WO2020124985A1 - 固件安全升级方法、装置、车载***和车辆 - Google Patents

固件安全升级方法、装置、车载***和车辆 Download PDF

Info

Publication number
WO2020124985A1
WO2020124985A1 PCT/CN2019/093435 CN2019093435W WO2020124985A1 WO 2020124985 A1 WO2020124985 A1 WO 2020124985A1 CN 2019093435 W CN2019093435 W CN 2019093435W WO 2020124985 A1 WO2020124985 A1 WO 2020124985A1
Authority
WO
WIPO (PCT)
Prior art keywords
firmware
response
instruction
firmware upgrade
upgrade package
Prior art date
Application number
PCT/CN2019/093435
Other languages
English (en)
French (fr)
Other versions
WO2020124985A9 (zh
Inventor
谭蔚华
Original Assignee
广州小鹏汽车科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 广州小鹏汽车科技有限公司 filed Critical 广州小鹏汽车科技有限公司
Priority to EP19901007.5A priority Critical patent/EP3889766B1/en
Publication of WO2020124985A1 publication Critical patent/WO2020124985A1/zh
Publication of WO2020124985A9 publication Critical patent/WO2020124985A9/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00—Arrangements for software engineering
    • G06F8/60—Software deployment
    • G06F8/65—Updates
    • G06F8/658—Incremental updates; Differential updates
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00—Arrangements for software engineering
    • G06F8/60—Software deployment
    • G06F8/65—Updates
    • G06F8/654—Updates using techniques specially adapted for alterable solid state memories, e.g. for EEPROM or flash memories
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/572—Secure firmware programming, e.g. of basic input output system [BIOS]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00—Arrangements for software engineering
    • G06F8/70—Software maintenance or management
    • G06F8/71—Version control; Configuration management

Definitions

  • the invention belongs to the technical field of information security, and in particular relates to a method, a device, a vehicle-mounted system and a vehicle for safely upgrading firmware.
  • Firmware is a program written in EROM or EEPROM, and is a "driver" saved inside the device. Through the firmware, the operating system can implement the operation of the specific machine according to the standard device driver.
  • Firmware upgrade refers to upgrading the embedded firmware of the device, which can improve device functions, enhance stability, and fix loopholes.
  • the interfaces used for firmware upgrades in devices have the risk of being maliciously used by attackers.
  • An attacker may hijack the firmware upgrade channel and write the self-made firmware upgrade package into it, so that the corresponding module of the control device and even the entire device can be controlled in the CAN bus to achieve the purpose of stealing control of the device and stealing data. Therefore, the security of firmware upgrade is very important for the occasions with high security requirements, such as smart cars, and the controller of the smart car should be prevented from being stolen through illegal firmware upgrades.
  • firmware upgrade package In order to ensure the security of the device's firmware upgrade, it is usually possible to ensure that the original firmware upgrade package is not tampered in the firmware upgrade package flashing process, but it cannot monitor whether the firmware upgrade package that is actually running in the device is the original flashed into the device.
  • the firmware upgrade package cannot perform security verification on the firmware upgrade package version, that is, an attacker may bypass the security restrictions of the upgrade channel and flash the self-made firmware upgrade package on the device and run it, which poses a security risk.
  • the present invention proposes a firmware security upgrade method, device, vehicle-mounted system and vehicle.
  • an embodiment of the present invention provides a method for safely upgrading firmware, including the following steps:
  • the response instruction is a preset response instruction
  • a message of successful upgrade is sent to complete the firmware upgrade.
  • the firmware upgrade package is pre-built with a response algorithm that generates a corresponding response command for the security verification command, wherein different versions of the firmware upgrade package correspond to the same security verification command and different response commands, and the firmware upgrade package There is a unique correspondence between the different versions of the security check command and the response command.
  • the version number of the firmware upgrade package is recorded.
  • the response instruction verification step if the response instruction sent by the device is the same as the preset response instruction in the response algorithm preset in the received firmware upgrade package, it is determined that the firmware is safely upgraded; if If the response instruction sent by the device is different from the preset response instruction preset in the response algorithm preset in the received firmware upgrade package, it is determined that the firmware upgrade is abnormal.
  • the device is subjected to a security test to ensure the security during the firmware upgrade process.
  • the firmware security upgrade device includes a firmware upgrade package acquisition module, a firmware flashing instruction sending module, a safety verification instruction sending module, a response instruction receiving module and Judgment module, where,
  • the firmware upgrade package acquisition module decrypts and signs the received firmware upgrade package
  • the firmware flashing instruction sending module sends a firmware flashing instruction to the corresponding device to be upgraded based on the firmware upgrade package;
  • the security verification instruction sending module sends a security verification instruction to the device based on the received successful writing instruction sent by the device;
  • the response instruction receiving module receives the response instruction sent by the device based on the security verification instruction
  • the judgment module sends a message that the upgrade is successful when the response instruction is a preset response instruction to complete the firmware upgrade.
  • another embodiment of the present invention provides a method for safely upgrading firmware, including the following steps:
  • the response instruction is a preset response instruction
  • a message of successful upgrade is sent to complete the firmware upgrade.
  • the firmware upgrade package is pre-built with a response algorithm that generates a corresponding response command for the security verification command, wherein different versions of the firmware upgrade package correspond to the same security verification command and different response commands, and the firmware upgrade package There is a unique correspondence between the different versions of the security check command and the response command.
  • the version number of the firmware upgrade package is received.
  • the response instruction verification step if the response instruction sent by the device is the same as the preset response instruction in the pre-stored response algorithm preset in the firmware upgrade package, it is determined that the firmware is safely upgraded; if all If the response instruction sent by the device is different from the preset response instruction preset in the response algorithm preset in the firmware upgrade package, it is determined that the firmware upgrade is abnormal.
  • firmware security upgrade device characterized in that the firmware security upgrade device includes a monitoring module, a security verification instruction sending module, a response instruction receiving module, and a judgment module, wherein,
  • the monitoring module receives the firmware flashing instruction of the device to be upgraded and enters the monitoring mode
  • the security verification instruction sending module sends the security verification instruction to the device after the monitoring module hears the successful writing instruction of the device;
  • a response instruction receiving module receiving the response instruction sent by the device based on the security verification instruction
  • the judgment module when the response instruction is a preset response instruction, sends a message of successful upgrade to complete the firmware upgrade.
  • Another embodiment of the present invention also provides an in-vehicle system in which at least one of the firmware safety upgrade devices described above is built.
  • Another embodiment of the present invention also provides a vehicle, the vehicle including the on-board system as described above.
  • the method, device, vehicle-mounted system and vehicle for firmware safety upgrade provided in the embodiments of the present invention are suitable for over-the-air (OTA) and OBD interface upgrades, by pre-packing a preset response algorithm in a firmware upgrade package , After the device completes the firmware flash, send a security verification verification command to verify the response command generated by the verification algorithm for security verification, so as to achieve consistency by checking the issued firmware and the firmware running after the upgrade.
  • OTA over-the-air
  • OBD interface upgrades by pre-packing a preset response algorithm in a firmware upgrade package .
  • FIG. 1 is a flowchart of a method for safely upgrading firmware according to Embodiment 1 of the present invention
  • FIG. 2 is a schematic diagram of a system applying the firmware safety upgrade method of Embodiment 1 of the present invention
  • FIG. 3 is a block diagram of a device for safely upgrading firmware according to Embodiment 2 of the present invention.
  • FIG. 4 is a flowchart of a method for safely upgrading firmware according to Embodiment 3 of the present invention.
  • FIG. 5 is a system schematic diagram of a method for safely upgrading firmware according to Embodiment 3 of the present invention.
  • FIG. 6 is a block diagram of a device for safely upgrading firmware according to Embodiment 4 of the present invention.
  • the embodiment of the present invention proposes a method of firmware safety upgrade, which is used to upgrade the firmware of a device, and is particularly suitable for the case of using OTA (Over-the-Air) method for remote firmware upgrade.
  • the device may be a car, as shown in the figure As shown in 1, it includes the following steps:
  • S11 Decrypt and verify the received firmware upgrade package; during the packaging process of the firmware upgrade package, encrypt and add a digital signature to the firmware upgrade package to ensure the security of the firmware upgrade package itself.
  • the encryption algorithm and signature algorithm may be any achievable algorithms in the prior art, and the present invention does not limit this.
  • the decryption algorithm and signature verification are executed, wherein the decryption algorithm corresponds to the encryption algorithm, and the signature verification process corresponds to the signature process.
  • the firmware upgrade package is pre-built with a response algorithm that generates a corresponding response instruction for the security verification instruction.
  • a response for generating the corresponding response instruction for the security verification instruction is written in advance
  • the logic of the algorithm implements the program for subsequent security verification.
  • the response algorithm has different response instructions for different versions of the firmware upgrade package and responds to the same security check instruction a or b, as shown in Table 1:
  • the response instruction of the firmware upgrade package version V1.0 is B, the response instruction of the firmware upgrade package version V2.0 is C, and the response of the firmware upgrade package version V3.0
  • the instruction is D; in response to the same security check instruction b, the response instruction of the firmware upgrade package version V1.0 is X, the response instruction of the firmware upgrade package version V2.0 is Y, and the firmware upgrade package version V3.0
  • the response command is Z. Therefore, the different versions V1.0, V2.0, and V3.0 of the firmware upgrade package and their security verification commands and response commands have a unique correspondence shown in Table 1.
  • step S11 after the signature verification is successful, the version number of the firmware upgrade package is recorded, so that the above-mentioned version of the firmware upgrade package can be used according to the recorded version number of the firmware upgrade package
  • the response algorithm obtains a preset response command, which in this embodiment is the response command associated with the version of the firmware upgrade package and the security verification command in Table 1, in order to facilitate comparison with the response command sent by the device in the subsequent step S15 .
  • the obtained firmware upgrade package sends a firmware flash instruction to the corresponding device to be upgraded based on the firmware upgrade package to start the firmware flash process.
  • the device to be upgraded uses a firmware upgrade package to flash the firmware according to the flash protocol, loads the firmware upgrade package into the corresponding storage module, and updates the version information of the firmware to the version of the firmware upgrade package.
  • a security test is performed on the device to ensure the security during the firmware upgrade process.
  • the detection content includes whether there are hijacked and/or tampered interference packets in the device's intranet, whether the device being flashed is under normal working conditions, and whether the device has an abnormal network connection, such as an attacker's connection. If one of the above conditions exists, you can stop flashing the firmware upgrade package of the current version and restore the previous firmware version.
  • the device After the firmware flash is completed, the device sends a flash successful command.
  • the device receives the security verification instruction, and uses a preset response algorithm in the flashed firmware upgrade package to send a corresponding response instruction for the version of the flashed firmware upgrade package.
  • the response command sent by the device is compared with the preset response command in the response algorithm preset in the received firmware upgrade package stored in advance.
  • the preset response instruction is the above-mentioned response instruction associated with the version of the firmware upgrade package and the security verification instruction.
  • the response instruction sent by the device is generated by the device according to a preset response algorithm in the firmware upgrade package that has been written, the response instruction sent by the device is pre-stored in the received firmware upgrade package If the preset response command in the set response algorithm is the same, it is determined that the firmware is safely upgraded; if the response command sent by the device is different from the preset response command in the response algorithm preset in the received firmware upgrade package, It indicates that there is a security risk in the firmware upgrade package written by the corresponding firmware. It is determined that the firmware upgrade is abnormal and recorded, and a security alarm is sent through the network. At the same time, it is prohibited to operate the device by OTA until it is unlocked by the risk removal process.
  • a security verification instruction a is sent to the device, the device generates a response instruction H, and returns the response instruction H.
  • the response instruction of the firmware upgrade package V1.0 corresponding to the security verification instruction a is B, then the preset response instruction is B.
  • its firmware security upgrade system includes an over-the-air upgrade OTA server, an in-vehicle security chip module ESU, and an electronic unit ECU to be flashed and upgraded.
  • the OTA server stores a challenge-end algorithm of a tag with a challenge response That is, in the response algorithm in Embodiment 1 of the present invention, the in-vehicle security chip module ESU performs the steps of the firmware security upgrade method described in Embodiment 1 of the present invention.
  • the response algorithm may be as shown in Table 1.
  • the challenge-end algorithm has only one security verification command AAA. For example, for the version 1.1 firmware, when the security verification command AAA is received, the response response command BBB is fed back.
  • the OTA server sends the challenge-end algorithm to the security chip module ESU in the car, and the security chip module ESU in the car stores the challenge-end algorithm in advance.
  • the second step is to have or generate a firmware package for upgrading in the over-the-air OTA server, that is, the firmware upgrade package in Embodiment 1 of the present invention, and preset the challenge-end algorithm in the upgraded firmware package.
  • the challenge-end algorithm in this example only has one security check instruction AAA
  • the challenge-end algorithm is preset in the upgraded firmware package by specifically inserting a hardcode challenge corresponding tag in the upgraded firmware package, for example, For firmware version V1.1, when receiving the security verification command AAA, the feedback response command BBB is fed back.
  • the security chip module ESU in the car obtains the upgraded firmware package, downloads it to the security chip module ESU in the car, and performs decryption and signature verification. If the verification passes, the security chip module ESU in the vehicle records the version number of the upgraded firmware package, for example, V1.1, and sends a firmware flashing instruction.
  • the security chip module ESU or other flashing control components in the vehicle use the upgraded firmware package to flash the firmware of the electronic unit ECU to be flashed according to the flashing protocol. After the firmware is successfully flashed, the electronic unit ECU runs the new firmware.
  • the security chip module ESU in the vehicle initiates a challenge-end algorithm based on the recorded version number V1.1 of the upgraded firmware package, and sends a security verification command AAA to the electronic unit ECU (expecting feedback preset response) Instruction BBB).
  • the electronic unit ECU After receiving the security verification instruction AAA sent by the security chip module ESU in the vehicle, the electronic unit ECU sends a response instruction to the security chip module ESU.
  • the security chip module ESU in the vehicle determines that the response is normal, and the firmware upgrade of the electronic unit ECU is successful. If the electronic unit ECU sends a response command to the security chip module ESU that is different from the preset response command BBB, the security chip module ESU in the vehicle determines that the response is abnormal, and the firmware package written by the electronic unit ECU is safe Risk, determine and record the firmware upgrade abnormality, the security chip module ESU sends a security alarm to the vehicle and/or OTA server through the network, and prohibits the operation of the vehicle by OTA mode.
  • the embodiment of the present invention proposes a device for safely upgrading firmware, which is used to upgrade the firmware of a device, and is particularly suitable for the case of using OTA (Over-the-Air) to perform remote firmware upgrade.
  • the device may be a car, as shown in the figure As shown in 3, it includes a firmware upgrade package acquisition module, a firmware flashing instruction sending module, a security verification instruction sending module, a response instruction receiving module, and a judgment module.
  • the firmware upgrade package acquisition module decrypts and signs the received firmware upgrade package.
  • the firmware upgrade package is encrypted and a digital signature is added to ensure the security of the firmware upgrade package itself.
  • the encryption algorithm and signature algorithm may be any achievable algorithms in the prior art, and the present invention does not limit this.
  • the decryption algorithm and signature verification are executed, wherein the decryption algorithm corresponds to the encryption algorithm, and the signature verification process corresponds to the signature process.
  • the firmware upgrade package is pre-built with a response algorithm that generates a corresponding response instruction for the security verification instruction.
  • a response for generating the corresponding response instruction for the security verification instruction is written in advance
  • the logic of the algorithm implements the program for subsequent security verification.
  • the response algorithm has different response instructions for different versions of the firmware upgrade package and responds to the same security verification instruction a or b, as shown in Table 1. That is, in response to the same security verification instruction a, the response instruction of the firmware upgrade package version V1.0 is B, the response instruction of the firmware upgrade package version V2.0 is C, and the response of the firmware upgrade package version V3.0 The instruction is D; in response to the same security check instruction b, the response instruction of the firmware upgrade package version V1.0 is X, the response instruction of the firmware upgrade package version V2.0 is Y, and the firmware upgrade package version V3.0 The response command is Z. Therefore, the different versions V1.0, V2.0, and V3.0 of the firmware upgrade package and their security verification commands and response commands have a unique correspondence shown in Table 1.
  • the firmware upgrade package acquisition module records the version number of the firmware upgrade package, so as to be able to obtain the preset response instruction used by the judgment module.
  • the above-mentioned response algorithm related to the version of the firmware upgrade package can be used to obtain the preset response instruction, which in this embodiment is the version of the firmware upgrade package in Table 1
  • the response command associated with the security verification command is the version of the firmware upgrade package in Table 1
  • the firmware flashing instruction sending module sends a firmware flashing instruction to the corresponding device to be upgraded based on the firmware upgrade package.
  • the obtained firmware upgrade package sends a firmware flash instruction to the corresponding device to be upgraded based on the firmware upgrade package to start the firmware flash process.
  • the device to be upgraded uses a firmware upgrade package to flash the firmware according to the flash protocol, loads the firmware upgrade package into the corresponding storage module, and updates the version information of the firmware to the version of the firmware upgrade package.
  • the firmware flashing instruction sending module performs security detection on the device to determine the security during the firmware upgrade.
  • the detection content includes whether there are hijacked and/or tampered interference packets in the device's intranet, whether the flashed firmware is in normal working conditions, and whether the device has an abnormal network connection, such as an attacker's connection. If one of the above conditions exists, you can stop flashing the current firmware upgrade package and restore the previous firmware version.
  • the device After the firmware flash is completed, the device sends a flash successful command.
  • the security verification instruction sending module sends a security verification instruction to the device based on the received successful writing command sent by the device.
  • the device receives the security verification instruction, and uses the preset response algorithm in the flashed firmware upgrade package to send a corresponding response instruction for the version of the flashed firmware upgrade package.
  • the response instruction receiving module receives the response instruction sent by the device based on the security verification instruction.
  • the judgment module when the response instruction is a preset response instruction, sends a message of successful upgrade to complete the firmware upgrade. Specifically, after receiving the response command sent by the device, the judgment module compares the response command sent by the device with a preset response command in a response algorithm preset in the received firmware upgrade package.
  • the preset response instruction is the above-mentioned response instruction associated with the version of the firmware upgrade package and the security verification instruction.
  • the response instruction sent by the device is generated by the device according to a preset response algorithm in the firmware upgrade package that has been written, the response instruction sent by the device is pre-stored in the received firmware upgrade package If the preset response command in the set response algorithm is the same, the judgment module determines that the firmware is safely upgraded; if the response command sent by the device is the preset response command in the response algorithm preset in the received firmware upgrade package stored in advance If it is different, it indicates that there is a security risk in the firmware upgrade package written by the corresponding firmware. The judgment module determines that the firmware upgrade is abnormal and records it, and sends a security alarm through the network. At the same time, it is prohibited to operate the device by OTA until the risk relief process Unlock.
  • a security verification instruction a is sent to the device, the device generates a response instruction H, and returns the response instruction H.
  • the response instruction of the firmware upgrade package V1.0 corresponding to the security verification instruction a is B, then the preset response instruction is B.
  • An embodiment of the present invention proposes a method for safely upgrading firmware, which is used to upgrade the firmware of a device, and is particularly suitable for a situation where the firmware is upgraded using the OBD interface method.
  • S21 Receive the firmware flashing instruction of the device to be upgraded, and enter the monitoring mode.
  • monitor the flashing instruction in the CAN bus or the local area network where the device is located and after listening to the firmware flashing instruction of the device to be upgraded, enter the monitoring mode to monitor the flashing progress of the firmware.
  • the online diagnostic instrument receives the firmware upgrade package, uses the secret key and digital certificate, decrypts and signs the received firmware upgrade package, and uses the firmware upgrade package to flash the firmware according to the flash protocol, and loads the firmware upgrade package to the corresponding In the storage module, the firmware version information is updated to the version number of the firmware upgrade package.
  • the firmware upgrade package is encrypted and a digital signature is added to ensure the security of the firmware upgrade package itself.
  • the encryption algorithm and signature algorithm may be any achievable algorithms in the prior art, and the present invention does not limit this.
  • the decryption algorithm and signature verification are executed, wherein the decryption algorithm and the encryption algorithm correspond, and the signature verification process corresponds to the signature process.
  • the firmware upgrade package is pre-built with a response algorithm that generates a corresponding response instruction for the security verification instruction.
  • a response for generating the corresponding response instruction for the security verification instruction is written in advance
  • the logic of the algorithm implements the program for subsequent security verification.
  • the response algorithm has different response instructions for different versions of the firmware upgrade package and responds to the same security verification instruction a or b, as shown in Table 1. That is, in response to the same security verification instruction a, the response instruction of the firmware upgrade package version V1.0 is B, the response instruction of the firmware upgrade package version V2.0 is C, and the response of the firmware upgrade package version V3.0 The instruction is D; in response to the same security check instruction b, the response instruction of the firmware upgrade package version V1.0 is X, the response instruction of the firmware upgrade package version V2.0 is Y, and the firmware upgrade package version V3.0 The response command is Z. Therefore, the different versions V1.0, V2.0, and V3.0 of the firmware upgrade package and their security verification commands and response commands have a unique correspondence shown in Table 1.
  • the device needs to return the response instruction and the version number of the firmware upgrade package after receiving the security verification instruction.
  • the device uses a preset response algorithm in the flashed firmware upgrade package to send a corresponding response instruction for the version of the flashed firmware upgrade package.
  • the version number of the firmware upgrade package is received, so that it can be based on the received firmware upgrade package Version number, using the above-mentioned response algorithm related to the version of the firmware upgrade package to obtain a preset response command, that is, the response command in Table 1 associated with the version of the firmware upgrade package and the security verification command, so as to facilitate the subsequent step S24 Compare with the response command sent by the device.
  • the response instruction is a preset response instruction
  • the response instruction sent by the device is compared with a preset response instruction in a response algorithm preset in the firmware upgrade package stored in advance.
  • the preset response instruction is the above-mentioned response instruction associated with the version of the firmware upgrade package and the security verification instruction.
  • the response instruction sent by the device is generated by the device according to the preset response algorithm in the firmware upgrade package that has been written, the response instruction sent by the device is preset in the firmware upgrade package stored in advance If the preset response command in the response algorithm is the same, it is determined that the firmware is safely upgraded; if the response command sent by the device is different from the preset response command in the response algorithm preset in the firmware upgrade package stored in advance, it indicates There is a security risk in the firmware upgrade package written by the corresponding firmware. It is determined that the firmware upgrade is abnormal and recorded, and a security alarm is sent through the network. At the same time, it is prohibited to use OBD to operate the device until it is unlocked by the risk removal process.
  • the device After the device completes the flashing of the firmware upgrade package V1.0, it sends a security verification instruction a to the device, and the device generates a response instruction H, and the response instruction H and the firmware upgrade package Version number V1.0 will be sent back.
  • the response instruction of the firmware upgrade package V1.0 corresponding to the security verification instruction a is B, then the preset response instruction is B.
  • its firmware safety upgrade system includes a firmware generation server, a diagnostic instrument, a safety chip module ESU in the vehicle, and an electronic unit ECU to be flashed for upgrade.
  • the terminal algorithm is the response algorithm in Embodiment 3 of the present invention, and the in-vehicle security chip module ESU executes the steps of the firmware security upgrade method described in Embodiment 3 of the present invention.
  • the response algorithm may be as shown in Table 1.
  • the challenge-end algorithm has only one security verification command AAA. For example, for the version 1.1 firmware, when the security verification command AAA is received, the response response command BBB is fed back.
  • the firmware generation server sends the challenge-end algorithm to the security chip module ESU in the car, and the security chip module ESU in the car stores the challenge-end algorithm in advance.
  • a firmware package for upgrade is generated in the firmware generation server, that is, the firmware upgrade package in Embodiment 1 of the present invention, and the challenge-end algorithm is preset in the upgraded firmware package.
  • the challenge-end algorithm in this example only has one security check instruction AAA
  • the challenge-end algorithm is preset in the upgraded firmware package by specifically inserting a hardcode challenge corresponding tag in the upgraded firmware package, for example, For firmware version V1.1, when receiving the security verification command AAA, the feedback response command BBB is fed back.
  • the diagnostic apparatus obtains the upgraded firmware package from the firmware generation server, for example, the firmware package of the V1.1 version.
  • the diagnostic instrument is physically connected to the OBD interface of the vehicle to flash the firmware of the electronic component ECU.
  • the diagnostic apparatus uses the upgraded firmware package to flash the firmware of the electronic unit ECU to be flashed according to the flash protocol.
  • the electronic unit ECU runs the new firmware.
  • the security chip module ESU in the vehicle monitors the flash command in the CAN bus or the local area network of the vehicle, and after listening to the firmware flash command of the electronic unit ECU to be updated, enters the monitoring mode to monitor The flashing progress of the firmware.
  • the safety chip module ESU in the vehicle monitors that the electronic unit ECU has completed the flashing of the upgraded firmware package, it initiates a challenge-end algorithm to the electronic unit ECU and sends a safety verification instruction to the electronic unit ECU AAA.
  • the electronic unit ECU After receiving the security verification command AAA sent by the security chip module ESU in the vehicle, the electronic unit ECU sends a response command and the version number V1.1 of the upgraded firmware package to the security chip module ESU.
  • the safety chip module ESU in the vehicle obtains a preset response command BBB expecting feedback using the pre-stored challenge-end algorithm according to the version number V1.1 of the firmware package sent by the electronic unit ECU.
  • the security chip module ESU in the vehicle determines that the response is normal, and the firmware upgrade of the electronic unit ECU is successful. If the electronic unit ECU sends a response command to the security chip module ESU that is different from the preset response command BBB, the security chip module ESU in the vehicle determines that the response is abnormal, and the firmware package written by the electronic unit ECU is safe Risk, determine and record the firmware upgrade abnormality, the security chip module ESU sends a security alarm to the vehicle and/or firmware generation server via the network, and prohibits the use of OTA to operate the vehicle.
  • the embodiment of the present invention proposes a firmware safety upgrading device, which is used to upgrade the firmware of a device, and is particularly suitable for the case of using the OBD interface to upgrade the firmware.
  • the device may be a car, as shown in FIG. 6, including a monitoring module , Security check instruction sending module, response instruction receiving module and judgment module. among them,
  • the monitoring module receives the firmware flashing instruction of the device to be upgraded and enters the monitoring mode.
  • monitor the flashing instruction in the CAN bus or the local area network where the device is located and after listening to the firmware flashing instruction of the device to be upgraded, enter the monitoring mode to monitor the flashing progress of the firmware.
  • the online diagnostic instrument receives the firmware upgrade package, uses the secret key and digital certificate, decrypts and signs the received firmware upgrade package, and uses the firmware upgrade package to flash the firmware according to the flash protocol, and loads the firmware upgrade package to the corresponding In the storage module, the firmware version information is updated to the version number of the firmware upgrade package.
  • the firmware upgrade package is encrypted and a digital signature is added to ensure the security of the firmware upgrade package itself.
  • the encryption algorithm and signature algorithm may be any achievable algorithms in the prior art, and the present invention does not limit this.
  • the decryption algorithm and signature verification are executed, wherein the decryption algorithm corresponds to the encryption algorithm, and the signature verification process corresponds to the signature process.
  • the firmware upgrade package is pre-built with a response algorithm that generates a corresponding response instruction for the security verification instruction.
  • a response for generating the corresponding response instruction for the security verification instruction is written in advance
  • the logic of the algorithm implements the program for subsequent security verification.
  • the response algorithm has different response instructions for different versions of the firmware upgrade package and responds to the same security verification instruction a or b, as shown in Table 1. That is, in response to the same security verification instruction a, the response instruction of the firmware upgrade package version V1.0 is B, the response instruction of the firmware upgrade package version V2.0 is C, and the response of the firmware upgrade package version V3.0 The instruction is D; in response to the same security check instruction b, the response instruction of the firmware upgrade package version V1.0 is X, the response instruction of the firmware upgrade package version V2.0 is Y, and the firmware upgrade package version V3.0 The response command is Z. Therefore, the different versions V1.0, V2.0, and V3.0 of the firmware upgrade package and their security verification commands and response commands have a unique correspondence shown in Table 1.
  • the security verification instruction sending module sends the security verification instruction to the device.
  • the device needs to return the response instruction and the version number of the firmware upgrade package after receiving the security verification instruction.
  • the device uses a preset response algorithm in the flashed firmware upgrade package to send a corresponding response instruction for the version of the flashed firmware upgrade package.
  • the response instruction receiving module receives the response instruction sent by the device based on the security verification instruction.
  • the response instruction receiving module receives the version number of the firmware upgrade package while receiving the response instruction sent by the device, so that the judgment module can be obtained
  • the preset answer command used.
  • a preset response instruction can be obtained, that is, the version in Table 1 associated with the firmware upgrade package version and the security verification instruction Respond to instructions.
  • the judgment module when the response instruction is a preset response instruction, sends a message of successful upgrade to complete the firmware upgrade. Specifically, after receiving the response instruction sent by the device, the judgment module compares the response instruction sent by the device with a preset response instruction in a response algorithm preset in the firmware upgrade package stored in advance.
  • the preset response instruction is the above-mentioned response instruction associated with the version of the firmware upgrade package and the security verification instruction.
  • the response instruction sent by the device is generated by the device according to the preset response algorithm in the firmware upgrade package that has been written, the response instruction sent by the device is preset in the firmware upgrade package stored in advance If the preset response command in the response algorithm is the same, the judgment module determines that the firmware is safely upgraded; if the response command sent by the device is different from the preset response command in the response algorithm preset in the firmware upgrade package, It indicates that there is a security risk in the firmware upgrade package written by the corresponding firmware. The judgment module determines that the firmware upgrade is abnormal and records it, and sends a security alarm through the network. At the same time, it is forbidden to use OBD to operate the device until it is unlocked by the risk removal process.
  • the device After the device completes the flashing of the firmware upgrade package V1.0, it sends a security verification instruction a to the device, and the device generates a response instruction H, and the response instruction H and the firmware upgrade package Version number V1.0 will be sent back.
  • the response instruction of the firmware upgrade package V1.0 corresponding to the security verification instruction a is B, then the preset response instruction is B.
  • the judgment module After receiving the response instruction H sent by the device based on the security verification instruction a and the version number V1.0 of the firmware upgrade package, the judgment module sends the response instruction H sent by the device and the firmware upgrade package V1 stored in advance
  • An embodiment of the present invention further proposes a vehicle-mounted system that is built with the OTA remote upgrade-based firmware security upgrade device according to Embodiment 2 of the present invention and/or based on the OBD interface method according to Embodiment 4 of the present invention.
  • An upgraded firmware safety upgrade device The firmware safety upgrade device controls the vehicle to perform firmware upgrade to ensure that the firmware is safely upgraded.
  • An embodiment of the present invention further proposes a vehicle including the on-board system as described above, so that the vehicle has a function of firmware safety upgrade.
  • An embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps of the above method are implemented.
  • An embodiment of the present invention also provides a computer device, including a memory, a processor, and a computer program stored on the memory and executable on the processor.
  • the processor implements the program and implements the steps of the foregoing method.
  • a "computer-readable medium” may be any device that can contain, store, communicate, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device.
  • computer-readable media include the following: electrical connections (electronic devices) with one or more wires, portable computer cartridges (magnetic devices), random access memory (RAM), Read only memory (ROM), erasable and editable read only memory (EPROM or flash memory), fiber optic devices, and portable compact disk read only memory (CDROM).
  • the computer-readable medium may even be paper or other suitable medium on which the program can be printed, because, for example, by optically scanning the paper or other medium, followed by editing, interpretation, or other appropriate if necessary Process to obtain the program electronically and then store it in computer memory.
  • each part of the present invention may be implemented by hardware, software, firmware, or a combination thereof.
  • multiple steps or methods may be implemented in software or firmware stored in memory and executed by a suitable instruction execution system.
  • a logic gate circuit for implementing a logic function on a data signal
  • PGA programmable gate arrays
  • FPGA field programmable gate arrays

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Stored Programmes (AREA)

Abstract

本发明涉及一种固件安全升级方法、装置、车载***和车辆。所述方法包括对接收的固件升级包进行解密和签名校验；基于所述固件升级包向相应的待升级设备发送固件刷写指令；基于接收的所述设备发送的刷写成功指令，向所述设备发送安全校验指令；接收所述设备基于所述安全校验指令发送的应答指令并验证；当所述应答指令为预设应答指令时，发送升级成功的消息以完成固件升级。本发明实施例的技术方案可适用于空中升级和OBD接口升级，通过检查发布的固件和升级后运行的固件的一致性，解决了绕开升级通道的安全限制而非法写入固件包的安全问题。

Description

固件安全升级方法、装置、车载***和车辆 技术领域
本发明属于信息安全技术领域，具体涉及一种固件安全升级方法、装置、车载***和车辆。
背景技术
固件就是写入EROM或EEPROM中的程序，是设备内部保存的“驱动程序”。通过固件，操作***才能按照标准的设备驱动实现特定机器的运行动作。固件升级是指对设备的内嵌固件进行升级，可以完善设备功能、增强稳定性、修补漏洞。
现有技术中，设备中用于固件升级的接口都存在被攻击者恶意利用的风险。攻击者可能劫持固件升级的通道，将自制的固件升级包刷写进去，由此控制设备的相应模块乃至在CAN总线中控制整台设备，实现例如盗取设备控制权、盗取数据等目的。因此，对于例如智能汽车等对于安全性要求极高的场合，固件升级的安全性显得非常重要，应避免智能汽车的控制器通过非法固件升级的方式被盗取。
为了保证设备的固件升级的安全性，通常能够在固件升级包刷写流程中确保原始固件升级包不被篡改，但不能监控设备中后续实际运行的固件升级包是否是刷写到设备中的原始固件升级包，不能针对固件升级包版本进行安全性校验，即，攻击者可能绕开升级通道的安全限制，在设备中刷写自制的固件升级包并运行，存在安全隐患。
此外，对于通过物理接口接入总线刷写固件升级包的情况，例如通过OBD口接入总线刷写固件升级包，可以绕过了大部分安全检测机制，刷写攻击者自制的固件升级包。如果攻击者恶意通过上述方法刷写固件，而设备内尚无相应的检测机制和报警机制，用户无法察觉。
发明内容
为了解决上述固件升级安全性低的技术问题，本发明提出了一种固件安全升级方法、装置、车载***和车辆。
一方面，本发明一实施例提出一种固件安全升级方法，包括如下步骤：
对接收的固件升级包进行解密和签名校验；
基于所述固件升级包向相应的待升级设备发送固件刷写指令；
基于接收的所述设备发送的刷写成功指令，向所述设备发送安全校验指令；
接收所述设备基于所述安全校验指令发送的应答指令并验证；
当所述应答指令为预设应答指令时，发送升级成功的消息以完成固件升级。
进一步，所述固件升级包中预先内置有针对安全校验指令生成相应应答指令的应答算法，其中固件升级包的不同版本对应相同的安全校验指令和不同的应答指令，且所述固件升级包的不同版本与其安全校验指令及应答指令存在唯一对应关系。
进一步，所述接收的固件升级包进行解密和签名校验步骤中，当所述签名校验成功后，记录固件升级包的版本号。
进一步，在所述应答指令验证步骤中，如果所述设备发送的应答指令与预先存储的所接收的固件升级包中预置的应答算法中的预设应答指令相同，则确定固件安全升级；如果所述设备发送的应答指令与预先存储的所接收的固件升级包中预置的应答算法中的预设应答指令不同，则确定固件升级异常。
进一步，在固件升级包刷写过程中，对所述设备进行安全检测，以确保固件升级过程中的安全性。
进一步，当所述应答指令与所述预设应答指令不一致时，发送异常告警。
另一方面，本发明另一实施例提出一种固件安全升级装置，所述固件安全升级装置包括固件升级包获取模块、固件刷写指令发送模块、安全校验指令发送模块、应答指令接收模块和判断模块，其中，
固件升级包获取模块对接收的固件升级包进行解密和签名校验；
固件刷写指令发送模块基于所述固件升级包向相应的待升级设备发送固件刷写指令；
安全校验指令发送模块基于接收的所述设备发送的刷写成功指令，向所述设备发送安全校验指令；
应答指令接收模块接收所述设备基于所述安全校验指令发送的应答指令；
判断模块在所述应答指令为预设应答指令时发送升级成功的消息以完成固件升级。
再一方面，本发明再一实施例提出一种固件安全升级方法，包括以下步骤：
接收对待升级设备的固件刷写指令，进入监听模式；
监听到待升级设备的固件升级包刷写成功指令后，向所述设备发送安全校验指令；
接收所述设备基于所述安全校验指令发送的应答指令并验证；
当所述应答指令为预设应答指令时，发送升级成功的消息以完成固件升级。
进一步，所述固件升级包中预先内置有针对安全校验指令生成相应应答指令的应答算法，其中固件升级包的不同版本对应相同的安全校验指令和不同的应答指令，且所述固件升级包的不同版本与其安全校验指令及应答指令存在唯一对应关系。
进一步，接收所述设备发送的应答指令的同时，接收所述固件升级包的版本号。
进一步，在所述应答指令验证步骤中，如果所述设备发送的应答指令与预先存储的所述固件升级包中预置的应答算法中的预设应答指令相同，则确定固件安全升级；如果所述设备发送的应答指令与预先存储的所述固件升级包中预置的应答算法中的预设应答指令不同，则确定固件升级异常。
进一步，当所述应答指令与所述预设应答指令不一致时，发送异常告警。
又一方面，本发明又一实施例提出一种固件安全升级装置，其特征在于，所述固件安全升级装置包括监听模块、安全校验指令发送模块、应答指令接收模块和判断模块，其中，
监听模块，接收对待升级设备的固件刷写指令，进入监听模式；
安全校验指令发送模块，在监听模块监听到所述设备的刷写成功指令后，向所述设备发送安全校验指令；
应答指令接收模块，接收所述设备基于所述安全校验指令发送的应答指令；
判断模块，当所述应答指令为预设应答指令时，发送升级成功的消息以完成固件升级。
本发明另一实施例还提出一种车载***，所述车载***内置有如上所述的固件安全升级装置的至少一 个。
本发明另一实施例还提出一种车辆，所述车辆包括如上所述的车载***。
本发明的有益效果：本发明实施例提出的固件安全升级方法、装置、车载***和车辆，适用于空中升级(OTA)和OBD接口升级，通过预先将预设的应答算法打包在固件升级包中，在设备完成固件刷写后，发送安全验证校验指令，以通过校验所述应答算法生成的应答指令进行安全验证，从而实现通过检查发布的固件和升级后运行的固件的一致性，解决绕开升级通道的安全限制而非法写入固件包的安全问题。
附图说明
图1是本发明实施例1提出的一种固件安全升级方法的流程图；
图2是应用本发明实施例1的固件安全升级方法的***原理图；
图3是本发明实施例2提出的一种固件安全升级装置的方框图；
图4是本发明实施例3提出的一种固件安全升级方法的流程图；
图5是应用本发明实施例3的固件安全升级方法的***原理图；
图6是本发明实施例4提出的一种固件安全升级装置的方框图。
具体实施方式
为使本发明的目的、技术方案和优点更加清楚明白，以下结合具体实施例，并参照附图，对本发明进一步详细说明。但本领域技术人员知晓，本发明并不局限于附图和以下实施例。
实施例1：
本发明实施例提出了一种固件安全升级方法，用于对设备进行固件升级，尤其适用于采用OTA(Over-the-Air)方式进行远程固件升级的情形，所述设备可以是汽车，如图1所示，包括如下步骤：
S11，对接收的固件升级包进行解密和签名校验；所述固件升级包在打包过程中，对固件升级包进行加密和添加数字签名，以确保固件升级包本身的安全性。其中，所述加密算法和签名算法可以是现有技术中任意可实现算法，本发明对此不做限制。当接收到固件升级包后，执行解密算法和签名校验，其中所述解密算法和加密算法相对应，签名校验过程与所述签名过程相对应。
进一步的，所述固件升级包中预先内置有针对安全校验指令生成相应应答指令的应答算法，在对固件升级包进行打包的过程中，预先写入针对安全校验指令生成相应应答指令的应答算法的逻辑实现程序，以进行后续的安全校验。其中所述固件升级包的不同版本对应相同的安全校验指令和不同的应答指令，且所述固件升级包的不同版本与其安全校验指令及应答指令存在唯一对应关系。
例如，所述应答算法针对不同的固件升级包的版本，响应于相同的安全校验指令a或b，具有不同的应答指令，如表1所示：
固件升级包的版本 安全校验指令 应答指令
V1.0 a B
V2.0 a C
V3.0 a D
V1.0 b X
V2.0 b Y
V3.0 b Z
表1
即，响应于相同的安全校验指令a，固件升级包的版本V1.0的应答指令为B，固件升级包的版本V2.0的应答指令为C，固件升级包的版本V3.0的应答指令为D；响应于相同的安全校验指令b，固件升级包的版本V1.0的应答指令为X，固件升级包的版本V2.0的应答指令为Y，固件升级包的版本V3.0的应答指令为Z。因此，固件升级包的不同版本V1.0、V2.0、V3.0与其安全校验指令及应答指令存在表1所示的唯一对应关系。
基于上述应答算法，在步骤S11中，当所述签名校验成功后，记录固件升级包的版本号，从而能够根据所记录的固件升级包的版本号，使用上述与固件升级包的版本相关的应答算法，得到预设应答指令，在本实施例中即为表1中与固件升级包的版本和安全校验指令关联的应答指令，以便于在后续步骤S15中与设备发送的应答指令进行比较。
S12，基于所述固件升级包向相应的待升级设备发送固件刷写指令；
当所述解密和签名校验过程成功后，获的所述固件升级包，基于该固件升级包向相应的待升级设备发送固件刷写指令，以启动固件刷写流程。
所述待升级设备根据刷写协议使用固件升级包进行固件刷写，将固件升级包加载至对应的存储模块中，并将固件的版本信息更新为固件升级包的版本。
在固件升级包刷写过程中，对所述设备进行安全检测，以确保固件升级过程中的安全性。检测内容包括设备内网中是否有劫持和/或篡改的干扰数据包、被刷写的器件是否处于正常的工况、以及所述设备是否存在异常的网络连接，例如攻击者的连接。如果存在上述情况之一，则可停止刷写当前版本的固件升级包，并恢复之前的固件版本。
在完成固件刷写后，所述设备发送刷写成功指令。
S13，基于接收的所述设备发送的刷写成功指令，向所述设备发送安全校验指令；
所述设备接收到安全校验指令，使用已刷写的固件升级包中的预置应答算法，针对已刷写的固件升级包的版本，发送相应的应答指令。
S14，接收所述设备基于所述安全校验指令发送的应答指令并验证；
S15，当所述应答指令为预设应答指令时，发送升级成功的消息以完成固件升级。
具体的，在接收到所述设备发送的应答指令后，将所述设备发送的应答指令与预先存储的所接收的固件升级包中预置的应答算法中的预设应答指令进行比较。在本实施例中，所述预设应答指令为上述与固件升级包的版本和安全校验指令关联的应答指令。如果所述设备发送的应答指令是所述设备根据已所刷写的固件升级包中预设的应答算法生成的，则所述设备发送的应答指令与预先存储的所接收的固件升级包中预置的应答算法中的预设应答指令相同，则确定固件安全升级；如果所述设备发送的应答指令与预先存储的 所接收的固件升级包中预置的应答算法中的预设应答指令不同，则表明相应固件所刷写的固件升级包存在安全风险，确定固件升级异常并进行记录，并通过网络发送安全告警，同时禁止采用OTA方式对设备进行操作，直到由风险解除流程进行解锁。
例如，在所述设备完成了固件升级包V1.0的刷写后，将一个安全校验指令a发送给所述设备，所述设备生成应答指令H，并将应答指令H进行回传。
根据预先存储的所接收的固件升级包中预置的应答算法，与安全校验指令a对应的固件升级包V1.0的应答指令为B，则所述预设应答指令为B。
接收所述设备基于所述安全校验指令a发送的应答指令H后，将所述设备发送的应答指令H与预先存储的所接收的固件升级包V1.0中预置的应答算法中的预设应答指令B进行比较。如果H＝B，则确定固件安全升级；如果H≠B，确定固件升级异常并进行记录，并通过网络发送安全告警，同时禁止采用OTA方式对设备进行操作，直到由风险解除流程进行解锁。
以下，以采用OTA方式对车辆进行远程固件升级为例，对本发明实施例1的固件安全升级方法进行说明。
如图2所示，其固件安全升级***包括空中升级的OTA服务器、车内的安全芯片模块ESU和待刷写升级的电子单元ECU，所述OTA服务器中存储有挑战响应的Tag的挑战端算法即，本发明实施例1中的应答算法，所述车内安全芯片模块ESU执行本发明实施例1所述的固件安全升级方法的步骤。当有多个的安全校验指令时，所述应答算法可如表1所示。在本示例中，所述挑战端算法仅有一个安全校验指令AAA，例如，对于V1.1版本的固件，当接收到安全校验指令AAA时，反馈应答指令BBB。
第一步，OTA服务器将所述挑战端算法发送给所述车内的安全芯片模块ESU，所述车内的安全芯片模块ESU预先存储所述挑战端算法。
第二步，在空中升级的OTA服务器中具有或生成用于升级的固件包，即本发明实施例1中的固件升级包，在升级的固件包中预置所述挑战端算法。
由于本示例中的挑战端算法仅有一个安全校验指令AAA，所以在升级的固件包中预置所述挑战端算法具体为在升级的固件包中打入一个hardcode的挑战相应Tag，例如，对于V1.1版本的固件，当接收到安全校验指令AAA时，反馈应答指令BBB。
第三步，车内的安全芯片模块ESU获取升级的固件包，将其下载到车内的安全芯片模块ESU，进行解密和签名校验。如果校验通过，则车内的安全芯片模块ESU记录所述升级的固件包的版本号，例如V1.1，并发送固件刷写指令。
第四步，车内的安全芯片模块ESU或其他刷写控制部件根据刷写协议使用所述升级的固件包对待刷写升级的电子单元ECU进行固件刷写。固件刷写成功后，电子单元ECU运行新固件。
第五步，车内的安全芯片模块ESU根据记录的所述升级的固件包的版本号V1.1，发起挑战端算法，向所述电子单元ECU发送安全校验指令AAA(期待反馈预设应答指令BBB)。
第六步，所述电子单元ECU接收到车内的安全芯片模块ESU发送的安全校验指令AAA后，向安全芯片模块ESU发送应答指令。
如果所述电子单元ECU向车内的安全芯片模块ESU发送应答指令为预设应答指令BBB时，则所述车内 的安全芯片模块ESU确定应答正常，所述电子单元ECU的固件升级成功。如果所述电子单元ECU向安全芯片模块ESU发送应答指令不同于预设应答指令BBB时，则所述车内的安全芯片模块ESU确定应答异常，所述电子单元ECU所刷写的固件包存在安全风险，确定固件升级异常并进行记录，所述安全芯片模块ESU通过网络向车辆和/或OTA服务器发送安全告警，同时禁止采用OTA方式对车辆进行操作。
实施例2：
本发明实施例提出了一种固件安全升级装置，用于对设备进行固件升级，尤其适用于采用OTA(Over-the-Air)方式进行远程固件升级的情形，所述设备可以是汽车，如图3所示，包括固件升级包获取模块、固件刷写指令发送模块、安全校验指令发送模块、应答指令接收模块和判断模块。
固件升级包获取模块，对接收的固件升级包进行解密和签名校验。所述固件升级包在打包过程中，对固件升级包进行加密和添加数字签名，以确保固件升级包本身的安全性。其中，所述加密算法和签名算法可以是现有技术中任意可实现算法，本发明对此不做限制。当接收到固件升级包后，执行解密算法和签名校验，其中所述解密算法和加密算法相对应，签名校验过程与所述签名过程相对应。
进一步的，所述固件升级包中预先内置有针对安全校验指令生成相应应答指令的应答算法，在对固件升级包进行打包的过程中，预先写入针对安全校验指令生成相应应答指令的应答算法的逻辑实现程序，以进行后续的安全校验。其中所述固件升级包的不同版本对应相同的安全校验指令和不同的应答指令，且所述固件升级包的不同版本与其安全校验指令及应答指令存在唯一对应关系。
例如，所述应答算法针对不同的固件升级包的版本，响应于相同的安全校验指令a或b，具有不同的应答指令，如表1所示。即，响应于相同的安全校验指令a，固件升级包的版本V1.0的应答指令为B，固件升级包的版本V2.0的应答指令为C，固件升级包的版本V3.0的应答指令为D；响应于相同的安全校验指令b，固件升级包的版本V1.0的应答指令为X，固件升级包的版本V2.0的应答指令为Y，固件升级包的版本V3.0的应答指令为Z。因此，固件升级包的不同版本V1.0、V2.0、V3.0与其安全校验指令及应答指令存在表1所示的唯一对应关系。
基于上述应答算法，当所述签名校验成功后，固件升级包获取模块记录固件升级包的版本号，以便能够得到判断模块使用的预设应答指令。根据所记录的固件升级包的版本号，使用上述与固件升级包的版本相关的应答算法，即可得到所述预设应答指令，在本实施例中即为表1中与固件升级包的版本和安全校验指令关联的应答指令。
固件刷写指令发送模块，基于所述固件升级包向相应的待升级设备发送固件刷写指令。
当所述解密和签名校验过程成功后，获的所述固件升级包，基于该固件升级包向相应的待升级设备发送固件刷写指令，以启动固件刷写流程。
所述待升级设备根据刷写协议使用固件升级包进行固件刷写，将固件升级包加载至对应的存储模块中，并将固件的版本信息更新为固件升级包的版本。
在固件升级包刷写过程中，固件刷写指令发送模块对所述设备进行安全检测，以确定固件升级过程中的安全性。检测内容包括设备内网中是否有劫持和/或篡改的干扰数据包、被刷写的固件是否处于正常的工况、以及所述设备是否存在异常的网络连接，例如攻击者的连接。如果存在上述情况之一，则可停止刷 写当前版本的固件升级包，并恢复之前的固件版本。
在完成固件刷写后，所述设备发送刷写成功指令。
安全校验指令发送模块，基于接收的所述设备发送的刷写成功指令，向所述设备发送安全校验指令。所述设备接收到安全校验指令，使用已刷写的固件升级包中的预置应答算法，针对已刷写的固件升级包的版本，发送相应的应答指令。
应答指令接收模块，接收所述设备基于所述安全校验指令发送的应答指令。
判断模块，当所述应答指令为预设应答指令时，发送升级成功的消息以完成固件升级。具体的，在接收到所述设备发送的应答指令后，判断模块将所述设备发送的应答指令与预先存储的所接收的固件升级包中预置的应答算法中的预设应答指令进行比较。在本实施例中，所述预设应答指令为上述与固件升级包的版本和安全校验指令关联的应答指令。如果所述设备发送的应答指令是所述设备根据已所刷写的固件升级包中预设的应答算法生成的，则所述设备发送的应答指令与预先存储的所接收的固件升级包中预置的应答算法中的预设应答指令相同，则判断模块确定固件安全升级；如果所述设备发送的应答指令与预先存储的所接收的固件升级包中预置的应答算法中的预设应答指令不同，则表明相应固件所刷写的固件升级包存在安全风险，判断模块确定固件升级异常并进行记录，并通过网络发送安全告警，同时禁止采用OTA方式对设备进行操作，直到由风险解除流程进行解锁。
例如，在所述设备完成了固件升级包V1.0的刷写后，将一个安全校验指令a发送给所述设备，所述设备生成应答指令H，并将应答指令H进行回传。
根据预先存储的所接收的固件升级包中预置的应答算法，与安全校验指令a对应的固件升级包V1.0的应答指令为B，则所述预设应答指令为B。
判断模块接收所述设备基于所述安全校验指令a发送的应答指令H后，将所述设备发送的应答指令H与预先存储的所接收的固件升级包V1.0中预置的应答算法中的预设应答指令B进行比较。如果H＝B，则确定固件安全升级；如果H≠B，确定固件升级异常并进行记录，并通过网络发送安全告警，同时禁止采用OTA方式对设备进行操作，直到由风险解除流程进行解锁。
实施例3：
本发明实施例提出了一种固件安全升级方法，用于对设备进行固件升级，尤其适用于采用OBD接口方式进行固件升级的情形，如图4所示，包括如下步骤：
S21，接收对待升级设备的固件刷写指令，进入监听模式。
具体的，监听CAN总线或设备所在局域网中的刷写指令，在监听到对待升级设备的固件刷写指令后，进入监听模式，以监听固件的刷写进度。
在线诊断仪接收固件升级包，使用秘钥和数字证书，对接收的固件升级包进行解密和签名校验，并根据刷写协议使用固件升级包进行固件刷写，将固件升级包加载至对应的存储模块中，并将固件的版本信息更新为固件升级包的版本号。其中，所述固件升级包在打包过程中，对固件升级包进行加密和添加数字签名，以确保固件升级包本身的安全性。其中，所述加密算法和签名算法可以是现有技术中任意可实现算法，本发明对此不做限制。当接收到固件升级包后，执行解密算法和签名校验，其中所述解密算法和加密算法 相对应，签名校验过程与所述签名过程相对应。
进一步的，所述固件升级包中预先内置有针对安全校验指令生成相应应答指令的应答算法，在对固件升级包进行打包的过程中，预先写入针对安全校验指令生成相应应答指令的应答算法的逻辑实现程序，以进行后续的安全校验。其中所述固件升级包的不同版本对应相同的安全校验指令和不同的应答指令，且所述固件升级包的不同版本与其安全校验指令及应答指令存在唯一对应关系。
例如，所述应答算法针对不同的固件升级包的版本，响应于相同的安全校验指令a或b，具有不同的应答指令，如表1所示。即，响应于相同的安全校验指令a，固件升级包的版本V1.0的应答指令为B，固件升级包的版本V2.0的应答指令为C，固件升级包的版本V3.0的应答指令为D；响应于相同的安全校验指令b，固件升级包的版本V1.0的应答指令为X，固件升级包的版本V2.0的应答指令为Y，固件升级包的版本V3.0的应答指令为Z。因此，固件升级包的不同版本V1.0、V2.0、V3.0与其安全校验指令及应答指令存在表1所示的唯一对应关系。
S22，监听到所述设备的刷写成功指令后，向所述设备发送安全校验指令。
基于与固件升级包的版本相关的上述应答算法，所述设备接收到安全校验指令，需要回传应答指令以及所述固件升级包的版本号。正常情况下，所述设备使用已刷写的固件升级包中的预置应答算法，针对已刷写的固件升级包的版本，发送相应的应答指令。
S23，接收所述设备基于所述安全校验指令发送的应答指令并验证。
在本实施例中，基于与固件升级包的版本相关的上述应答算法，在接收所述设备发送的应答指令的同时，接收所述固件升级包的版本号，从而能够根据所接收的固件升级包的版本号，使用上述与固件升级包的版本相关的应答算法，得到预设应答指令，即，表1中与固件升级包的版本和安全校验指令关联的应答指令，以便于在后续步骤S24中与设备发送的应答指令进行比较。
S24，当所述应答指令为预设应答指令时，发送升级成功的消息以完成固件升级。具体的，在接收到所述设备发送的应答指令后，将所述设备发送的应答指令与预先存储的所述固件升级包中预置的应答算法中的预设应答指令进行比较。在本实施例中，所述预设应答指令为上述与固件升级包的版本和安全校验指令关联的应答指令。如果所述设备发送的应答指令是所述设备根据已所刷写的固件升级包中预设的应答算法生成的，则所述设备发送的应答指令与预先存储的所述固件升级包中预置的应答算法中的预设应答指令相同，则确定固件安全升级；如果所述设备发送的应答指令与预先存储的所述固件升级包中预置的应答算法中的预设应答指令不同，则表明相应固件所刷写的固件升级包存在安全风险，确定固件升级异常并进行记录，并通过网络发送安全告警，同时禁止采用OBD方式对设备进行操作，直到由风险解除流程进行解锁。
例如，在所述设备完成了固件升级包V1.0的刷写后，将一个安全校验指令a发送给所述设备，所述设备生成应答指令H，并将应答指令H和固件升级包的版本号V1.0进行回传。
根据预先存储的所述固件升级包中预置的应答算法，与安全校验指令a对应的固件升级包V1.0的应答指令为B，则所述预设应答指令为B。
接收所述设备基于所述安全校验指令a发送的应答指令H和固件升级包的版本号V1.0后，将所述设备发送的应答指令H与预先存储的所述固件升级包V1.0中预置的应答算法中的预设应答指令B进行比较。如果H＝B，则确定固件安全升级；如果H≠B，确定固件升级异常并进行记录，并通过网络发送安全告警， 同时禁止采用OBD方式对设备进行操作，直到由风险解除流程进行解锁。
以下，以采用OBD接口方式对车辆固件升级为例，对本发明实施例3的固件安全升级方法进行说明。
如图5所示，其固件安全升级***包括固件生成服务器、诊断仪、车内的安全芯片模块ESU和待刷写升级的电子单元ECU，所述固件生成服务器中存储有挑战响应的Tag的挑战端算法即，本发明实施例3中的应答算法，所述车内安全芯片模块ESU执行本发明实施例3所述的固件安全升级方法的步骤。当有多个的安全校验指令时，所述应答算法可如表1所示。在本示例中，所述挑战端算法仅有一个安全校验指令AAA，例如，对于V1.1版本的固件，当接收到安全校验指令AAA时，反馈应答指令BBB。
第一步，固件生成服务器将所述挑战端算法发送给所述车内的安全芯片模块ESU，所述车内的安全芯片模块ESU预先存储所述挑战端算法。
第二步，在固件生成服务器中生成用于升级的固件包，即本发明实施例1中的固件升级包，在升级的固件包中预置所述挑战端算法。
由于本示例中的挑战端算法仅有一个安全校验指令AAA，所以在升级的固件包中预置所述挑战端算法具体为在升级的固件包中打入一个hardcode的挑战相应Tag，例如，对于V1.1版本的固件，当接收到安全校验指令AAA时，反馈应答指令BBB。
第三步，所述诊断仪从固件生成服务器获取升级的固件包，例如V1.1版本的固件包。所述诊断仪以物理方式接入车辆的OBD接口，对电子元件ECU进行固件升级刷写。
第四步，所述诊断仪根据刷写协议使用所述升级的固件包对待刷写升级的电子单元ECU进行固件刷写。
固件刷写成功后，电子单元ECU运行新固件。
第五步，所述车内的安全芯片模块ESU监听CAN总线或车辆所在局域网中的刷写指令，在监听到对待刷写升级的电子单元ECU的固件刷写指令后，进入监听模式，以监听固件的刷写进度。
当所述车内的安全芯片模块ESU监听到所述电子单元ECU完成了升级的固件包的刷写后，向所述电子单元ECU发起挑战端算法，向所述电子单元ECU发送安全校验指令AAA。
第六步，所述电子单元ECU接收到车内的安全芯片模块ESU发送的安全校验指令AAA后，向安全芯片模块ESU发送应答指令以及所述升级的固件包的版本号V1.1。
所述车内的安全芯片模块ESU根据所述电子单元ECU发送的固件包的版本号V1.1，利用预先存储的所述挑战端算法，得到期待反馈的预设应答指令BBB。
如果所述电子单元ECU向车内的安全芯片模块ESU发送应答指令为预设应答指令BBB时，则所述车内的安全芯片模块ESU确定应答正常，所述电子单元ECU的固件升级成功。如果所述电子单元ECU向安全芯片模块ESU发送应答指令不同于预设应答指令BBB时，则所述车内的安全芯片模块ESU确定应答异常，所述电子单元ECU所刷写的固件包存在安全风险，确定固件升级异常并进行记录，所述安全芯片模块ESU通过网络向车辆和/或固件生成服务器发送安全告警，同时禁止采用OTA方式对车辆进行操作。
实施例4：
本发明实施例提出了一种固件安全升级装置，用于对设备进行固件升级，尤其适用于采用OBD接口方式进行固件升级的情形，所述设备可以是汽车，如图6所示，包括监听模块、安全校验指令发送模块、应 答指令接收模块和判断模块。其中，
监听模块，接收对待升级设备的固件刷写指令，进入监听模式。
具体的，监听CAN总线或设备所在局域网中的刷写指令，在监听到对待升级设备的固件刷写指令后，进入监听模式，以监听固件的刷写进度。
在线诊断仪接收固件升级包，使用秘钥和数字证书，对接收的固件升级包进行解密和签名校验，并根据刷写协议使用固件升级包进行固件刷写，将固件升级包加载至对应的存储模块中，并将固件的版本信息更新为固件升级包的版本号。其中，所述固件升级包在打包过程中，对固件升级包进行加密和添加数字签名，以确保固件升级包本身的安全性。其中，所述加密算法和签名算法可以是现有技术中任意可实现算法，本发明对此不做限制。当接收到固件升级包后，执行解密算法和签名校验，其中所述解密算法和加密算法相对应，签名校验过程与所述签名过程相对应。
进一步的，所述固件升级包中预先内置有针对安全校验指令生成相应应答指令的应答算法，在对固件升级包进行打包的过程中，预先写入针对安全校验指令生成相应应答指令的应答算法的逻辑实现程序，以进行后续的安全校验。其中所述固件升级包的不同版本对应相同的安全校验指令和不同的应答指令，且所述固件升级包的不同版本与其安全校验指令及应答指令存在唯一对应关系。
例如，所述应答算法针对不同的固件升级包的版本，响应于相同的安全校验指令a或b，具有不同的应答指令，如表1所示。即，响应于相同的安全校验指令a，固件升级包的版本V1.0的应答指令为B，固件升级包的版本V2.0的应答指令为C，固件升级包的版本V3.0的应答指令为D；响应于相同的安全校验指令b，固件升级包的版本V1.0的应答指令为X，固件升级包的版本V2.0的应答指令为Y，固件升级包的版本V3.0的应答指令为Z。因此，固件升级包的不同版本V1.0、V2.0、V3.0与其安全校验指令及应答指令存在表1所示的唯一对应关系。
在监听模块监听到所述设备的刷写成功指令后，安全校验指令发送模块向所述设备发送安全校验指令。
基于与固件升级包的版本相关的上述应答算法，所述设备接收到安全校验指令，需要回传应答指令以及所述固件升级包的版本号。正常情况下，所述设备使用已刷写的固件升级包中的预置应答算法，针对已刷写的固件升级包的版本，发送相应的应答指令。
应答指令接收模块，接收所述设备基于所述安全校验指令发送的应答指令。
在本实施例中，基于与固件升级包的版本相关的上述应答算法，应答指令接收模块在接收所述设备发送的应答指令的同时，接收所述固件升级包的版本号，以便能够得到判断模块使用的预设应答指令。根据所接收的固件升级包的版本号，使用上述与固件升级包的版本相关的应答算法，即可得到预设应答指令，即，表1中与固件升级包的版本和安全校验指令关联的应答指令。
判断模块，当所述应答指令为预设应答指令时，发送升级成功的消息以完成固件升级。具体的，在接收到所述设备发送的应答指令后，判断模块将所述设备发送的应答指令与预先存储的所述固件升级包中预置的应答算法中的预设应答指令进行比较。在本实施例中，所述预设应答指令为上述与固件升级包的版本和安全校验指令关联的应答指令。如果所述设备发送的应答指令是所述设备根据已所刷写的固件升级包中预设的应答算法生成的，则所述设备发送的应答指令与预先存储的所述固件升级包中预置的应答算法中的预设应答指令相同，则判断模块确定固件安全升级；如果所述设备发送的应答指令与预先存储的所述固件 升级包中预置的应答算法中的预设应答指令不同，则表明相应固件所刷写的固件升级包存在安全风险，判断模块确定固件升级异常并进行记录，并通过网络发送安全告警，同时禁止采用OBD方式对设备进行操作，直到由风险解除流程进行解锁。
例如，在所述设备完成了固件升级包V1.0的刷写后，将一个安全校验指令a发送给所述设备，所述设备生成应答指令H，并将应答指令H和固件升级包的版本号V1.0进行回传。
根据预先存储的所述固件升级包中预置的应答算法，与安全校验指令a对应的固件升级包V1.0的应答指令为B，则所述预设应答指令为B。
判断模块接收所述设备基于所述安全校验指令a发送的应答指令H和固件升级包的版本号V1.0后，将所述设备发送的应答指令H与预先存储的所述固件升级包V1.0中预置的应答算法中的预设应答指令B进行比较。如果H＝B，则确定固件安全升级；如果H≠B，确定固件升级异常并进行记录，并通过网络发送安全告警，同时禁止采用OBD方式对设备进行操作，直到由风险解除流程进行解锁。
本发明实施例还提出一种车载***，所述车载***内置有本发明实施例2所述的基于OTA远程升级的固件安全升级装置和/或本发明实施例4所述的基于OBD接口方式进行升级的固件安全升级装置，所述固件安全升级装置控制车辆进行固件升级，确保固件安全升级。
本发明实施例还提出一种车辆，所述车辆包括如上所述的车载***，从而使得所述车辆具有固件安全升级的功能。
本发明实施例还提出一种计算机可读存储介质，其上存储有计算机程序，该计算机程序被处理器执行时实现上述方法的步骤。
本发明实施例还提出一种计算机设备，包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，所述处理器执行所述程序时实现上述方法的步骤。
本领域技术人员可以理解，在流程图中表示或在此以其他方式描述的逻辑和/或步骤，例如，可以被认为是用于实现逻辑功能的可执行指令的定序列表，可以具体实现在任何计算机可读介质中，以供指令执行***、装置或设备(如基于计算机的***、包括处理器的***或其他可以从指令执行***、装置或设备取指令并执行指令的***)使用，或结合这些指令执行***、装置或设备而使用。就本说明书而言，“计算机可读介质”可以是任何可以包含、存储、通信、传播或传输程序以供指令执行***、装置或设备或结合这些指令执行***、装置或设备而使用的装置。
计算机可读介质的更具体的示例(非穷尽性列表)包括以下：具有一个或多个布线的电连接部(电子装置)，便携式计算机盘盒(磁装置)，随机存取存储器(RAM)，只读存储器(ROM)，可擦除可编辑只读存储器(EPROM或闪速存储器)，光纤装置，以及便携式光盘只读存储器(CDROM)。另外，计算机可读介质甚至可以是可在其上打印所述程序的纸或其他合适的介质，因为可以例如通过对纸或其他介质进行光学扫描，接着进行编辑、解译或必要时以其他合适方式进行处理来以电子方式获得所述程序，然后将其存储在计算机存储器中。
应当理解，本发明的各部分可以用硬件、软件、固件或它们的组合来实现。在上述实施方式中，多个步骤或方法可以用存储在存储器中且由合适的指令执行***执行的软件或固件来实现。例如，如果用硬件 来实现，和在另一实施方式中一样，可用本领域公知的下列技术中的任一项或它们的组合来实现：具有用于对数据信号实现逻辑功能的逻辑门电路的离散逻辑电路，具有合适的组合逻辑门电路的专用集成电路，可编程门阵列(PGA)，现场可编程门阵列(FPGA)等。
在本说明书的描述中，参考术语“一个实施例”、“一些实施例”、“示例”、“具体示例”、或“一些示例”等的描述意指结合该实施例或示例描述的具体特征、结构、材料或者特点包含于本发明的至少一个实施例或示例中。在本说明书中，对上述术语的示意性表述不一定指的是相同的实施例或示例。而且，描述的具体特征、结构、材料或者特点可以在任何的一个或多个实施例或示例中以合适的方式结合。
以上，对本发明的实施方式进行了说明。但是，本发明不限定于上述实施方式。凡在本发明的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。

Claims (15)

  1. 一种固件安全升级方法，其特征在于，包括如下步骤：
    对接收的固件升级包进行解密和签名校验；
    基于所述固件升级包向相应的待升级设备发送固件刷写指令；
    基于接收的所述设备发送的刷写成功指令，向所述设备发送安全校验指令；
    接收所述设备基于所述安全校验指令发送的应答指令并验证；
    当所述应答指令为预设应答指令时，发送升级成功的消息以完成固件升级。
  2. 如权利要求1所述的固件安全升级方法，其特征在于，所述固件升级包中预先内置有针对安全校验指令生成相应应答指令的应答算法，其中固件升级包的不同版本对应相同的安全校验指令和不同的应答指令，且所述固件升级包的不同版本与其安全校验指令及应答指令存在唯一对应关系。
  3. 如权利要求2所述的固件安全升级方法，其特征在于，所述接收的固件升级包进行解密和签名校验步骤中，当所述签名校验成功后，记录固件升级包的版本号。
  4. 如权利要求2所述的固件安全升级方法，其特征在于，在所述应答指令验证步骤中，如果所述设备发送的应答指令与预先存储的所接收的固件升级包中预置的应答算法中的预设应答指令相同，则确定固件安全升级；如果所述设备发送的应答指令与预先存储的所接收的固件升级包中预置的应答算法中的预设应答指令不同，则确定固件升级异常。
  5. 如权利要求1所述的固件安全升级方法，其特征在于，在固件升级包刷写过程中，对所述设备进行安全检测，以确保固件升级过程中的安全性。
  6. 如权利要求1所述的固件安全升级方法，其特征在于，进一步包括，当所述应答指令与所述预设应答指令不一致时，发送异常告警。
  7. 一种固件安全升级装置，其特征在于，所述固件安全升级装置包括固件升级包获取模块、固件刷写指令发送模块、安全校验指令发送模块、应答指令接收模块和判断模块，其中，
    固件升级包获取模块对接收的固件升级包进行解密和签名校验；
    固件刷写指令发送模块基于所述固件升级包向相应的待升级设备发送固件刷写指令；
    安全校验指令发送模块基于接收的所述设备发送的刷写成功指令，向所述设备发送安全校验指令；
    应答指令接收模块接收所述设备基于所述安全校验指令发送的应答指令；
    判断模块在所述应答指令为预设应答指令时发送升级成功的消息以完成固件升级。
  8. 一种固件安全升级方法，其特征在于，包括以下步骤：
    接收对待升级设备的固件刷写指令，进入监听模式；
    监听到待升级设备的固件升级包刷写成功指令后，向所述设备发送安全校验指令；
    接收所述设备基于所述安全校验指令发送的应答指令并验证；
    当所述应答指令为预设应答指令时，发送升级成功的消息以完成固件升级。
  9. 如权利要求8所述的固件安全升级方法，其特征在于，所述固件升级包中预先内置有针对安全校验指令生成相应应答指令的应答算法，其中固件升级包的不同版本对应相同的安全校验指令和不同的应答指 令，且所述固件升级包的不同版本与其安全校验指令及应答指令存在唯一对应关系。
  10. 如权利要求9所述的固件安全升级方法，其特征在于，接收所述设备发送的应答指令的同时，接收所述固件升级包的版本号。
  11. 如权利要求9所述的固件安全升级方法，其特征在于，在所述应答指令验证步骤中，如果所述设备发送的应答指令与预先存储的所述固件升级包中预置的应答算法中的预设应答指令相同，则确定固件安全升级；如果所述设备发送的应答指令与预先存储的所述固件升级包中预置的应答算法中的预设应答指令不同，则确定固件升级异常。
  12. 如权利要求9所述的固件安全升级方法，其特征在于，进一步包括，当所述应答指令与所述预设应答指令不一致时，发送异常告警。
  13. 一种固件安全升级装置，其特征在于，所述固件安全升级装置包括监听模块、安全校验指令发送模块、应答指令接收模块和判断模块，其中，
    监听模块，接收对待升级设备的固件刷写指令，进入监听模式；
    安全校验指令发送模块，在监听模块监听到所述设备的刷写成功指令后，向所述设备发送安全校验指令；
    应答指令接收模块，接收所述设备基于所述安全校验指令发送的应答指令；
    判断模块，当所述应答指令为预设应答指令时，发送升级成功的消息以完成固件升级。
  14. 一种车载***，其特征在于，所述车载***内置有如权利要求7和/或13所述的固件安全升级装置。
  15. 一种车辆，其特征在于，所述车辆包括如权利要求14所述的车载***。
PCT/CN2019/093435 2018-12-19 2019-06-28 固件安全升级方法、装置、车载***和车辆 WO2020124985A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP19901007.5A EP3889766B1 (en) 2018-12-19 2019-06-28 Secure firmware upgrade method, device, on-board system, and vehicle

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201811558091.5 2018-12-19
CN201811558091.5A CN109697081B (zh) 2018-12-19 2018-12-19 固件安全升级方法、装置、车载***和车辆

Publications (2)

Publication Number Publication Date
WO2020124985A1 true WO2020124985A1 (zh) 2020-06-25
WO2020124985A9 WO2020124985A9 (zh) 2021-06-24

Family

ID=66231772

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/093435 WO2020124985A1 (zh) 2018-12-19 2019-06-28 固件安全升级方法、装置、车载***和车辆

Country Status (3)

Country Link
EP (1) EP3889766B1 (zh)
CN (1) CN109697081B (zh)
WO (1) WO2020124985A1 (zh)

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112202602A (zh) * 2020-09-24 2021-01-08 洛阳光法电气科技有限公司 一种基于can总线的充电桩远程升级***及方法
CN114428630A (zh) * 2022-03-31 2022-05-03 浙江地芯引力科技有限公司 芯片算法升级方法、装置和芯片
CN114793196A (zh) * 2022-06-21 2022-07-26 国汽智控(北京)科技有限公司 固件升级方法、装置、设备和存储介质
CN115145610A (zh) * 2021-03-31 2022-10-04 上海擎感智能科技有限公司 一种车载***及其软件的升级方法
CN115314386A (zh) * 2022-08-08 2022-11-08 矩阵时光数字科技有限公司 一种量子安全设备的固件升级***
CN116661821A (zh) * 2023-05-10 2023-08-29 浙江简捷物联科技有限公司 一种应用升级方法、装置、电子设备及存储介质

Families Citing this family (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109697081B (zh) * 2018-12-19 2021-04-13 广州小鹏汽车科技有限公司 固件安全升级方法、装置、车载***和车辆
CN110276201B (zh) * 2019-06-18 2021-09-03 广州小鹏汽车科技有限公司 一种车载***的安全检测方法、***及服务设备
CN110347412B (zh) * 2019-06-27 2023-05-30 中国第一汽车股份有限公司 电子控制单元固件升级管理方法、装置、设备和存储介质
CN111158736B (zh) * 2019-12-25 2023-04-28 北京珞安科技有限责任公司 一种智能捕获windows操作***补丁更新文件的方法
CN113138775B (zh) * 2020-01-20 2022-11-18 上海交通大学 车载诊断***固件保护方法及***
CN111880824A (zh) * 2020-07-24 2020-11-03 欧姆龙(上海)有限公司 固件数据的校验设备和方法、固件更新设备和方法及***
CN111964922A (zh) * 2020-08-28 2020-11-20 福瑞泰克智能***有限公司 智能驾驶车辆测试***
CN112527326A (zh) * 2020-12-02 2021-03-19 上海星融汽车科技有限公司 免拆板ecu跨厂家刷写***及方法
CN112559419A (zh) * 2020-12-21 2021-03-26 厦门市美亚柏科信息股份有限公司 一种pcie存储模块的固件升级保护方法、装置
CN113778489B (zh) * 2021-09-14 2024-01-30 上海芯钛信息科技有限公司 一种从硬件层面支持不停车ota的方法及***
CN114281065A (zh) * 2021-12-28 2022-04-05 深圳市元征科技股份有限公司 车辆的电子控制单元刷写方法、装置及诊断设备
CN114866585A (zh) * 2022-04-24 2022-08-05 深圳市元征科技股份有限公司 远程升级方法、装置、***及设备端接头
CN114995860B (zh) * 2022-08-01 2022-11-11 摩尔线程智能科技(北京)有限责任公司 图形处理器固件升级的方法和图形处理器

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090064125A1 (en) * 2007-09-05 2009-03-05 Microsoft Corporation Secure Upgrade of Firmware Update in Constrained Memory
CN106843932A (zh) * 2016-12-26 2017-06-13 歌尔科技有限公司 虚拟现实设备固件的升级方法及***
CN108196867A (zh) * 2018-03-08 2018-06-22 深圳市文鼎创数据科技有限公司 设备的固件升级装置、设备及其固件升级方法
CN109697081A (zh) * 2018-12-19 2019-04-30 广州小鹏汽车科技有限公司 固件安全升级方法、装置、车载***和车辆

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102981881B (zh) * 2012-12-10 2018-03-27 中兴通讯股份有限公司 一种防止移动终端升级到非法固件版本的方法及***
CN105760750B (zh) * 2016-02-01 2019-06-14 北京华胜天成科技股份有限公司 软件篡改识别方法和***
US10855462B2 (en) * 2016-06-14 2020-12-01 Honeywell International Inc. Secure in-band upgrade using key revocation lists and certificate-less asymmetric tertiary key pairs
CN106843942B (zh) * 2016-12-31 2021-04-30 歌尔科技有限公司 穿戴式设备的固件升级方法及穿戴式设备
US20180300477A1 (en) * 2017-04-13 2018-10-18 Argus Cyber Security Ltd. In-vehicle cyber protection
CN107479924B (zh) * 2017-08-09 2020-07-28 四川长虹电器股份有限公司 基于Android***的软件升级校验方法
CN108037931B (zh) * 2017-12-06 2021-02-02 广州路派电子科技有限公司 一种对微处理器存储单元进行文件烧写的方法
CN108170447A (zh) * 2017-12-08 2018-06-15 摩比天线技术（深圳）有限公司 芯片在线自动烧录方法和***
CN108304722A (zh) * 2017-12-21 2018-07-20 广州小鹏汽车科技有限公司 一种软件安装包及其生成方法、升级方法和***
CN107992321B (zh) * 2017-12-28 2021-04-27 国机智骏汽车有限公司 Ecu软件更新方法、装置、车载t-box及车辆

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090064125A1 (en) * 2007-09-05 2009-03-05 Microsoft Corporation Secure Upgrade of Firmware Update in Constrained Memory
CN106843932A (zh) * 2016-12-26 2017-06-13 歌尔科技有限公司 虚拟现实设备固件的升级方法及***
CN108196867A (zh) * 2018-03-08 2018-06-22 深圳市文鼎创数据科技有限公司 设备的固件升级装置、设备及其固件升级方法
CN109697081A (zh) * 2018-12-19 2019-04-30 广州小鹏汽车科技有限公司 固件安全升级方法、装置、车载***和车辆

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3889766A4 *

Cited By (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112202602A (zh) * 2020-09-24 2021-01-08 洛阳光法电气科技有限公司 一种基于can总线的充电桩远程升级***及方法
CN112202602B (zh) * 2020-09-24 2023-06-23 蜂鸟智超新能源技术(上海)有限公司 一种基于can总线的充电桩远程升级***及方法
CN115145610A (zh) * 2021-03-31 2022-10-04 上海擎感智能科技有限公司 一种车载***及其软件的升级方法
CN114428630A (zh) * 2022-03-31 2022-05-03 浙江地芯引力科技有限公司 芯片算法升级方法、装置和芯片
CN114428630B (zh) * 2022-03-31 2022-07-01 浙江地芯引力科技有限公司 芯片算法升级方法、装置和芯片
CN114793196A (zh) * 2022-06-21 2022-07-26 国汽智控(北京)科技有限公司 固件升级方法、装置、设备和存储介质
CN114793196B (zh) * 2022-06-21 2022-09-13 国汽智控(北京)科技有限公司 固件升级方法、装置、设备和存储介质
CN115314386A (zh) * 2022-08-08 2022-11-08 矩阵时光数字科技有限公司 一种量子安全设备的固件升级***
CN115314386B (zh) * 2022-08-08 2024-02-20 矩阵时光数字科技有限公司 一种量子安全设备的固件升级***
CN116661821A (zh) * 2023-05-10 2023-08-29 浙江简捷物联科技有限公司 一种应用升级方法、装置、电子设备及存储介质

Also Published As

Publication number Publication date
WO2020124985A9 (zh) 2021-06-24
CN109697081B (zh) 2021-04-13
EP3889766A1 (en) 2021-10-06
CN109697081A (zh) 2019-04-30
EP3889766A4 (en) 2022-06-08
EP3889766B1 (en) 2024-01-24

Similar Documents

Publication Publication Date Title
WO2020124985A1 (zh) 固件安全升级方法、装置、车载***和车辆
CN109257374B (zh) 安全控制方法、装置和计算机设备
CN111723383B (zh) 数据存储、验证方法及装置
US11182485B2 (en) In-vehicle apparatus for efficient reprogramming and controlling method thereof
CN107430658B (zh) 安全软件认证及验证
US20110083161A1 (en) Vehicle, maintenance device, maintenance service system, and maintenance service method
US11409872B2 (en) Confirming a version of firmware loaded to a processor-based device
US20240054207A1 (en) Validation of Software Residing on Remote Computing Devices
US20070028115A1 (en) Method for guaranteeing the integrity and authenticity of flashware for control devices
CN110795126A (zh) 一种固件安全升级***
CN113645590B (zh) 基于加密算法的远程控制车辆的方法、装置、设备及介质
US20150339467A1 (en) Apparatus, method for controlling apparatus, and program
CN113138775B (zh) 车载诊断***固件保护方法及***
CN111651748A (zh) 一种车内ecu的安全访问处理***及其方法
CN109190335B (zh) 一种软件版权保护方法和***
CN109445705A (zh) 固件认证方法及固态硬盘
US20220182248A1 (en) Secure startup method, controller, and control system
CN110633172A (zh) U盘以及u盘的数据同步方法
CN109583197B (zh) 一种可信叠层文件加解密方法
US20190339884A1 (en) Supply Chips and Methods for Restricting Read Access Thereof
CN115495123A (zh) 硬件安全模块的刷写方法及***
WO2020090418A1 (ja) 電子制御装置、電子制御装置のリプログラミング方法
CN107743306B (zh) 一种基于多密码控制的智能pos机wifi设置方法及智能pos机
CN107943721B (zh) 一种电子设备的数据加密方法及装置
US20240211600A1 (en) Method for reprogram with enhanced security

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19901007

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2019901007

Country of ref document: EP

Effective date: 20210628