal according to the present invention, and may include devices capable of doing so. The processor may also execute a program or control the OTA server (100). Program code executed by the processor may be stored in memory. The memory may store relevant information for performing a service according to the present invention or a program for implementing a method. The memory may be volatile or non-volatile memory.

[0040] The OTA server (100) can transmit data to an external device or receive data from an external device using a network.

[0041] The OTA server (100) can train an artificial neural network and utilize a trained artificial neural network. The processor can train or execute an artificial neural network stored in memory, and the memory can store a trained artificial neural network. The electronic device that trains the artificial neural network and the electronic device that utilizes the artificial neural network may be the same or separate.

[0042] Artificial intelligence (AI) is a computer system that embodies some of the functions of the human brain, capable of learning, making inferences, and making judgments on its own. As learning progresses, the probability of extracting answers increases. AI can be comprised of learning and the underlying technologies that utilize it. AI learning is an algorithmic technology that classifies and learns features based on input data, while the underlying technologies can utilize learning algorithms to partially emulate the functions of the human brain.

[0043] AI is a technology that easily approaches problems with multiple probabilistic answers, enabling it to logically and probabilistically infer optimal cycles, methods, and plans based on input data. AI inference techniques can include evaluating input data, making optimal predictions, knowledge- and probability-based inferences, and preference-based planning.

[0044] An artificial neural network (ANN) is a learning algorithm in the field of machine learning. It implements the connections between neurons and synapses in the brain through a program. An ANN can be programmed to create a neural network structure and then train it to achieve a desired function. While errors may exist, it can learn from massive amounts of data, producing appropriate output data based on input data. Its advantages include the ability to obtain output data that yields statistically positive results and its resemblance to human reasoning.

[0045] The OTA server (100) can infer individual characteristics and interests by analyzing consumers' online behavior data, social media activities, search history, etc. using an artificial intelligence algorithm built on big data, and for this purpose, can include a number of pre-learned artificial neural networks.

[0046] A network is a high-speed backbone network of a large communications network capable of providing large-capacity, long-distance voice and data services, and may be a next-generation wired or wireless network to provide the Internet or high-speed multimedia services.

[0047] If the network is a mobile communication network, it may be a synchronous mobile communication network or an asynchronous mobile communication network. An example of an asynchronous mobile communication network is a Wideband Code Division Multiple Access (WCDMA) network. In this case, although not shown in the diagram, the network may include a Radio Network Controller (RNC). While a WCDMA network is mentioned as an example, it could also be a 3G LTE network, a 4G network, a next-generation communication network such as 5G, or any other IP-based network.

[0048] The OTA server (100) and certification authority (CA, 500) may include any terminal capable of transmitting and receiving data over a network, such as a desktop computer, laptop, tablet, or smartphone.

[0049] The OTA server (100) and the certification authority (CA, 500) may include one or more of the computational functions, storage functions, reference functions, input / output functions, and control functions of a computer to perform the service according to the present invention.

[0050] The OTA server (100) and the certification authority (CA, 500) can access a website or install an application to receive services according to the present invention. The OTA server (100) and the certification authority (CA, 500) can exchange data via the website or application.

[0051] A network is a high-speed backbone network of a large communications network capable of providing large-capacity, long-distance voice and data services, and may be a next-generation wired or wireless network to provide the Internet or high-speed multimedia services.

[0052] If the network is a mobile communication network, it may be a synchronous mobile communication network or an asynchronous mobile communication network. An example of an asynchronous mobile communication network is a Wideband Code Division Multiple Access (WCDMA) network. In this case, although not shown in the diagram, the network may include a Radio Network Controller (RNC). While a WCDMA network is mentioned as an example, it could also be a 3G LTE network, a 4G network, a next-generation communication network such as 5G, or any other IP-based network.

[0053] A system (1) according to one embodiment of the present invention can collectively manage the process of manufacturing a meat pie by communicating with the equipment for manufacturing a meat pie in a manufacturing plant (300).

[0054]

[0055] FIG. 2 is a conceptual diagram of an OTA server according to one embodiment of the present invention.

[0056] Referring to FIG. 2, an OTA server (100) according to one embodiment of the present invention may include a key generation unit (110), a data generation unit (130), and a verification value generation unit (150).

[0057] The key generation unit (110) generates a public key and a private key for the OTA server, and when the certificate requested from the certification authority (CA, 500) is issued, generates a symmetric key with the EV-OTA terminal (300) and shares the generated symmetric key with the EV-OTA terminal (300).

[0058] The data generation unit (130) can generate metadata information MAC and transmit the generated MAC value to the EV-OTA terminal (300).

[0059] The verification value generation unit (150) can generate a software data integrity verification value and transmit the generated integrity verification value to the EV-OTA terminal (300).

[0060] Meanwhile, the OTA server (100) can update the software version information of the EV-OTA terminal shared with the symmetric key generated by the key generation unit to the latest software version information by performing a metadata MAC value generation and verification procedure when an OTA software update occurs, and then performing a software integrity verification value (signature value) generation and verification procedure.

[0061] The above-described metadata MAC value generation and verification procedure can be performed in a step in which the data generation unit of the OTA server can load metadata information and generate metadata information MAC, the OTA server can transmit a new software notification and metadata information MAC generated by the OTA server to the EV-OTA terminal, the EV-OTA terminal can check the current software version transmitted from the OTA server and verify the metadata information MAC value, and the EV-OTA transmits the metadata and MAC verification result to the OTA server as Success or Fail.

[0062] In addition, the software integrity verification value (signature value) generation and verification procedure may be performed such that, when the OTA server receives the metadata and MAC verification result as Success from the EV-OTA, the verification value generation unit of the OTA server may generate a software data integrity verification value, the OTA server may transmit the software data integrity verification value and the OTA server's certificate to the EV-OTA terminal, the EV-OTA terminal may verify the validity of the OTA certificate transmitted from the OTA server and the software data integrity verification value, the EV-OTA terminal may transmit the software data download and update result to the OTA server as Success or Fail, and when the OTA receives the software data download and update result as Success from the EV-OTA terminal, the procedure may be performed such that the EV-OTA terminal updates to the latest software version information.

[0063] Meanwhile, the OTA server may use the following [Mathematical Formula 1] as a basis for determining the user's satisfaction with the OTA server based on the update cycle of the OTA software, the time taken to update the OTA software, the user's satisfaction with the updated OTA software, the user's satisfaction with the result transmission between the OTA server and the EV-OTA terminal, and the user's satisfaction with the verification result between the OTA server and the EV-OTA terminal.

[0064] [Mathematical Formula 1]

[0065]

[0066] Here, S s can mean satisfaction with updated OTA software, and S r may mean satisfaction with the result transmission between the OTA server and the EV-OTA terminal, and S v may mean satisfaction with the verification results of the OTA server and the EV-OTA terminal, and Pu may refer to the update cycle of the above OTA software, and T u may refer to the time taken to update the OTA software, and S1 may refer to a criterion for judging user satisfaction with the OTA server.

[0067] For example, S s is 8, S r is 9, S v is 8, P u is 7, T u If is 0.5, S1 can be calculated as 38.5, and S s is 2, S r is 3, S v is 3, P u is 3, T u If is 1, S1 can be calculated as 3.72.

[0068] Here, the smaller the value of S1 produced, the lower the satisfaction can be judged, and the larger the value produced, the higher the satisfaction can be judged.

[0069] The administrator of the OTA server can determine the satisfaction level of the OTA server user based on the value of S1 produced, and if the user satisfaction level is determined to be low, an inspection of the OTA server can be performed.

[0070] Here, the criteria for a clear numerical value for determining whether to perform an inspection of the OTA server based on the value of S1 produced can be determined by the administrator of the OTA server.

[0071] For example, if the value of S1 being produced is less than 10, the administrator can perform a check of the OTA server.

[0072] However, the lower the value of S1 produced, the lower the satisfaction with the OTA server may remain unchanged.

[0073] Meanwhile, the OTA server can calculate satisfaction from the users of the OTA server using another [Mathematical Formula 2].

[0074] [Equation 2]

[0075]

[0076] Here, S s can mean satisfaction with updated OTA software, and S r may mean satisfaction with the result transmission between the OTA server and the EV-OTA terminal, and S v may mean satisfaction with the verification results of the OTA server and the EV-OTA terminal, and P u may refer to the update cycle of the above OTA software, and T u may refer to the time taken to update the OTA software, and S2 may refer to a criterion for judging user satisfaction with the OTA server.

[0077] For example, S s is 8, S r is 9, S v is 8, P u is 7, T u If is 0.5, S2 can be calculated as 1.62, and S s is 2, S r is 3, S v is 3, P u is 3, T u If is 1, S2 can be calculated as 0.8.

[0078] Here, the smaller the value of S2 produced, the lower the satisfaction can be judged, and the larger the value produced, the higher the satisfaction can be judged.

[0079] The administrator of the OTA server can determine the satisfaction level of OTA server users based on the value of S2 produced, and if the user satisfaction level is determined to be low, an inspection of the OTA server can be performed.

[0080] Here, the criteria for a clear numerical value for determining whether to perform an inspection of the OTA server based on the value of S2 produced can be determined by the administrator of the OTA server.

[0081] For example, if the value of S2 produced is less than 1, the administrator can perform a check of the OTA server.

[0082] However, the lower the value of S2 produced, the lower the satisfaction with the OTA server may remain unchanged.

[0083] Meanwhile, the OTA server can calculate satisfaction from the users of the OTA server using another [Mathematical Formula 3].

[0084] [Equation 3]

[0085]

[0086] Here, S s can mean satisfaction with updated OTA software, and S r may mean satisfaction with the result transmission between the OTA server and the EV-OTA terminal, and S v may mean satisfaction with the verification results of the OTA server and the EV-OTA terminal, and P u may refer to the update cycle of the above OTA software, and T u may refer to the time taken to update the OTA software, and S3 may refer to a criterion for judging the user's satisfaction with the OTA server.

[0087] For example, S s is 8, S r is 9, S v is 8, Pu is 7, T u If is 0.5, S3 can be calculated as 5.17, and S s is 2, S r is 3, S v is 3, P u is 3, T u If is 1, S3 can be calculated as 2.71.

[0088] Here, the smaller the value of S3 produced, the lower the satisfaction level can be judged, and the larger the value produced, the higher the satisfaction level can be judged.

[0089] The administrator of the OTA server can determine the satisfaction level of OTA server users based on the value of S3 produced, and can perform an inspection of the OTA server if the user satisfaction level is determined to be low.

[0090] Here, the criteria for a clear numerical value for determining whether to perform an inspection of the OTA server based on the value of the S3 produced can be determined by the administrator of the OTA server.

[0091] For example, if the value of S3 being produced is less than 5, the administrator can perform a check on the OTA server.

[0092] However, the lower the value of S3 produced, the lower the satisfaction with the OTA server may remain unchanged.

[0093] FIGS. 3 to 12 are diagrams illustrating an OTA software integrity verification scenario according to one embodiment of the present invention.

[0094] The TA Software Integrity Verification Scenario Tests in Figures 3 through 12 are designed to construct OTA software update scenarios, define situations, and verify the types of scenarios that can determine valid behavior in normal / error situations. For each of the 10 error scenarios, 10 normal and 10 error situations are randomly selected and verified for normal / error status.

[0095]

[0096] The embodiments described above are provided for illustrative purposes only, and those skilled in the art will readily appreciate that the embodiments described above can be readily modified into other specific forms without altering the technical concepts or essential characteristics of the embodiments described above. Therefore, the embodiments described above should be understood as illustrative in all respects and not restrictive. For example, components described as being single may be implemented in a distributed manner, and similarly, components described as being distributed may be implemented in a combined manner.

[0097]

[0098] The scope of protection sought through this specification is indicated by the claims described below rather than by the detailed description, and should be interpreted to include all changes or modifications derived from the meaning and scope of the claims and their equivalent concepts.

Claims

1. An OTA software integrity verification system including an OTA server that wirelessly updates the software of a connected EV-OTA terminal.

2. In paragraph 1, The above OTA server, A key generation unit that generates a public key and a private key for an OTA server, generates a symmetric key with the EV-OTA terminal when the certificate requested from a certification authority (CA) is issued, and shares the generated symmetric key with the EV-OTA terminal; A data generation unit that generates metadata information MAC and transmits the generated MAC value to the EV-OTA terminal; and A verification value generation unit that generates a software data integrity verification value and transmits the generated integrity verification value to the EV-OTA terminal; The above OTA server, When an OTA software update occurs, the metadata MAC value is generated and verified, and then the software integrity verification value (signature value) is generated and verified, thereby updating the software version information of the EV-OTA terminal shared with the symmetric key generated by the key generation unit to the latest software version information. The above metadata MAC value generation and verification procedure is: The data generation unit of the OTA server loads metadata information and generates a metadata information MAC, The above OTA server transmits new software notification and metadata information MAC generated by the OTA server to the EV-OTA terminal, The above EV-OTA terminal verifies the current software version and metadata information MAC value transmitted from the above OTA server, The above EV-OTA performs a verification procedure in which the metadata and MAC verification results are transmitted to the OTA server as Success or Fail. The above software integrity verification value (signature value) generation and verification procedure is: If the OTA server receives the metadata and MAC verification results as Success from the EV-OTA, the verification value generation unit of the OTA server generates a software data integrity verification value, The OTA server transmits a software data integrity verification value and a certificate of the OTA server to the EV-OTA terminal, The above EV-OTA terminal verifies the validity of the OTA certificate and the software data integrity verification value transmitted from the OTA server, The above EV-OTA terminal transmits the software data download and update results to the OTA server as Success or Fail, If the OTA receives a Successful result for software data download and update from the EV-OTA terminal, the procedure is performed to update the EV-OTA terminal with the latest software version information. The above EV-OTA terminal, Including an electric vehicle registered on the above OTA server, Verify the MAC value received from the OTA server and transmit the OTA software download result. The above certification authority (CA) is, An OTA software integrity verification system that generates CA public and private keys and issues a certificate to the OTA server.

3. In paragraph 2, The above OTA server, An OTA software integrity verification system, which uses the following [mathematical formula] as a basis for determining a user's satisfaction with the OTA server based on the update cycle of the OTA software, the time taken to update the OTA software, the satisfaction with the updated OTA software, the satisfaction with the result transmission between the OTA server and the EV-OTA terminal, and the satisfaction with the verification result between the OTA server and the EV-OTA terminal. [Mathematical formula] (S s means satisfaction with updated OTA software, and S r means the satisfaction level for the result transmission between the OTA server and the EV-OTA terminal, and S v means the satisfaction level with the verification results of the OTA server and the EV-OTA terminal, and P u refers to the update cycle of the above OTA software, and T u refers to the time taken to update the OTA software, and S1 refers to the standard value for judging the user's satisfaction with the OTA server.)

Images