OTA software integrity verification system for detecting contamination of information

Abstract

The present invention relates to an OTA software integrity verification system for detecting contamination of information, the system comprising an OTA server for updating, through wireless communication, software of an EV-OTA terminal connected thereto.

Description

OTA software integrity verification system that detects information corruption

[0001] The present invention relates to an OTA software integrity verification system for detecting whether information is contaminated.

[0002] Today, embedded systems are widely used in products like automobiles and mobile phones, enhancing product performance while also creating new features. To ensure the smooth operation and reliability of these embedded systems, verification procedures for the software applied to them are essential.

[0003] However, current software verification methods have several inherent problems. Specifically, existing verification methods may require modifications to the software code being verified.

[0004] That is, in addition to the software code to be verified designed by the developer, additional test codes required for testing must be inserted into the software code, which may require time and effort.

[0005] Meanwhile, the background technology described above is technical information that the inventor possessed for the purpose of deriving the present invention or acquired in the process of deriving the present invention, and cannot necessarily be said to be publicly known technology disclosed to the general public prior to the application for the present invention.

[0006] The purpose of the present invention is to propose an OTA software integrity verification system that detects whether information is corrupted by detecting whether past software version (old version) information is corrupted, whether new software version (new version) information is corrupted, and whether time information is corrupted.

[0007] The purpose of the present invention is to propose an OTA software integrity verification system that detects whether information is corrupted by detecting whether past software version (old version) information is corrupted, whether new software version (new version) information is corrupted, and whether time information is corrupted.

[0008] The technical problems of the present invention are not limited to the technical problems mentioned above, and other technical problems not mentioned will be clearly understood by those skilled in the art from the description below.

[0009] According to one aspect of the present invention described above, the OTA software integrity verification system for detecting whether information is contaminated proposed by the present invention can verify integrity by detecting when past software version (old version) information is contaminated, when new software version (new version) information is contaminated, and when time information is contaminated.

[0010] Additionally, the OTA software integrity verification system that detects whether information is tainted can verify integrity by detecting if the message authentication code (MAC) of the meta information is tainted, if a different server certificate is used, or if a certificate issued by a different certification authority is used.

[0011] In addition, the OTA software integrity verification system that detects whether information is contaminated can verify integrity by detecting whether an expired certificate is used, whether a revoked certificate is used, whether the OTA software is contaminated, or whether the OTA software and verification value (signature value) are contaminated.

[0012] The effects of the present invention are not limited to the effects mentioned above, and various effects may be included within a range obvious to those skilled in the art from the contents described below.

[0013] FIG. 1 is a conceptual diagram of an OTA software integrity verification system that detects whether information is contaminated according to one embodiment of the present invention.

[0014] FIG. 2 is a conceptual diagram of an OTA server according to one embodiment of the present invention.

[0015] FIGS. 3 to 12 are diagrams illustrating an OTA software integrity verification scenario according to one embodiment of the present invention.

[0016]

[0017] The detailed description of the present invention, which follows, refers to the accompanying drawings, which illustrate specific embodiments in which the present invention may be practiced. These embodiments are described in sufficient detail to enable those skilled in the art to practice the present invention. It should be understood that the various embodiments of the present invention, while different from each other, are not necessarily mutually exclusive. For example, specific shapes, structures, and characteristics described herein may be implemented in other embodiments without departing from the spirit and scope of the present invention.

[0018] When a component is referred to as being "connected" or "fastened" to another component, it should be understood that it may be directly connected or fastened to that other component, but that there may be other components intervening. Conversely, when a component is referred to as being "directly connected" or "fastened" to another component, it should be understood that there are no other components intervening.

[0019] Furthermore, it should be understood that the location or arrangement of individual components within each disclosed embodiment may be modified without departing from the spirit and scope of the present invention. Therefore, the following detailed description is not intended to be limiting, and the scope of the present invention, if properly described, is defined solely by the appended claims, along with the full scope equivalents thereof. Similar reference numerals in the drawings designate the same or similar functions throughout.

[0020] Hereinafter, preferred embodiments of the present invention will be described in more detail with reference to the drawings.

[0021]

[0022] FIG. 1 is a conceptual diagram of an OTA software integrity verification system that detects whether information is contaminated according to one embodiment of the present invention.

[0023] Figure 1 is a conceptual diagram of a system according to one embodiment of the present invention.

[0024] Referring to FIG. 1, an OTA software integrity verification system for detecting whether information is contaminated according to one embodiment of the present invention may include an OTA server (100), an EV-OTA terminal (300), and a certification authority (CA, 500).

[0025] The OTA server (100) can update the software of an EV-OTA terminal connected according to the present invention through wireless communication.

[0026] The OTA server (100) can verify integrity by detecting when past software version (old version) information is corrupted, when new software version (new version) information is corrupted, and when time information is corrupted.

[0027] The EV-OTA terminal (300) may include an electric vehicle registered in the OTA server (100), verify the MAC value transmitted from the OTA server (100), and transmit the OTA software download result.

[0028] A certification authority (CA) can generate a CA public key and private key and issue a certificate to an OTA server (500).

[0029] The OTA server (100) and the certification authority (CA, 500) may be an own server for providing a service according to the present invention, a cloud server, or a p2p (peer-to-peer) collection of distributed nodes.

[0030] The OTA server (100) can perform one or more of the operations, storage, reference, input / output, and control functions of a general computer, and can include an artificial neural network to be described later based on input data.

[0031] The OTA server (100) may include a processor and memory. The processor may wirelessly update the software of a connected EV-OTA terminal according to the present invention, and may include devices capable of doing so. The processor may also execute a program or control the OTA server (100). Program code executed by the processor may be stored in memory. The memory may store relevant information for performing a service according to the present invention or a program for implementing a method. The memory may be volatile or non-volatile memory.

[0032] The OTA server (100) can transmit data to an external device or receive data from an external device using a network.

[0033] The OTA server (100) can train an artificial neural network and utilize a trained artificial neural network. The processor can train or execute an artificial neural network stored in memory, and the memory can store a trained artificial neural network. The electronic device that trains the artificial neural network and the electronic device that utilizes the artificial neural network may be the same or separate.

[0034] Artificial intelligence (AI) is a computer system that embodies some of the functions of the human brain, capable of learning, making inferences, and making judgments on its own. As learning progresses, the probability of extracting answers increases. AI can be comprised of learning and the underlying technologies that utilize it. AI learning is an algorithmic technology that classifies and learns features based on input data, while the underlying technologies can utilize learning algorithms to partially emulate the functions of the human brain.

[0035] AI is a technology that easily approaches problems with multiple probabilistic answers, enabling it to logically and probabilistically infer optimal cycles, methods, and plans based on input data. AI inference techniques can include evaluating input data, making optimal predictions, knowledge- and probability-based inferences, and preference-based planning.

[0036] An artificial neural network (ANN) is a learning algorithm in the field of machine learning. It implements the connections between neurons and synapses in the brain through a program. An ANN can be programmed to create a neural network structure and then train it to achieve a desired function. While errors may exist, it can learn from massive amounts of data, producing appropriate output data based on input data. Its advantages include the ability to obtain output data that yields statistically positive results and its resemblance to human reasoning.

[0037] The OTA server (100) can infer individual characteristics and interests by analyzing consumers' online behavior data, social media activities, search history, etc. using an artificial intelligence algorithm built on big data, and for this purpose, can include a number of pre-learned artificial neural networks.

[0038] A network is a high-speed backbone network of a large communications network capable of providing large-capacity, long-distance voice and data services, and may be a next-generation wired or wireless network to provide the Internet or high-speed multimedia services.

[0039] If the network is a mobile communication network, it may be a synchronous mobile communication network or an asynchronous mobile communication network. An example of an asynchronous mobile communication network is a Wideband Code Division Multiple Access (WCDMA) network. In this case, although not shown in the diagram, the network may include a Radio Network Controller (RNC). While a WCDMA network is mentioned as an example, it could also be a 3G LTE network, a 4G network, a next-generation communication network such as 5G, or any other IP-based network.

[0040] The OTA server (100) and certification authority (CA, 500) may include any terminal capable of transmitting and receiving data over a network, such as a desktop computer, laptop, tablet, or smartphone.

[0041] The OTA server (100) and the certification authority (CA, 500) may include one or more of the computational functions, storage functions, reference functions, input / output functions, and control functions of a computer to perform the service according to the present invention.

[0042] The OTA server (100) and the certification authority (CA, 500) can access a website or install an application to receive services according to the present invention. The OTA server (100) and the certification authority (CA, 500) can exchange data via the website or application.

[0043] A network is a high-speed backbone network of a large communications network capable of providing large-capacity, long-distance voice and data services, and may be a next-generation wired or wireless network to provide the Internet or high-speed multimedia services.

[0044] If the network is a mobile communication network, it may be a synchronous mobile communication network or an asynchronous mobile communication network. An example of an asynchronous mobile communication network is a Wideband Code Division Multiple Access (WCDMA) network. In this case, although not shown in the diagram, the network may include a Radio Network Controller (RNC). While a WCDMA network is mentioned as an example, it could also be a 3G LTE network, a 4G network, a next-generation communication network such as 5G, or any other IP-based network.

[0045] A system (1) according to one embodiment of the present invention can collectively manage the process of manufacturing a meat pie by communicating with the equipment for manufacturing a meat pie in a manufacturing plant (300).

[0046]

[0047] FIG. 2 is a conceptual diagram of an OTA server according to one embodiment of the present invention.

[0048] Referring to FIG. 2, an OTA server (100) according to one embodiment of the present invention may include a key generation unit (110), a data generation unit (130), and a verification value generation unit (150).

[0049] The key generation unit (110) generates a public key and a private key for the OTA server, and when the certificate requested from the certification authority (CA, 500) is issued, generates a symmetric key with the EV-OTA terminal (300) and shares the generated symmetric key with the EV-OTA terminal (300).

[0050] The data generation unit (130) can generate metadata information MAC and transmit the generated MAC value to the EV-OTA terminal (300).

[0051] The verification value generation unit (150) can generate a software data integrity verification value and transmit the generated integrity verification value to the EV-OTA terminal (300).

[0052] Meanwhile, the OTA server (100) can update the software version information of the EV-OTA terminal shared with the symmetric key generated by the key generation unit to the latest software version information by performing a metadata MAC value generation and verification procedure when an OTA software update occurs, and then performing a software integrity verification value (signature value) generation and verification procedure.

[0053] The above-described metadata MAC value generation and verification procedure can be performed in a step in which the data generation unit of the OTA server can load metadata information and generate metadata information MAC, the OTA server can transmit a new software notification and metadata information MAC generated by the OTA server to the EV-OTA terminal, the EV-OTA terminal can check the current software version transmitted from the OTA server and verify the metadata information MAC value, and the EV-OTA transmits the metadata and MAC verification result to the OTA server as Success or Fail.

[0054] In addition, the software integrity verification value (signature value) generation and verification procedure may be performed such that, when the OTA server receives the metadata and MAC verification result as Success from the EV-OTA, the verification value generation unit of the OTA server may generate a software data integrity verification value, the OTA server may transmit the software data integrity verification value and the OTA server's certificate to the EV-OTA terminal, the EV-OTA terminal may verify the validity of the OTA certificate transmitted from the OTA server and the software data integrity verification value, the EV-OTA terminal may transmit the software data download and update result to the OTA server as Success or Fail, and when the OTA receives the software data download and update result as Success from the EV-OTA terminal, the procedure may be performed such that the EV-OTA terminal updates to the latest software version information.

[0055] Meanwhile, the OTA server may use the following [Mathematical Formula 1] as a basis for determining the user's satisfaction with the OTA server based on the update cycle of the OTA software, the time taken to update the OTA software, the user's satisfaction with the updated OTA software, the user's satisfaction with the result transmission between the OTA server and the EV-OTA terminal, and the user's satisfaction with the verification result between the OTA server and the EV-OTA terminal.

[0056] [Mathematical Formula 1]

[0057]

[0058] Here, Ss may mean satisfaction with the updated OTA software, Sr may mean satisfaction with the result transmission between the OTA server and the EV-OTA terminal, Sv may mean satisfaction with the verification result of the OTA server and the EV-OTA terminal, Pu may mean the update cycle of the OTA software, Tu may mean the time taken to update the OTA software, and S1 may mean a judgment criterion value of the user's satisfaction with the OTA server.

[0059] For example, if Ss is 8, Sr is 9, Sv is 8, Pu is 7, and Tu is 0.5, S1 can be calculated as 38.5, and if Ss is 2, Sr is 3, Sv is 3, Pu is 3, and Tu is 1, S1 can be calculated as 3.72.

[0060] Here, the smaller the value of S1 produced, the lower the satisfaction can be judged, and the larger the value produced, the higher the satisfaction can be judged.

[0061] The administrator of the OTA server can determine the satisfaction level of the OTA server user based on the value of S1 produced, and if the user satisfaction level is determined to be low, an inspection of the OTA server can be performed.

[0062] Here, the criteria for a clear numerical value for determining whether to perform an inspection of the OTA server based on the value of S1 produced can be determined by the administrator of the OTA server.

[0063] For example, if the value of S1 being produced is less than 10, the administrator can perform a check of the OTA server.

[0064] However, the lower the value of S1 produced, the lower the satisfaction with the OTA server may remain unchanged.

[0065] Meanwhile, the OTA server can calculate satisfaction from the users of the OTA server using another [Mathematical Formula 2].

[0066] [Equation 2]

[0067]

[0068] Here, Ss may mean satisfaction with the updated OTA software, Sr may mean satisfaction with the result transmission between the OTA server and the EV-OTA terminal, Sv may mean satisfaction with the verification result of the OTA server and the EV-OTA terminal, Pu may mean the update cycle of the OTA software, Tu may mean the time taken to update the OTA software, and S2 may mean a judgment criterion value of the user's satisfaction with the OTA server.

[0069] For example, if Ss is 8, Sr is 9, Sv is 8, Pu is 7, and Tu is 0.5, S2 can be calculated as 1.62, and if Ss is 2, Sr is 3, Sv is 3, Pu is 3, and Tu is 1, S2 can be calculated as 0.8.

[0070] Here, the smaller the value of S2 produced, the lower the satisfaction can be judged, and the larger the value produced, the higher the satisfaction can be judged.

[0071] The administrator of the OTA server can determine the satisfaction level of OTA server users based on the value of S2 produced, and if the user satisfaction level is determined to be low, an inspection of the OTA server can be performed.

[0072] Here, the criteria for a clear numerical value for determining whether to perform an inspection of the OTA server based on the value of S2 produced can be determined by the administrator of the OTA server.

[0073] For example, if the value of S2 produced is less than 1, the administrator can perform a check of the OTA server.

[0074] However, the lower the value of S2 produced, the lower the satisfaction with the OTA server may remain unchanged.

[0075] Meanwhile, the OTA server can calculate satisfaction from the users of the OTA server using another [Mathematical Formula 3].

[0076] [Equation 3]

[0077]

[0078] Here, Ss may mean satisfaction with the updated OTA software, Sr may mean satisfaction with the result transmission between the OTA server and the EV-OTA terminal, Sv may mean satisfaction with the verification result of the OTA server and the EV-OTA terminal, Pu may mean the update cycle of the OTA software, Tu may mean the time taken to update the OTA software, and S may mean a judgment criterion value of the user's satisfaction with the OTA server.

[0079] For example, if Ss is 8, Sr is 9, Sv is 8, Pu is 7, and Tu is 0.5, S3 can be calculated as 5.17, and if Ss is 2, Sr is 3, Sv is 3, Pu is 3, and Tu is 1, S3 can be calculated as 2.71.

[0080] Here, the smaller the value of S3 produced, the lower the satisfaction level can be judged, and the larger the value produced, the higher the satisfaction level can be judged.

[0081] The administrator of the OTA server can determine the satisfaction level of OTA server users based on the value of S3 produced, and can perform an inspection of the OTA server if the user satisfaction level is determined to be low.

[0082] Here, the criteria for a clear numerical value for determining whether to perform an inspection of the OTA server based on the value of the S3 produced can be determined by the administrator of the OTA server.

[0083] For example, if the value of S3 being produced is less than 5, the administrator can perform a check on the OTA server.

[0084] However, the lower the value of S3 produced, the lower the satisfaction with the OTA server may remain unchanged.

[0085] FIGS. 3 to 12 are diagrams illustrating an OTA software integrity verification scenario according to one embodiment of the present invention.

[0086] The TA Software Integrity Verification Scenario Tests in Figures 3 through 12 are designed to construct OTA software update scenarios, define situations, and verify the types of scenarios that can determine valid behavior in normal / error situations. For each of the 10 error scenarios, 10 normal and 10 error situations are randomly selected and verified for normal / error status.

[0087]

[0088] The embodiments described above are provided for illustrative purposes only, and those skilled in the art will readily appreciate that the embodiments described above can be readily modified into other specific forms without altering the technical concepts or essential characteristics of the embodiments described above. Therefore, the embodiments described above should be understood as illustrative in all respects and not restrictive. For example, components described as being single may be implemented in a distributed manner, and similarly, components described as being distributed may be implemented in a combined manner.

[0089]

[0090] The scope of protection sought through this specification is indicated by the claims described below rather than by the detailed description, and should be interpreted to include all changes or modifications derived from the meaning and scope of the claims and their equivalent concepts.

Claims

1. An OTA software integrity verification system that detects whether information is corrupted, including an OTA server that detects whether information of a past software version (old version) is corrupted, whether information of a new software version (new version) is corrupted, and whether time information is corrupted, verifies integrity, and updates the software of a connected EV-OTA terminal via wireless communication.

2. In paragraph 1, The above OTA server, A key generation unit that generates a public key and a private key for an OTA server, generates a symmetric key with the EV-OTA terminal when the certificate requested from a certification authority (CA) is issued, and shares the generated symmetric key with the EV-OTA terminal; A data generation unit that generates metadata information MAC and transmits the generated MAC value to the EV-OTA terminal; and A verification value generation unit that generates a software data integrity verification value and transmits the generated integrity verification value to the EV-OTA terminal; The above OTA server, When an OTA software update occurs, the metadata MAC value is generated and verified, and then the software integrity verification value (signature value) is generated and verified, thereby updating the software version information of the EV-OTA terminal shared with the symmetric key generated by the key generation unit to the latest software version information. The above metadata MAC value generation and verification procedure is: The data generation unit of the OTA server loads metadata information and generates a metadata information MAC, The above OTA server transmits new software notification and metadata information MAC generated by the OTA server to the EV-OTA terminal, The above EV-OTA terminal verifies the current software version and metadata information MAC value transmitted from the above OTA server, The above EV-OTA performs a verification procedure in which the metadata and MAC verification results are transmitted to the OTA server as Success or Fail. The above software integrity verification value (signature value) generation and verification procedure is: If the OTA server receives the metadata and MAC verification results as Success from the EV-OTA, the verification value generation unit of the OTA server generates a software data integrity verification value, The OTA server transmits a software data integrity verification value and a certificate of the OTA server to the EV-OTA terminal, The above EV-OTA terminal verifies the validity of the OTA certificate and the software data integrity verification value transmitted from the OTA server, The above EV-OTA terminal transmits the software data download and update results to the OTA server as Success or Fail, If the OTA receives a Successful result for software data download and update from the EV-OTA terminal, the procedure is performed to update the EV-OTA terminal with the latest software version information. The above EV-OTA terminal, Including an electric vehicle registered on the above OTA server, Verify the MAC value received from the OTA server and transmit the OTA software download result. The above certification authority (CA) is, Generate CA public and private keys and issue a certificate to the OTA server. The above OTA server, An OTA software integrity verification system that detects whether information is contaminated, using the value calculated using the following [mathematical formula] based on the update cycle of the OTA software, the time taken to update the OTA software, the satisfaction with the updated OTA software, the satisfaction with the result transmission between the OTA server and the EV-OTA terminal, and the satisfaction with the verification result of the OTA server and the EV-OTA terminal, as a criterion for judging the user's satisfaction with the OTA server. [Mathematical formula] (Ss means satisfaction with the updated OTA software, Sr means satisfaction with the result transmission between the OTA server and the EV-OTA terminal, Sv means satisfaction with the verification result between the OTA server and the EV-OTA terminal, Pu means the update cycle of the OTA software, Tu means the time taken to update the OTA software, and S1 means a judgment criterion value of the user's satisfaction with the OTA server.)

Images