WO2020124985A9 - 固件安全升级方法、装置、车载系统和车辆 - Google Patents

固件安全升级方法、装置、车载系统和车辆 Download PDF

Info

Publication number
WO2020124985A9
WO2020124985A9 PCT/CN2019/093435 CN2019093435W WO2020124985A9 WO 2020124985 A9 WO2020124985 A9 WO 2020124985A9 CN 2019093435 W CN2019093435 W CN 2019093435W WO 2020124985 A9 WO2020124985 A9 WO 2020124985A9
Authority
WO
WIPO (PCT)
Prior art keywords
firmware
instruction
response
security
firmware upgrade
Prior art date
Application number
PCT/CN2019/093435
Other languages
English (en)
French (fr)
Other versions
WO2020124985A1 (zh
Inventor
谭蔚华
Original Assignee
广州小鹏汽车科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 广州小鹏汽车科技有限公司 filed Critical 广州小鹏汽车科技有限公司
Priority to EP19901007.5A priority Critical patent/EP3889766B1/en
Publication of WO2020124985A1 publication Critical patent/WO2020124985A1/zh
Publication of WO2020124985A9 publication Critical patent/WO2020124985A9/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00—Arrangements for software engineering
    • G06F8/60—Software deployment
    • G06F8/65—Updates
    • G06F8/658—Incremental updates; Differential updates
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00—Arrangements for software engineering
    • G06F8/60—Software deployment
    • G06F8/65—Updates
    • G06F8/654—Updates using techniques specially adapted for alterable solid state memories, e.g. for EEPROM or flash memories
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/572—Secure firmware programming, e.g. of basic input output system [BIOS]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00—Arrangements for software engineering
    • G06F8/70—Software maintenance or management
    • G06F8/71—Version control; Configuration management

Definitions

  • the invention belongs to the technical field of information security, and specifically relates to a firmware security upgrade method, device, vehicle-mounted system and vehicle.
  • Firmware is a program written into EROM or EEPROM, and is a "driver" stored inside the device. Through the firmware, the operating system can realize the running action of the specific machine according to the standard device driver.
  • Firmware upgrade refers to upgrading the embedded firmware of the device, which can improve device functions, enhance stability, and repair vulnerabilities.
  • firmware upgrade package In order to ensure the security of the firmware upgrade of the device, it is usually possible to ensure that the original firmware upgrade package is not tampered during the firmware upgrade package flashing process, but it cannot monitor whether the subsequent firmware upgrade package actually running in the device is the original flashed to the device.
  • the firmware upgrade package cannot perform security verification against the firmware upgrade package version, that is, an attacker may bypass the security restrictions of the upgrade channel and flash a self-made firmware upgrade package in the device and run it, which poses security risks.
  • the firmware upgrade package is flashed through the physical interface to access the bus
  • the firmware upgrade package is flashed through the OBD port to access the bus, which can bypass most of the security detection mechanisms and flash the firmware upgrade package made by the attacker. If an attacker maliciously flashes the firmware through the above method, and the device does not have a corresponding detection mechanism and alarm mechanism, the user will not be able to detect it.
  • the present invention proposes a firmware upgrade method, device, vehicle-mounted system, and vehicle.
  • an embodiment of the present invention provides a method for firmware security upgrade, which includes the following steps:
  • the response instruction is a preset response instruction
  • a message indicating that the upgrade is successful is sent to complete the firmware upgrade.
  • the firmware upgrade package has a pre-built response algorithm for generating corresponding response instructions for the security verification instructions, wherein different versions of the firmware upgrade package correspond to the same security verification instructions and different response instructions, and the firmware upgrade package There is a unique correspondence between the different versions of and their safety verification commands and response commands.
  • the version number of the firmware upgrade package is recorded.
  • the response instruction verification step if the response instruction sent by the device is the same as the preset response instruction in the response algorithm preset in the received firmware upgrade package, then it is determined that the firmware is safely upgraded; if If the response command sent by the device is different from the preset response command in the response algorithm preset in the received firmware upgrade package, it is determined that the firmware upgrade is abnormal.
  • the security check is performed on the device to ensure the security during the firmware upgrade process.
  • the firmware security upgrade device includes a firmware upgrade package acquisition module, a firmware flashing instruction sending module, a security verification instruction sending module, a response instruction receiving module, and Judgment module, where,
  • the firmware upgrade package acquisition module decrypts and verifies the signature of the received firmware upgrade package
  • the firmware flashing instruction sending module sends a firmware flashing instruction to the corresponding device to be upgraded based on the firmware upgrade package;
  • the security verification instruction sending module sends a security verification instruction to the device based on the received flashing success instruction sent by the device;
  • the response instruction receiving module receives the response instruction sent by the device based on the safety verification instruction
  • the judging module sends a message of successful upgrade to complete the firmware upgrade.
  • yet another embodiment of the present invention provides a method for firmware security upgrade, which includes the following steps:
  • the response instruction is a preset response instruction
  • a message indicating that the upgrade is successful is sent to complete the firmware upgrade.
  • the firmware upgrade package has a pre-built response algorithm for generating corresponding response instructions for the security verification instructions, wherein different versions of the firmware upgrade package correspond to the same security verification instructions and different response instructions, and the firmware upgrade package There is a unique correspondence between the different versions of and their safety verification commands and response commands.
  • the version number of the firmware upgrade package is received.
  • the response instruction verification step if the response instruction sent by the device is the same as the preset response instruction in the response algorithm preset in the firmware upgrade package, then it is determined that the firmware is upgraded safely; If the response command sent by the device is different from the preset response command in the response algorithm preset in the firmware upgrade package, it is determined that the firmware upgrade is abnormal.
  • firmware security upgrade device which is characterized in that the firmware security upgrade device includes a monitoring module, a security verification instruction sending module, a response instruction receiving module, and a judgment module, wherein,
  • the monitoring module receives the firmware flashing instruction of the device to be upgraded and enters the monitoring mode
  • a security verification instruction sending module which sends a security verification instruction to the device after the monitoring module monitors the successful write instruction of the device;
  • a response instruction receiving module which receives a response instruction sent by the device based on the safety verification instruction
  • the judging module when the response instruction is a preset response instruction, sends a message indicating that the upgrade is successful to complete the firmware upgrade.
  • Another embodiment of the present invention also provides an in-vehicle system, the in-vehicle system is built with at least one of the above-mentioned firmware security upgrade devices.
  • Another embodiment of the present invention also provides a vehicle, which includes the vehicle-mounted system as described above.
  • the firmware security upgrade method, device, on-board system and vehicle proposed in the embodiments of the present invention are suitable for over-the-air upgrade (OTA) and OBD interface upgrades, by pre-packing the preset response algorithm in the firmware upgrade package After the device completes the firmware flashing, it sends a security verification verification instruction to verify security by verifying the response instruction generated by the response algorithm, so as to achieve the solution by checking the consistency of the released firmware and the firmware running after the upgrade.
  • OTA over-the-air upgrade
  • OBD interface upgrades by pre-packing the preset response algorithm in the firmware upgrade package
  • the device After the device completes the firmware flashing, it sends a security verification verification instruction to verify security by verifying the response instruction generated by the response algorithm, so as to achieve the solution by checking the consistency of the released firmware and the firmware running after the upgrade.
  • the security problem of illegally writing the firmware package by bypassing the security restrictions of the upgrade channel.
  • FIG. 1 is a flowchart of a method for securely upgrading firmware proposed in Embodiment 1 of the present invention
  • FIG. 2 is a schematic diagram of a system applying the firmware security upgrade method of Embodiment 1 of the present invention
  • FIG. 3 is a block diagram of a firmware security upgrade device proposed in Embodiment 2 of the present invention.
  • FIG. 5 is a schematic diagram of a system applying the firmware security upgrade method of Embodiment 3 of the present invention.
  • FIG. 6 is a block diagram of a firmware security upgrade device proposed in Embodiment 4 of the present invention.
  • the embodiment of the present invention proposes a secure firmware upgrade method to upgrade the firmware of a device, which is especially suitable for remote firmware upgrades using OTA (Over-the-Air) mode.
  • the device may be a car, as shown in the figure. As shown in 1, it includes the following steps:
  • S11 Decrypt and verify the signature of the received firmware upgrade package; during the packaging process of the firmware upgrade package, encrypt the firmware upgrade package and add a digital signature to ensure the security of the firmware upgrade package itself.
  • the encryption algorithm and the signature algorithm may be any achievable algorithm in the prior art, which is not limited in the present invention.
  • the firmware upgrade package is pre-built with a response algorithm for generating a corresponding response instruction for the safety verification instruction, and in the process of packaging the firmware upgrade package, a response to the safety verification instruction generating a corresponding response instruction is written in advance The logic implementation program of the algorithm for subsequent safety verification.
  • the different versions of the firmware upgrade package correspond to the same safety verification instruction and different response instructions, and the different versions of the firmware upgrade package have a unique correspondence relationship with their safety verification instructions and response instructions.
  • the response algorithm has different response commands in response to the same security check command a or b for different firmware upgrade package versions, as shown in Table 1:
  • the response command of version V1.0 of the firmware upgrade package is B
  • the response command of version V2.0 of the firmware upgrade package is C
  • the response of version V3.0 of the firmware upgrade package is The command is D
  • the response command of the firmware upgrade package version V1.0 is X
  • the response command of the firmware upgrade package version V2.0 is Y
  • the firmware upgrade package version V3.0 The response command is Z. Therefore, the different versions of the firmware upgrade package V1.0, V2.0, V3.0 and their safety verification commands and response commands have the only corresponding relationship shown in Table 1.
  • step S11 when the signature verification is successful, the version number of the firmware upgrade package is recorded, so that the above-mentioned version related to the firmware upgrade package can be used according to the recorded version number of the firmware upgrade package.
  • the response algorithm obtains the preset response command. In this embodiment, it is the response command associated with the version of the firmware upgrade package and the security check command in Table 1, so that it can be compared with the response command sent by the device in the subsequent step S15 .
  • the obtained firmware upgrade package sends a firmware flashing instruction to the corresponding device to be upgraded based on the firmware upgrade package to start the firmware flashing process.
  • the device to be upgraded uses the firmware upgrade package to perform firmware flashing according to the flashing protocol, loads the firmware upgrade package into the corresponding storage module, and updates the version information of the firmware to the version of the firmware upgrade package.
  • the security check is performed on the device to ensure the security during the firmware upgrade process.
  • the detection content includes whether there are hijacked and/or tampered interference data packets in the internal network of the device, whether the flashed device is in normal working condition, and whether the device has abnormal network connections, such as the connection of an attacker. If one of the above situations exists, you can stop flashing the firmware upgrade package of the current version and restore the previous firmware version.
  • the device After completing the firmware flashing, the device sends a flashing successful instruction.
  • S13 Send a security verification instruction to the device based on the received flashing success instruction sent by the device;
  • the device receives the safety verification instruction, and uses the preset response algorithm in the flashed firmware upgrade package to send a corresponding response instruction for the version of the flashed firmware upgrade package.
  • the response instruction sent by the device is compared with the preset response instruction in the response algorithm preset in the received firmware upgrade package.
  • the preset response command is the above-mentioned response command associated with the version of the firmware upgrade package and the security check command. If the response instruction sent by the device is generated by the device according to the response algorithm preset in the firmware upgrade package that has been flashed, the response instruction sent by the device is the same as the pre-stored received firmware upgrade package.
  • the firmware is determined to be upgraded safely; if the response command sent by the device is different from the preset response command in the response algorithm preset in the received firmware upgrade package, It indicates that the firmware upgrade package flashed by the corresponding firmware has a security risk. Determine and record the firmware upgrade abnormality, and send a security alarm through the network. At the same time, it is forbidden to operate the device in the OTA mode until it is unlocked by the risk removal process.
  • the device After the device has completed the flashing of the firmware upgrade package V1.0, it sends a security verification instruction a to the device, and the device generates a response instruction H, and transmits the response instruction H back.
  • the response command of the firmware upgrade package V1.0 corresponding to the security check command a is B
  • the preset response command is B
  • its firmware security upgrade system includes an over-the-air upgrade OTA server, a security chip module ESU in the car, and an electronic unit ECU to be flashed and upgraded.
  • the OTA server stores a challenge-response Tag challenge-side algorithm That is, in the response algorithm in Embodiment 1 of the present invention, the in-vehicle security chip module ESU executes the steps of the firmware security upgrade method described in Embodiment 1 of the present invention.
  • the response algorithm can be as shown in Table 1.
  • the challenger algorithm has only one security check command AAA. For example, for the firmware version V1.1, when the security check command AAA is received, the response command BBB is fed back.
  • the OTA server sends the challenge-side algorithm to the security chip module ESU in the vehicle, and the security chip module ESU in the vehicle pre-stores the challenge-side algorithm.
  • the second step is to have or generate a firmware package for upgrading in the OTA server that is upgraded over the air, that is, the firmware upgrade package in Embodiment 1 of the present invention, and the challenge side algorithm is preset in the upgraded firmware package.
  • the challenge side algorithm preset in the upgraded firmware package is specifically to enter a hardcode challenge tag in the upgraded firmware package, for example, For the firmware version V1.1, when the security check command AAA is received, the response command BBB is fed back.
  • the security chip module ESU in the car obtains the upgraded firmware package, and downloads it to the security chip module ESU in the car for decryption and signature verification. If the verification is passed, the security chip module ESU in the vehicle records the version number of the upgraded firmware package, for example, V1.1, and sends a firmware flashing instruction.
  • the security chip module ESU or other flashing control components in the vehicle use the upgraded firmware package according to the flashing protocol to flash the firmware of the electronic unit ECU to be flashed and upgraded. After the firmware is successfully flashed, the electronic unit ECU runs the new firmware.
  • the security chip module ESU in the car initiates the challenge-side algorithm according to the recorded version number V1.1 of the upgraded firmware package, and sends the security verification instruction AAA to the electronic unit ECU (anticipating feedback preset response Command BBB).
  • the electronic unit ECU After the electronic unit ECU receives the security verification instruction AAA sent by the security chip module ESU in the vehicle, it sends a response instruction to the security chip module ESU.
  • the security chip module ESU in the vehicle determines that the response is normal, and the firmware upgrade of the electronic unit ECU is successful. If the electronic unit ECU sends a response command to the security chip module ESU that is different from the preset response command BBB, the security chip module ESU in the vehicle determines that the response is abnormal, and the firmware package written by the electronic unit ECU is safe Risk, determine the firmware upgrade abnormality and record, the security chip module ESU sends a security alarm to the vehicle and/or OTA server through the network, and at the same time prohibits the use of OTA to operate the vehicle.
  • the embodiment of the present invention proposes a firmware security upgrade device, which is used to upgrade the firmware of a device, which is especially suitable for the situation of remote firmware upgrade by OTA (Over-the-Air).
  • the device may be a car, as shown in the figure.
  • it includes a firmware upgrade package acquisition module, a firmware flashing instruction sending module, a safety verification instruction sending module, a response instruction receiving module, and a judgment module.
  • the firmware upgrade package acquisition module decrypts and verifies the signature of the received firmware upgrade package.
  • the firmware upgrade package is encrypted and a digital signature is added to ensure the security of the firmware upgrade package itself.
  • the encryption algorithm and the signature algorithm may be any achievable algorithm in the prior art, which is not limited in the present invention.
  • the firmware upgrade package is pre-built with a response algorithm for generating a corresponding response instruction for the safety verification instruction, and in the process of packaging the firmware upgrade package, a response to the safety verification instruction generating a corresponding response instruction is written in advance The logic implementation program of the algorithm for subsequent safety verification.
  • the different versions of the firmware upgrade package correspond to the same safety verification instruction and different response instructions, and the different versions of the firmware upgrade package have a unique correspondence relationship with their safety verification instructions and response instructions.
  • the response algorithm has different response commands in response to the same security check command a or b for different firmware upgrade package versions, as shown in Table 1. That is, in response to the same security check command a, the response command of version V1.0 of the firmware upgrade package is B, the response command of version V2.0 of the firmware upgrade package is C, and the response of version V3.0 of the firmware upgrade package is The command is D; in response to the same security check command b, the response command of the firmware upgrade package version V1.0 is X, the response command of the firmware upgrade package version V2.0 is Y, and the firmware upgrade package version V3.0 The response command is Z. Therefore, the different versions of the firmware upgrade package V1.0, V2.0, V3.0 and their safety verification commands and response commands have the only corresponding relationship shown in Table 1.
  • the firmware upgrade package acquisition module records the version number of the firmware upgrade package, so as to be able to obtain the preset response instruction used by the judgment module.
  • the above-mentioned response algorithm related to the version of the firmware upgrade package can be used to obtain the preset response instruction, which is the version of the firmware upgrade package in Table 1 in this embodiment.
  • the response command associated with the safety check command is the response command associated with the safety check command.
  • the firmware flashing instruction sending module sends a firmware flashing instruction to the corresponding device to be upgraded based on the firmware upgrade package.
  • the obtained firmware upgrade package sends a firmware flashing instruction to the corresponding device to be upgraded based on the firmware upgrade package to start the firmware flashing process.
  • the device to be upgraded uses the firmware upgrade package to perform firmware flashing according to the flashing protocol, loads the firmware upgrade package into the corresponding storage module, and updates the version information of the firmware to the version of the firmware upgrade package.
  • the firmware flashing instruction sending module performs security inspection on the device to determine the security during the firmware upgrade process.
  • the detection content includes whether there are hijacked and/or tampered interference data packets in the internal network of the device, whether the flashed firmware is in a normal working condition, and whether the device has abnormal network connections, such as the connection of an attacker. If one of the above conditions exists, you can stop flashing the firmware upgrade package of the current version and restore the previous firmware version.
  • the device After completing the firmware flashing, the device sends a flashing successful instruction.
  • the security verification instruction sending module sends a security verification instruction to the device based on the received flashing success instruction sent by the device.
  • the device receives the safety verification instruction, and uses the preset response algorithm in the flashed firmware upgrade package to send a corresponding response instruction for the version of the flashed firmware upgrade package.
  • the response instruction receiving module receives the response instruction sent by the device based on the safety verification instruction.
  • the judging module when the response instruction is a preset response instruction, sends a message indicating that the upgrade is successful to complete the firmware upgrade. Specifically, after receiving the response instruction sent by the device, the judgment module compares the response instruction sent by the device with the preset response instruction in the response algorithm preset in the received firmware upgrade package.
  • the preset response command is the above-mentioned response command associated with the version of the firmware upgrade package and the security check command.
  • the judgment module determines that the firmware is upgraded safely; if the response command sent by the device is the same as the preset response command in the response algorithm preset in the received firmware upgrade package Different, it indicates that the firmware upgrade package flashed by the corresponding firmware has a security risk.
  • the judgment module determines the firmware upgrade abnormality and records it, and sends a security alarm through the network. At the same time, it is prohibited to use OTA to operate the device until the risk removal process is carried out. Unlock.
  • the device After the device has completed the flashing of the firmware upgrade package V1.0, it sends a security verification instruction a to the device, and the device generates a response instruction H, and transmits the response instruction H back.
  • the response command of the firmware upgrade package V1.0 corresponding to the security check command a is B
  • the preset response command is B
  • the embodiment of the present invention proposes a firmware security upgrade method, which is used to upgrade the firmware of the device, and is especially suitable for the situation where the firmware upgrade is performed in the OBD interface mode. As shown in FIG. 4, the method includes the following steps:
  • S21 Receive a firmware flashing instruction of the device to be upgraded, and enter a monitoring mode.
  • the device monitors the flashing instruction in the CAN bus or the local area network where the device is located, and after listening to the firmware flashing instruction of the device to be upgraded, enters the monitoring mode to monitor the firmware flashing progress.
  • the online diagnostic tool receives the firmware upgrade package, uses the secret key and digital certificate to decrypt and signature verification of the received firmware upgrade package, and uses the firmware upgrade package to flash the firmware according to the flashing protocol, and load the firmware upgrade package to the corresponding In the storage module, the version information of the firmware is updated to the version number of the firmware upgrade package.
  • the firmware upgrade package is encrypted and a digital signature is added to ensure the security of the firmware upgrade package itself.
  • the encryption algorithm and the signature algorithm may be any achievable algorithm in the prior art, which is not limited in the present invention.
  • the decryption algorithm and signature verification are executed, wherein the decryption algorithm and the encryption algorithm correspond to each other, and the signature verification process corresponds to the signature process.
  • the firmware upgrade package is pre-built with a response algorithm for generating a corresponding response instruction for the safety verification instruction, and in the process of packaging the firmware upgrade package, a response to the safety verification instruction generating a corresponding response instruction is written in advance The logic implementation program of the algorithm for subsequent safety verification.
  • the different versions of the firmware upgrade package correspond to the same safety verification instruction and different response instructions, and the different versions of the firmware upgrade package have a unique correspondence relationship with their safety verification instructions and response instructions.
  • the response algorithm has different response commands in response to the same security check command a or b for different firmware upgrade package versions, as shown in Table 1. That is, in response to the same security check command a, the response command of version V1.0 of the firmware upgrade package is B, the response command of version V2.0 of the firmware upgrade package is C, and the response of version V3.0 of the firmware upgrade package is The command is D; in response to the same safety check command b, the response command of the firmware upgrade package version V1.0 is X, the response command of the firmware upgrade package version V2.0 is Y, and the firmware upgrade package version V3.0 The response command is Z. Therefore, the different versions of the firmware upgrade package V1.0, V2.0, V3.0 and their safety verification commands and response commands have the only corresponding relationship shown in Table 1.
  • the device needs to return the response command and the version number of the firmware upgrade package after receiving the security check instruction.
  • the device uses the preset response algorithm in the flashed firmware upgrade package to send a corresponding response instruction for the version of the flashed firmware upgrade package.
  • the version number of the firmware upgrade package is received, so that the firmware upgrade package can be based on the received firmware upgrade package.
  • the preset response command that is, the response command associated with the version of the firmware upgrade package and the security check command in Table 1, so as to facilitate the subsequent step S24 Compare with the response command sent by the device.
  • the response instruction is a preset response instruction
  • a message indicating that the upgrade is successful is sent to complete the firmware upgrade.
  • the response instruction sent by the device is compared with the preset response instruction in the response algorithm preset in the firmware upgrade package.
  • the preset response command is the above-mentioned response command associated with the version of the firmware upgrade package and the security check command. If the response instruction sent by the device is generated by the device according to the response algorithm preset in the firmware upgrade package that has been flashed, the response instruction sent by the device is the same as the pre-stored firmware upgrade package.
  • the firmware is determined to be upgraded safely; if the response command sent by the device is different from the preset response command in the response algorithm preset in the firmware upgrade package, it means The firmware upgrade package flashed by the corresponding firmware has security risks. Determine and record the firmware upgrade abnormality, and send a security alarm through the network. At the same time, it is prohibited to operate the device in the OBD mode until it is unlocked by the risk removal process.
  • the device After the device has completed the flashing of the firmware upgrade package V1.0, it sends a security check instruction a to the device, the device generates a response instruction H, and sends the response instruction H and the firmware upgrade package The version number V1.0 is sent back.
  • the response command of the firmware upgrade package V1.0 corresponding to the security check command a is B, and then the preset response command is B.
  • the response instruction H sent by the device After receiving the response instruction H sent by the device based on the safety verification instruction a and the version number V1.0 of the firmware upgrade package, the response instruction H sent by the device is combined with the pre-stored firmware upgrade package V1.0
  • its firmware security upgrade system includes a firmware generation server, a diagnostic instrument, a security chip module ESU in the car, and an electronic unit ECU to be flashed and upgraded.
  • the firmware generation server stores a challenge response Tag challenge
  • the end algorithm is the response algorithm in Embodiment 3 of the present invention.
  • the in-vehicle security chip module ESU executes the steps of the firmware security upgrade method described in Embodiment 3 of the present invention.
  • the response algorithm can be as shown in Table 1.
  • the challenger algorithm has only one security check command AAA. For example, for the firmware version V1.1, when the security check command AAA is received, the response command BBB is fed back.
  • the firmware generation server sends the challenge-side algorithm to the security chip module ESU in the vehicle, and the security chip module ESU in the vehicle pre-stores the challenge-side algorithm.
  • a firmware package for upgrading is generated in the firmware generation server, that is, the firmware upgrade package in Embodiment 1 of the present invention, and the challenge side algorithm is preset in the upgraded firmware package.
  • the challenge side algorithm preset in the upgraded firmware package is specifically to enter a hardcode challenge tag in the upgraded firmware package, for example, For the firmware version V1.1, when the security check command AAA is received, the response command BBB is fed back.
  • the diagnostic instrument obtains the upgraded firmware package from the firmware generation server, for example, the firmware package of version V1.1.
  • the diagnostic instrument is physically connected to the OBD interface of the vehicle to upgrade the firmware of the electronic component ECU.
  • the diagnostic instrument uses the upgraded firmware package according to the flashing protocol to flash the firmware of the electronic unit ECU to be flashed and upgraded.
  • the electronic unit ECU runs the new firmware.
  • the security chip module ESU in the car monitors the flashing instructions in the CAN bus or the local area network where the vehicle is located. After listening to the firmware flashing instructions of the electronic unit ECU to be flashed and upgraded, it enters the monitoring mode to monitor The firmware flashing progress.
  • the security chip module ESU in the car monitors that the electronic unit ECU has completed the flashing of the upgraded firmware package, it initiates a challenge-side algorithm to the electronic unit ECU, and sends a safety verification instruction to the electronic unit ECU AAA.
  • the electronic unit ECU receives the security verification instruction AAA sent by the security chip module ESU in the vehicle, it sends a response instruction and the version number V1.1 of the upgraded firmware package to the security chip module ESU.
  • the security chip module ESU in the vehicle uses the pre-stored challenge side algorithm to obtain the preset response command BBB that is expected to be fed back.
  • the security chip module ESU in the vehicle determines that the response is normal, and the firmware upgrade of the electronic unit ECU is successful. If the electronic unit ECU sends a response command to the security chip module ESU that is different from the preset response command BBB, the security chip module ESU in the vehicle determines that the response is abnormal, and the firmware package written by the electronic unit ECU is safe Risk, determine and record the abnormal firmware upgrade, the security chip module ESU sends a security alarm to the vehicle and/or the firmware generation server through the network, and at the same time prohibits the use of OTA to operate the vehicle.
  • the embodiment of the present invention proposes a firmware security upgrade device, which is used to upgrade the firmware of a device, and is especially suitable for the situation where the firmware upgrade is performed by an OBD interface.
  • the device may be a car, as shown in FIG. 6, including a monitoring module , Safety verification instruction sending module, response instruction receiving module and judgment module. among them,
  • the monitoring module receives the firmware flashing instruction of the device to be upgraded, and enters the monitoring mode.
  • the device monitors the flashing instruction in the CAN bus or the local area network where the device is located, and after listening to the firmware flashing instruction of the device to be upgraded, enters the monitoring mode to monitor the firmware flashing progress.
  • the online diagnostic tool receives the firmware upgrade package, uses the secret key and digital certificate to decrypt and signature verification of the received firmware upgrade package, and uses the firmware upgrade package to flash the firmware according to the flashing protocol, and load the firmware upgrade package to the corresponding In the storage module, the version information of the firmware is updated to the version number of the firmware upgrade package.
  • the firmware upgrade package is encrypted and a digital signature is added to ensure the security of the firmware upgrade package itself.
  • the encryption algorithm and the signature algorithm may be any achievable algorithm in the prior art, which is not limited in the present invention.
  • a decryption algorithm and signature verification are executed, wherein the decryption algorithm and the encryption algorithm correspond to each other, and the signature verification process corresponds to the signature process.
  • the firmware upgrade package is pre-built with a response algorithm for generating a corresponding response instruction for the safety verification instruction, and in the process of packaging the firmware upgrade package, a response to the safety verification instruction generating a corresponding response instruction is written in advance The logic implementation program of the algorithm for subsequent safety verification.
  • the different versions of the firmware upgrade package correspond to the same safety verification instruction and different response instructions, and the different versions of the firmware upgrade package have a unique correspondence relationship with their safety verification instructions and response instructions.
  • the response algorithm has different response commands in response to the same security check command a or b for different firmware upgrade package versions, as shown in Table 1. That is, in response to the same security check command a, the response command of version V1.0 of the firmware upgrade package is B, the response command of version V2.0 of the firmware upgrade package is C, and the response of version V3.0 of the firmware upgrade package is The command is D; in response to the same safety check command b, the response command of the firmware upgrade package version V1.0 is X, the response command of the firmware upgrade package version V2.0 is Y, and the firmware upgrade package version V3.0 The response command is Z. Therefore, the different versions of the firmware upgrade package V1.0, V2.0, V3.0 and their safety verification commands and response commands have the only corresponding relationship shown in Table 1.
  • the security verification instruction sending module sends a security verification instruction to the device.
  • the device needs to return the response command and the version number of the firmware upgrade package after receiving the security check instruction.
  • the device uses the preset response algorithm in the flashed firmware upgrade package to send a corresponding response command for the version of the flashed firmware upgrade package.
  • the response instruction receiving module receives the response instruction sent by the device based on the safety verification instruction.
  • the response instruction receiving module receives the response instruction sent by the device while receiving the version number of the firmware upgrade package, so as to obtain the judgment module The preset response command used.
  • the preset response instruction can be obtained, that is, the version of the firmware upgrade package and the security check instruction in Table 1 are associated Respond to instructions.
  • the judging module when the response instruction is a preset response instruction, sends a message indicating that the upgrade is successful to complete the firmware upgrade. Specifically, after receiving the response instruction sent by the device, the judgment module compares the response instruction sent by the device with the preset response instruction in the response algorithm preset in the firmware upgrade package.
  • the preset response command is the above-mentioned response command associated with the version of the firmware upgrade package and the security check command. If the response instruction sent by the device is generated by the device according to the response algorithm preset in the firmware upgrade package that has been flashed, the response instruction sent by the device is the same as the pre-stored firmware upgrade package.
  • the judgment module determines the firmware upgrade; if the response command sent by the device is different from the preset response command in the response algorithm preset in the firmware upgrade package, It indicates that the firmware upgrade package flashed by the corresponding firmware has a security risk.
  • the judgment module determines the firmware upgrade abnormality and records it, and sends a security alarm through the network. At the same time, it is prohibited to operate the device in the OBD mode until it is unlocked by the risk removal process.
  • the device After the device has completed the flashing of the firmware upgrade package V1.0, it sends a security check instruction a to the device, the device generates a response instruction H, and sends the response instruction H and the firmware upgrade package The version number V1.0 is sent back.
  • the response command of the firmware upgrade package V1.0 corresponding to the security check command a is B, and then the preset response command is B.
  • the embodiment of the present invention also proposes an on-board system, the on-board system is built with the firmware security upgrade device based on OTA remote upgrade described in Embodiment 2 of the present invention and/or the OBD interface method described in Embodiment 4 of the present invention.
  • An upgraded firmware security upgrade device the firmware security upgrade device controls the vehicle to perform firmware upgrades to ensure the firmware security upgrade.
  • the embodiment of the present invention also provides a vehicle, the vehicle includes the above-mentioned on-board system, so that the vehicle has a firmware upgrade function.
  • the embodiment of the present invention also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps of the foregoing method are implemented.
  • the embodiment of the present invention also provides a computer device including a memory, a processor, and a computer program stored on the memory and capable of running on the processor, and the processor implements the steps of the above method when the program is executed.
  • a "computer-readable medium” can be any device that can contain, store, communicate, propagate, or transmit a program for use by an instruction execution system, device, or device or in combination with these instruction execution systems, devices, or devices.
  • computer readable media include the following: electrical connections (electronic devices) with one or more wiring, portable computer disk cases (magnetic devices), random access memory (RAM), Read only memory (ROM), erasable and editable read only memory (EPROM or flash memory), fiber optic devices, and portable compact disk read only memory (CDROM).
  • the computer-readable medium may even be paper or other suitable medium on which the program can be printed, because it can be used, for example, by optically scanning the paper or other medium, followed by editing, interpretation, or other suitable media if necessary. The program is processed in a manner to obtain the program electronically, and then stored in the computer memory.
  • each part of the present invention can be implemented by hardware, software, firmware or a combination thereof.
  • multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system.
  • a suitable instruction execution system For example, if it is implemented by hardware, as in another embodiment, it can be implemented by any one or a combination of the following technologies known in the art: Discrete logic circuits, application specific integrated circuits with suitable combinational logic gates, programmable gate array (PGA), field programmable gate array (FPGA), etc.

Abstract

本发明涉及一种固件安全升级方法、装置、车载系统和车辆。所述方法包括对接收的固件升级包进行解密和签名校验；基于所述固件升级包向相应的待升级设备发送固件刷写指令；基于接收的所述设备发送的刷写成功指令，向所述设备发送安全校验指令；接收所述设备基于所述安全校验指令发送的应答指令并验证；当所述应答指令为预设应答指令时，发送升级成功的消息以完成固件升级。本发明实施例的技术方案可适用于空中升级和OBD接口升级，通过检查发布的固件和升级后运行的固件的一致性，解决了绕开升级通道的安全限制而非法写入固件包的安全问题。

Description

固件安全升级方法、装置、车载系统和车辆 技术领域
本发明属于信息安全技术领域，具体涉及一种固件安全升级方法、装置、车载系统和车辆。
背景技术
固件就是写入EROM或EEPROM中的程序，是设备内部保存的“驱动程序”。通过固件，操作系统才能按照标准的设备驱动实现特定机器的运行动作。固件升级是指对设备的内嵌固件进行升级，可以完善设备功能、增强稳定性、修补漏洞。
现有技术中，设备中用于固件升级的接口都存在被攻击者恶意利用的风险。攻击者可能劫持固件升级的通道，将自制的固件升级包刷写进去，由此控制设备的相应模块乃至在CAN总线中控制整台设备，实现例如盗取设备控制权、盗取数据等目的。因此，对于例如智能汽车等对于安全性要求极高的场合，固件升级的安全性显得非常重要，应避免智能汽车的控制器通过非法固件升级的方式被盗取。
为了保证设备的固件升级的安全性，通常能够在固件升级包刷写流程中确保原始固件升级包不被篡改，但不能监控设备中后续实际运行的固件升级包是否是刷写到设备中的原始固件升级包，不能针对固件升级包版本进行安全性校验，即，攻击者可能绕开升级通道的安全限制，在设备中刷写自制的固件升级包并运行，存在安全隐患。
此外，对于通过物理接口接入总线刷写固件升级包的情况，例如通过OBD口接入总线刷写固件升级包，可以绕过了大部分安全检测机制，刷写攻击者自制的固件升级包。如果攻击者恶意通过上述方法刷写固件，而设备内尚无相应的检测机制和报警机制，用户无法察觉。
发明内容
为了解决上述固件升级安全性低的技术问题，本发明提出了一种固件安全升级方法、装置、车载系统和车辆。
一方面，本发明一实施例提出一种固件安全升级方法，包括如下步骤：
对接收的固件升级包进行解密和签名校验；
基于所述固件升级包向相应的待升级设备发送固件刷写指令；
基于接收的所述设备发送的刷写成功指令，向所述设备发送安全校验指令；
接收所述设备基于所述安全校验指令发送的应答指令并验证；
当所述应答指令为预设应答指令时，发送升级成功的消息以完成固件升级。
进一步，所述固件升级包中预先内置有针对安全校验指令生成相应应答指令的应答算法，其中固件升级包的不同版本对应相同的安全校验指令和不同的应答指令，且所述固件升级包的不同版本与其安全校验指令及应答指令存在唯一对应关系。
进一步，所述接收的固件升级包进行解密和签名校验步骤中，当所述签名校验成功后，记录固件升级包的版本号。
进一步，在所述应答指令验证步骤中，如果所述设备发送的应答指令与预先存储的所接收的固件升级包中预置的应答算法中的预设应答指令相同，则确定固件安全升级；如果所述设备发送的应答指令与预先存储的所接收的固件升级包中预置的应答算法中的预设应答指令不同，则确定固件升级异常。
进一步，在固件升级包刷写过程中，对所述设备进行安全检测，以确保固件升级过程中的安全性。
进一步，当所述应答指令与所述预设应答指令不一致时，发送异常告警。
另一方面，本发明另一实施例提出一种固件安全升级装置，所述固件安全升级装置包括固件升级包获取模块、固件刷写指令发送模块、安全校验指令发送模块、应答指令接收模块和判断模块，其中，
固件升级包获取模块对接收的固件升级包进行解密和签名校验；
固件刷写指令发送模块基于所述固件升级包向相应的待升级设备发送固件刷写指令；
安全校验指令发送模块基于接收的所述设备发送的刷写成功指令，向所述设备发送安全校验指令；
应答指令接收模块接收所述设备基于所述安全校验指令发送的应答指令；
判断模块在所述应答指令为预设应答指令时发送升级成功的消息以完成固件升级。
再一方面，本发明再一实施例提出一种固件安全升级方法，包括以下步骤：
接收对待升级设备的固件刷写指令，进入监听模式；
监听到待升级设备的固件升级包刷写成功指令后，向所述设备发送安全校验指令；
接收所述设备基于所述安全校验指令发送的应答指令并验证；
当所述应答指令为预设应答指令时，发送升级成功的消息以完成固件升级。
进一步，所述固件升级包中预先内置有针对安全校验指令生成相应应答指令的应答算法，其中固件升级包的不同版本对应相同的安全校验指令和不同的应答指令，且所述固件升级包的不同版本与其安全校验指令及应答指令存在唯一对应关系。
进一步，接收所述设备发送的应答指令的同时，接收所述固件升级包的版本号。
进一步，在所述应答指令验证步骤中，如果所述设备发送的应答指令与预先存储的所述固件升级包中预置的应答算法中的预设应答指令相同，则确定固件安全升级；如果所述设备发送的应答指令与预先存储的所述固件升级包中预置的应答算法中的预设应答指令不同，则确定固件升级异常。
进一步，当所述应答指令与所述预设应答指令不一致时，发送异常告警。
又一方面，本发明又一实施例提出一种固件安全升级装置，其特征在于，所述固件安全升级装置包括监听模块、安全校验指令发送模块、应答指令接收模块和判断模块，其中，
监听模块，接收对待升级设备的固件刷写指令，进入监听模式；
安全校验指令发送模块，在监听模块监听到所述设备的刷写成功指令后，向所述设备发送安全校验指令；
应答指令接收模块，接收所述设备基于所述安全校验指令发送的应答指令；
判断模块，当所述应答指令为预设应答指令时，发送升级成功的消息以完成固件升级。
本发明另一实施例还提出一种车载系统，所述车载系统内置有如上所述的固件安全升级装置的至少一 个。
本发明另一实施例还提出一种车辆，所述车辆包括如上所述的车载系统。
本发明的有益效果：本发明实施例提出的固件安全升级方法、装置、车载系统和车辆，适用于空中升级(OTA)和OBD接口升级，通过预先将预设的应答算法打包在固件升级包中，在设备完成固件刷写后，发送安全验证校验指令，以通过校验所述应答算法生成的应答指令进行安全验证，从而实现通过检查发布的固件和升级后运行的固件的一致性，解决绕开升级通道的安全限制而非法写入固件包的安全问题。
附图说明
图1是本发明实施例1提出的一种固件安全升级方法的流程图；
图2是应用本发明实施例1的固件安全升级方法的系统原理图；
图3是本发明实施例2提出的一种固件安全升级装置的方框图；
图4是本发明实施例3提出的一种固件安全升级方法的流程图；
图5是应用本发明实施例3的固件安全升级方法的系统原理图；
图6是本发明实施例4提出的一种固件安全升级装置的方框图。
具体实施方式
为使本发明的目的、技术方案和优点更加清楚明白，以下结合具体实施例，并参照附图，对本发明进一步详细说明。但本领域技术人员知晓，本发明并不局限于附图和以下实施例。
实施例1：
本发明实施例提出了一种固件安全升级方法，用于对设备进行固件升级，尤其适用于采用OTA(Over-the-Air)方式进行远程固件升级的情形，所述设备可以是汽车，如图1所示，包括如下步骤：
S11，对接收的固件升级包进行解密和签名校验；所述固件升级包在打包过程中，对固件升级包进行加密和添加数字签名，以确保固件升级包本身的安全性。其中，所述加密算法和签名算法可以是现有技术中任意可实现算法，本发明对此不做限制。当接收到固件升级包后，执行解密算法和签名校验，其中所述解密算法和加密算法相对应，签名校验过程与所述签名过程相对应。
进一步的，所述固件升级包中预先内置有针对安全校验指令生成相应应答指令的应答算法，在对固件升级包进行打包的过程中，预先写入针对安全校验指令生成相应应答指令的应答算法的逻辑实现程序，以进行后续的安全校验。其中所述固件升级包的不同版本对应相同的安全校验指令和不同的应答指令，且所述固件升级包的不同版本与其安全校验指令及应答指令存在唯一对应关系。
例如，所述应答算法针对不同的固件升级包的版本，响应于相同的安全校验指令a或b，具有不同的应答指令，如表1所示：
固件升级包的版本 安全校验指令 应答指令
V1.0 a B
V2.0 a C
V3.0 a D
V1.0 b X
V2.0 b Y
V3.0 b Z
表1
即，响应于相同的安全校验指令a，固件升级包的版本V1.0的应答指令为B，固件升级包的版本V2.0的应答指令为C，固件升级包的版本V3.0的应答指令为D；响应于相同的安全校验指令b，固件升级包的版本V1.0的应答指令为X，固件升级包的版本V2.0的应答指令为Y，固件升级包的版本V3.0的应答指令为Z。因此，固件升级包的不同版本V1.0、V2.0、V3.0与其安全校验指令及应答指令存在表1所示的唯一对应关系。
基于上述应答算法，在步骤S11中，当所述签名校验成功后，记录固件升级包的版本号，从而能够根据所记录的固件升级包的版本号，使用上述与固件升级包的版本相关的应答算法，得到预设应答指令，在本实施例中即为表1中与固件升级包的版本和安全校验指令关联的应答指令，以便于在后续步骤S15中与设备发送的应答指令进行比较。
S12，基于所述固件升级包向相应的待升级设备发送固件刷写指令；
当所述解密和签名校验过程成功后，获的所述固件升级包，基于该固件升级包向相应的待升级设备发送固件刷写指令，以启动固件刷写流程。
所述待升级设备根据刷写协议使用固件升级包进行固件刷写，将固件升级包加载至对应的存储模块中，并将固件的版本信息更新为固件升级包的版本。
在固件升级包刷写过程中，对所述设备进行安全检测，以确保固件升级过程中的安全性。检测内容包括设备内网中是否有劫持和/或篡改的干扰数据包、被刷写的器件是否处于正常的工况、以及所述设备是否存在异常的网络连接，例如攻击者的连接。如果存在上述情况之一，则可停止刷写当前版本的固件升级包，并恢复之前的固件版本。
在完成固件刷写后，所述设备发送刷写成功指令。
S13，基于接收的所述设备发送的刷写成功指令，向所述设备发送安全校验指令；
所述设备接收到安全校验指令，使用已刷写的固件升级包中的预置应答算法，针对已刷写的固件升级包的版本，发送相应的应答指令。
S14，接收所述设备基于所述安全校验指令发送的应答指令并验证；
S15，当所述应答指令为预设应答指令时，发送升级成功的消息以完成固件升级。
具体的，在接收到所述设备发送的应答指令后，将所述设备发送的应答指令与预先存储的所接收的固件升级包中预置的应答算法中的预设应答指令进行比较。在本实施例中，所述预设应答指令为上述与固件升级包的版本和安全校验指令关联的应答指令。如果所述设备发送的应答指令是所述设备根据已所刷写的固件升级包中预设的应答算法生成的，则所述设备发送的应答指令与预先存储的所接收的固件升级包中预置的应答算法中的预设应答指令相同，则确定固件安全升级；如果所述设备发送的应答指令与预先存储的 所接收的固件升级包中预置的应答算法中的预设应答指令不同，则表明相应固件所刷写的固件升级包存在安全风险，确定固件升级异常并进行记录，并通过网络发送安全告警，同时禁止采用OTA方式对设备进行操作，直到由风险解除流程进行解锁。
例如，在所述设备完成了固件升级包V1.0的刷写后，将一个安全校验指令a发送给所述设备，所述设备生成应答指令H，并将应答指令H进行回传。
根据预先存储的所接收的固件升级包中预置的应答算法，与安全校验指令a对应的固件升级包V1.0的应答指令为B，则所述预设应答指令为B。
接收所述设备基于所述安全校验指令a发送的应答指令H后，将所述设备发送的应答指令H与预先存储的所接收的固件升级包V1.0中预置的应答算法中的预设应答指令B进行比较。如果H＝B，则确定固件安全升级；如果H≠B，确定固件升级异常并进行记录，并通过网络发送安全告警，同时禁止采用OTA方式对设备进行操作，直到由风险解除流程进行解锁。
以下，以采用OTA方式对车辆进行远程固件升级为例，对本发明实施例1的固件安全升级方法进行说明。
如图2所示，其固件安全升级系统包括空中升级的OTA服务器、车内的安全芯片模块ESU和待刷写升级的电子单元ECU，所述OTA服务器中存储有挑战响应的Tag的挑战端算法即，本发明实施例1中的应答算法，所述车内安全芯片模块ESU执行本发明实施例1所述的固件安全升级方法的步骤。当有多个的安全校验指令时，所述应答算法可如表1所示。在本示例中，所述挑战端算法仅有一个安全校验指令AAA，例如，对于V1.1版本的固件，当接收到安全校验指令AAA时，反馈应答指令BBB。
第一步，OTA服务器将所述挑战端算法发送给所述车内的安全芯片模块ESU，所述车内的安全芯片模块ESU预先存储所述挑战端算法。
第二步，在空中升级的OTA服务器中具有或生成用于升级的固件包，即本发明实施例1中的固件升级包，在升级的固件包中预置所述挑战端算法。
由于本示例中的挑战端算法仅有一个安全校验指令AAA，所以在升级的固件包中预置所述挑战端算法具体为在升级的固件包中打入一个hardcode的挑战相应Tag，例如，对于V1.1版本的固件，当接收到安全校验指令AAA时，反馈应答指令BBB。
第三步，车内的安全芯片模块ESU获取升级的固件包，将其下载到车内的安全芯片模块ESU，进行解密和签名校验。如果校验通过，则车内的安全芯片模块ESU记录所述升级的固件包的版本号，例如V1.1，并发送固件刷写指令。
第四步，车内的安全芯片模块ESU或其他刷写控制部件根据刷写协议使用所述升级的固件包对待刷写升级的电子单元ECU进行固件刷写。固件刷写成功后，电子单元ECU运行新固件。
第五步，车内的安全芯片模块ESU根据记录的所述升级的固件包的版本号V1.1，发起挑战端算法，向所述电子单元ECU发送安全校验指令AAA(期待反馈预设应答指令BBB)。
第六步，所述电子单元ECU接收到车内的安全芯片模块ESU发送的安全校验指令AAA后，向安全芯片模块ESU发送应答指令。
如果所述电子单元ECU向车内的安全芯片模块ESU发送应答指令为预设应答指令BBB时，则所述车内 的安全芯片模块ESU确定应答正常，所述电子单元ECU的固件升级成功。如果所述电子单元ECU向安全芯片模块ESU发送应答指令不同于预设应答指令BBB时，则所述车内的安全芯片模块ESU确定应答异常，所述电子单元ECU所刷写的固件包存在安全风险，确定固件升级异常并进行记录，所述安全芯片模块ESU通过网络向车辆和/或OTA服务器发送安全告警，同时禁止采用OTA方式对车辆进行操作。
实施例2：
本发明实施例提出了一种固件安全升级装置，用于对设备进行固件升级，尤其适用于采用OTA(Over-the-Air)方式进行远程固件升级的情形，所述设备可以是汽车，如图3所示，包括固件升级包获取模块、固件刷写指令发送模块、安全校验指令发送模块、应答指令接收模块和判断模块。
固件升级包获取模块，对接收的固件升级包进行解密和签名校验。所述固件升级包在打包过程中，对固件升级包进行加密和添加数字签名，以确保固件升级包本身的安全性。其中，所述加密算法和签名算法可以是现有技术中任意可实现算法，本发明对此不做限制。当接收到固件升级包后，执行解密算法和签名校验，其中所述解密算法和加密算法相对应，签名校验过程与所述签名过程相对应。
进一步的，所述固件升级包中预先内置有针对安全校验指令生成相应应答指令的应答算法，在对固件升级包进行打包的过程中，预先写入针对安全校验指令生成相应应答指令的应答算法的逻辑实现程序，以进行后续的安全校验。其中所述固件升级包的不同版本对应相同的安全校验指令和不同的应答指令，且所述固件升级包的不同版本与其安全校验指令及应答指令存在唯一对应关系。
例如，所述应答算法针对不同的固件升级包的版本，响应于相同的安全校验指令a或b，具有不同的应答指令，如表1所示。即，响应于相同的安全校验指令a，固件升级包的版本V1.0的应答指令为B，固件升级包的版本V2.0的应答指令为C，固件升级包的版本V3.0的应答指令为D；响应于相同的安全校验指令b，固件升级包的版本V1.0的应答指令为X，固件升级包的版本V2.0的应答指令为Y，固件升级包的版本V3.0的应答指令为Z。因此，固件升级包的不同版本V1.0、V2.0、V3.0与其安全校验指令及应答指令存在表1所示的唯一对应关系。
基于上述应答算法，当所述签名校验成功后，固件升级包获取模块记录固件升级包的版本号，以便能够得到判断模块使用的预设应答指令。根据所记录的固件升级包的版本号，使用上述与固件升级包的版本相关的应答算法，即可得到所述预设应答指令，在本实施例中即为表1中与固件升级包的版本和安全校验指令关联的应答指令。
固件刷写指令发送模块，基于所述固件升级包向相应的待升级设备发送固件刷写指令。
当所述解密和签名校验过程成功后，获的所述固件升级包，基于该固件升级包向相应的待升级设备发送固件刷写指令，以启动固件刷写流程。
所述待升级设备根据刷写协议使用固件升级包进行固件刷写，将固件升级包加载至对应的存储模块中，并将固件的版本信息更新为固件升级包的版本。
在固件升级包刷写过程中，固件刷写指令发送模块对所述设备进行安全检测，以确定固件升级过程中的安全性。检测内容包括设备内网中是否有劫持和/或篡改的干扰数据包、被刷写的固件是否处于正常的工况、以及所述设备是否存在异常的网络连接，例如攻击者的连接。如果存在上述情况之一，则可停止刷 写当前版本的固件升级包，并恢复之前的固件版本。
在完成固件刷写后，所述设备发送刷写成功指令。
安全校验指令发送模块，基于接收的所述设备发送的刷写成功指令，向所述设备发送安全校验指令。所述设备接收到安全校验指令，使用已刷写的固件升级包中的预置应答算法，针对已刷写的固件升级包的版本，发送相应的应答指令。
应答指令接收模块，接收所述设备基于所述安全校验指令发送的应答指令。
判断模块，当所述应答指令为预设应答指令时，发送升级成功的消息以完成固件升级。具体的，在接收到所述设备发送的应答指令后，判断模块将所述设备发送的应答指令与预先存储的所接收的固件升级包中预置的应答算法中的预设应答指令进行比较。在本实施例中，所述预设应答指令为上述与固件升级包的版本和安全校验指令关联的应答指令。如果所述设备发送的应答指令是所述设备根据已所刷写的固件升级包中预设的应答算法生成的，则所述设备发送的应答指令与预先存储的所接收的固件升级包中预置的应答算法中的预设应答指令相同，则判断模块确定固件安全升级；如果所述设备发送的应答指令与预先存储的所接收的固件升级包中预置的应答算法中的预设应答指令不同，则表明相应固件所刷写的固件升级包存在安全风险，判断模块确定固件升级异常并进行记录，并通过网络发送安全告警，同时禁止采用OTA方式对设备进行操作，直到由风险解除流程进行解锁。
例如，在所述设备完成了固件升级包V1.0的刷写后，将一个安全校验指令a发送给所述设备，所述设备生成应答指令H，并将应答指令H进行回传。
根据预先存储的所接收的固件升级包中预置的应答算法，与安全校验指令a对应的固件升级包V1.0的应答指令为B，则所述预设应答指令为B。
判断模块接收所述设备基于所述安全校验指令a发送的应答指令H后，将所述设备发送的应答指令H与预先存储的所接收的固件升级包V1.0中预置的应答算法中的预设应答指令B进行比较。如果H＝B，则确定固件安全升级；如果H≠B，确定固件升级异常并进行记录，并通过网络发送安全告警，同时禁止采用OTA方式对设备进行操作，直到由风险解除流程进行解锁。
实施例3：
本发明实施例提出了一种固件安全升级方法，用于对设备进行固件升级，尤其适用于采用OBD接口方式进行固件升级的情形，如图4所示，包括如下步骤：
S21，接收对待升级设备的固件刷写指令，进入监听模式。
具体的，监听CAN总线或设备所在局域网中的刷写指令，在监听到对待升级设备的固件刷写指令后，进入监听模式，以监听固件的刷写进度。
在线诊断仪接收固件升级包，使用秘钥和数字证书，对接收的固件升级包进行解密和签名校验，并根据刷写协议使用固件升级包进行固件刷写，将固件升级包加载至对应的存储模块中，并将固件的版本信息更新为固件升级包的版本号。其中，所述固件升级包在打包过程中，对固件升级包进行加密和添加数字签名，以确保固件升级包本身的安全性。其中，所述加密算法和签名算法可以是现有技术中任意可实现算法，本发明对此不做限制。当接收到固件升级包后，执行解密算法和签名校验，其中所述解密算法和加密算法 相对应，签名校验过程与所述签名过程相对应。
进一步的，所述固件升级包中预先内置有针对安全校验指令生成相应应答指令的应答算法，在对固件升级包进行打包的过程中，预先写入针对安全校验指令生成相应应答指令的应答算法的逻辑实现程序，以进行后续的安全校验。其中所述固件升级包的不同版本对应相同的安全校验指令和不同的应答指令，且所述固件升级包的不同版本与其安全校验指令及应答指令存在唯一对应关系。
例如，所述应答算法针对不同的固件升级包的版本，响应于相同的安全校验指令a或b，具有不同的应答指令，如表1所示。即，响应于相同的安全校验指令a，固件升级包的版本V1.0的应答指令为B，固件升级包的版本V2.0的应答指令为C，固件升级包的版本V3.0的应答指令为D；响应于相同的安全校验指令b，固件升级包的版本V1.0的应答指令为X，固件升级包的版本V2.0的应答指令为Y，固件升级包的版本V3.0的应答指令为Z。因此，固件升级包的不同版本V1.0、V2.0、V3.0与其安全校验指令及应答指令存在表1所示的唯一对应关系。
S22，监听到所述设备的刷写成功指令后，向所述设备发送安全校验指令。
基于与固件升级包的版本相关的上述应答算法，所述设备接收到安全校验指令，需要回传应答指令以及所述固件升级包的版本号。正常情况下，所述设备使用已刷写的固件升级包中的预置应答算法，针对已刷写的固件升级包的版本，发送相应的应答指令。
S23，接收所述设备基于所述安全校验指令发送的应答指令并验证。
在本实施例中，基于与固件升级包的版本相关的上述应答算法，在接收所述设备发送的应答指令的同时，接收所述固件升级包的版本号，从而能够根据所接收的固件升级包的版本号，使用上述与固件升级包的版本相关的应答算法，得到预设应答指令，即，表1中与固件升级包的版本和安全校验指令关联的应答指令，以便于在后续步骤S24中与设备发送的应答指令进行比较。
S24，当所述应答指令为预设应答指令时，发送升级成功的消息以完成固件升级。具体的，在接收到所述设备发送的应答指令后，将所述设备发送的应答指令与预先存储的所述固件升级包中预置的应答算法中的预设应答指令进行比较。在本实施例中，所述预设应答指令为上述与固件升级包的版本和安全校验指令关联的应答指令。如果所述设备发送的应答指令是所述设备根据已所刷写的固件升级包中预设的应答算法生成的，则所述设备发送的应答指令与预先存储的所述固件升级包中预置的应答算法中的预设应答指令相同，则确定固件安全升级；如果所述设备发送的应答指令与预先存储的所述固件升级包中预置的应答算法中的预设应答指令不同，则表明相应固件所刷写的固件升级包存在安全风险，确定固件升级异常并进行记录，并通过网络发送安全告警，同时禁止采用OBD方式对设备进行操作，直到由风险解除流程进行解锁。
例如，在所述设备完成了固件升级包V1.0的刷写后，将一个安全校验指令a发送给所述设备，所述设备生成应答指令H，并将应答指令H和固件升级包的版本号V1.0进行回传。
根据预先存储的所述固件升级包中预置的应答算法，与安全校验指令a对应的固件升级包V1.0的应答指令为B，则所述预设应答指令为B。
接收所述设备基于所述安全校验指令a发送的应答指令H和固件升级包的版本号V1.0后，将所述设备发送的应答指令H与预先存储的所述固件升级包V1.0中预置的应答算法中的预设应答指令B进行比较。如果H＝B，则确定固件安全升级；如果H≠B，确定固件升级异常并进行记录，并通过网络发送安全告警， 同时禁止采用OBD方式对设备进行操作，直到由风险解除流程进行解锁。
以下，以采用OBD接口方式对车辆固件升级为例，对本发明实施例3的固件安全升级方法进行说明。
如图5所示，其固件安全升级系统包括固件生成服务器、诊断仪、车内的安全芯片模块ESU和待刷写升级的电子单元ECU，所述固件生成服务器中存储有挑战响应的Tag的挑战端算法即，本发明实施例3中的应答算法，所述车内安全芯片模块ESU执行本发明实施例3所述的固件安全升级方法的步骤。当有多个的安全校验指令时，所述应答算法可如表1所示。在本示例中，所述挑战端算法仅有一个安全校验指令AAA，例如，对于V1.1版本的固件，当接收到安全校验指令AAA时，反馈应答指令BBB。
第一步，固件生成服务器将所述挑战端算法发送给所述车内的安全芯片模块ESU，所述车内的安全芯片模块ESU预先存储所述挑战端算法。
第二步，在固件生成服务器中生成用于升级的固件包，即本发明实施例1中的固件升级包，在升级的固件包中预置所述挑战端算法。
由于本示例中的挑战端算法仅有一个安全校验指令AAA，所以在升级的固件包中预置所述挑战端算法具体为在升级的固件包中打入一个hardcode的挑战相应Tag，例如，对于V1.1版本的固件，当接收到安全校验指令AAA时，反馈应答指令BBB。
第三步，所述诊断仪从固件生成服务器获取升级的固件包，例如V1.1版本的固件包。所述诊断仪以物理方式接入车辆的OBD接口，对电子元件ECU进行固件升级刷写。
第四步，所述诊断仪根据刷写协议使用所述升级的固件包对待刷写升级的电子单元ECU进行固件刷写。
固件刷写成功后，电子单元ECU运行新固件。
第五步，所述车内的安全芯片模块ESU监听CAN总线或车辆所在局域网中的刷写指令，在监听到对待刷写升级的电子单元ECU的固件刷写指令后，进入监听模式，以监听固件的刷写进度。
当所述车内的安全芯片模块ESU监听到所述电子单元ECU完成了升级的固件包的刷写后，向所述电子单元ECU发起挑战端算法，向所述电子单元ECU发送安全校验指令AAA。
第六步，所述电子单元ECU接收到车内的安全芯片模块ESU发送的安全校验指令AAA后，向安全芯片模块ESU发送应答指令以及所述升级的固件包的版本号V1.1。
所述车内的安全芯片模块ESU根据所述电子单元ECU发送的固件包的版本号V1.1，利用预先存储的所述挑战端算法，得到期待反馈的预设应答指令BBB。
如果所述电子单元ECU向车内的安全芯片模块ESU发送应答指令为预设应答指令BBB时，则所述车内的安全芯片模块ESU确定应答正常，所述电子单元ECU的固件升级成功。如果所述电子单元ECU向安全芯片模块ESU发送应答指令不同于预设应答指令BBB时，则所述车内的安全芯片模块ESU确定应答异常，所述电子单元ECU所刷写的固件包存在安全风险，确定固件升级异常并进行记录，所述安全芯片模块ESU通过网络向车辆和/或固件生成服务器发送安全告警，同时禁止采用OTA方式对车辆进行操作。
实施例4：
本发明实施例提出了一种固件安全升级装置，用于对设备进行固件升级，尤其适用于采用OBD接口方式进行固件升级的情形，所述设备可以是汽车，如图6所示，包括监听模块、安全校验指令发送模块、应 答指令接收模块和判断模块。其中，
监听模块，接收对待升级设备的固件刷写指令，进入监听模式。
具体的，监听CAN总线或设备所在局域网中的刷写指令，在监听到对待升级设备的固件刷写指令后，进入监听模式，以监听固件的刷写进度。
在线诊断仪接收固件升级包，使用秘钥和数字证书，对接收的固件升级包进行解密和签名校验，并根据刷写协议使用固件升级包进行固件刷写，将固件升级包加载至对应的存储模块中，并将固件的版本信息更新为固件升级包的版本号。其中，所述固件升级包在打包过程中，对固件升级包进行加密和添加数字签名，以确保固件升级包本身的安全性。其中，所述加密算法和签名算法可以是现有技术中任意可实现算法，本发明对此不做限制。当接收到固件升级包后，执行解密算法和签名校验，其中所述解密算法和加密算法相对应，签名校验过程与所述签名过程相对应。
进一步的，所述固件升级包中预先内置有针对安全校验指令生成相应应答指令的应答算法，在对固件升级包进行打包的过程中，预先写入针对安全校验指令生成相应应答指令的应答算法的逻辑实现程序，以进行后续的安全校验。其中所述固件升级包的不同版本对应相同的安全校验指令和不同的应答指令，且所述固件升级包的不同版本与其安全校验指令及应答指令存在唯一对应关系。
例如，所述应答算法针对不同的固件升级包的版本，响应于相同的安全校验指令a或b，具有不同的应答指令，如表1所示。即，响应于相同的安全校验指令a，固件升级包的版本V1.0的应答指令为B，固件升级包的版本V2.0的应答指令为C，固件升级包的版本V3.0的应答指令为D；响应于相同的安全校验指令b，固件升级包的版本V1.0的应答指令为X，固件升级包的版本V2.0的应答指令为Y，固件升级包的版本V3.0的应答指令为Z。因此，固件升级包的不同版本V1.0、V2.0、V3.0与其安全校验指令及应答指令存在表1所示的唯一对应关系。
在监听模块监听到所述设备的刷写成功指令后，安全校验指令发送模块向所述设备发送安全校验指令。
基于与固件升级包的版本相关的上述应答算法，所述设备接收到安全校验指令，需要回传应答指令以及所述固件升级包的版本号。正常情况下，所述设备使用已刷写的固件升级包中的预置应答算法，针对已刷写的固件升级包的版本，发送相应的应答指令。
应答指令接收模块，接收所述设备基于所述安全校验指令发送的应答指令。
在本实施例中，基于与固件升级包的版本相关的上述应答算法，应答指令接收模块在接收所述设备发送的应答指令的同时，接收所述固件升级包的版本号，以便能够得到判断模块使用的预设应答指令。根据所接收的固件升级包的版本号，使用上述与固件升级包的版本相关的应答算法，即可得到预设应答指令，即，表1中与固件升级包的版本和安全校验指令关联的应答指令。
判断模块，当所述应答指令为预设应答指令时，发送升级成功的消息以完成固件升级。具体的，在接收到所述设备发送的应答指令后，判断模块将所述设备发送的应答指令与预先存储的所述固件升级包中预置的应答算法中的预设应答指令进行比较。在本实施例中，所述预设应答指令为上述与固件升级包的版本和安全校验指令关联的应答指令。如果所述设备发送的应答指令是所述设备根据已所刷写的固件升级包中预设的应答算法生成的，则所述设备发送的应答指令与预先存储的所述固件升级包中预置的应答算法中的预设应答指令相同，则判断模块确定固件安全升级；如果所述设备发送的应答指令与预先存储的所述固件 升级包中预置的应答算法中的预设应答指令不同，则表明相应固件所刷写的固件升级包存在安全风险，判断模块确定固件升级异常并进行记录，并通过网络发送安全告警，同时禁止采用OBD方式对设备进行操作，直到由风险解除流程进行解锁。
例如，在所述设备完成了固件升级包V1.0的刷写后，将一个安全校验指令a发送给所述设备，所述设备生成应答指令H，并将应答指令H和固件升级包的版本号V1.0进行回传。
根据预先存储的所述固件升级包中预置的应答算法，与安全校验指令a对应的固件升级包V1.0的应答指令为B，则所述预设应答指令为B。
判断模块接收所述设备基于所述安全校验指令a发送的应答指令H和固件升级包的版本号V1.0后，将所述设备发送的应答指令H与预先存储的所述固件升级包V1.0中预置的应答算法中的预设应答指令B进行比较。如果H＝B，则确定固件安全升级；如果H≠B，确定固件升级异常并进行记录，并通过网络发送安全告警，同时禁止采用OBD方式对设备进行操作，直到由风险解除流程进行解锁。
本发明实施例还提出一种车载系统，所述车载系统内置有本发明实施例2所述的基于OTA远程升级的固件安全升级装置和/或本发明实施例4所述的基于OBD接口方式进行升级的固件安全升级装置，所述固件安全升级装置控制车辆进行固件升级，确保固件安全升级。
本发明实施例还提出一种车辆，所述车辆包括如上所述的车载系统，从而使得所述车辆具有固件安全升级的功能。
本发明实施例还提出一种计算机可读存储介质，其上存储有计算机程序，该计算机程序被处理器执行时实现上述方法的步骤。
本发明实施例还提出一种计算机设备，包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，所述处理器执行所述程序时实现上述方法的步骤。
本领域技术人员可以理解，在流程图中表示或在此以其他方式描述的逻辑和/或步骤，例如，可以被认为是用于实现逻辑功能的可执行指令的定序列表，可以具体实现在任何计算机可读介质中，以供指令执行系统、装置或设备(如基于计算机的系统、包括处理器的系统或其他可以从指令执行系统、装置或设备取指令并执行指令的系统)使用，或结合这些指令执行系统、装置或设备而使用。就本说明书而言，“计算机可读介质”可以是任何可以包含、存储、通信、传播或传输程序以供指令执行系统、装置或设备或结合这些指令执行系统、装置或设备而使用的装置。
计算机可读介质的更具体的示例(非穷尽性列表)包括以下：具有一个或多个布线的电连接部(电子装置)，便携式计算机盘盒(磁装置)，随机存取存储器(RAM)，只读存储器(ROM)，可擦除可编辑只读存储器(EPROM或闪速存储器)，光纤装置，以及便携式光盘只读存储器(CDROM)。另外，计算机可读介质甚至可以是可在其上打印所述程序的纸或其他合适的介质，因为可以例如通过对纸或其他介质进行光学扫描，接着进行编辑、解译或必要时以其他合适方式进行处理来以电子方式获得所述程序，然后将其存储在计算机存储器中。
应当理解，本发明的各部分可以用硬件、软件、固件或它们的组合来实现。在上述实施方式中，多个步骤或方法可以用存储在存储器中且由合适的指令执行系统执行的软件或固件来实现。例如，如果用硬件 来实现，和在另一实施方式中一样，可用本领域公知的下列技术中的任一项或它们的组合来实现：具有用于对数据信号实现逻辑功能的逻辑门电路的离散逻辑电路，具有合适的组合逻辑门电路的专用集成电路，可编程门阵列(PGA)，现场可编程门阵列(FPGA)等。
在本说明书的描述中，参考术语“一个实施例”、“一些实施例”、“示例”、“具体示例”、或“一些示例”等的描述意指结合该实施例或示例描述的具体特征、结构、材料或者特点包含于本发明的至少一个实施例或示例中。在本说明书中，对上述术语的示意性表述不一定指的是相同的实施例或示例。而且，描述的具体特征、结构、材料或者特点可以在任何的一个或多个实施例或示例中以合适的方式结合。
以上，对本发明的实施方式进行了说明。但是，本发明不限定于上述实施方式。凡在本发明的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。

Claims (15)

  1. 一种固件安全升级方法，其特征在于，包括如下步骤：
    对接收的固件升级包进行解密和签名校验；
    基于所述固件升级包向相应的待升级设备发送固件刷写指令；
    基于接收的所述设备发送的刷写成功指令，向所述设备发送安全校验指令；
    接收所述设备基于所述安全校验指令发送的应答指令并验证；
    当所述应答指令为预设应答指令时，发送升级成功的消息以完成固件升级。
  2. 如权利要求1所述的固件安全升级方法，其特征在于，所述固件升级包中预先内置有针对安全校验指令生成相应应答指令的应答算法，其中固件升级包的不同版本对应相同的安全校验指令和不同的应答指令，且所述固件升级包的不同版本与其安全校验指令及应答指令存在唯一对应关系。
  3. 如权利要求2所述的固件安全升级方法，其特征在于，所述接收的固件升级包进行解密和签名校验步骤中，当所述签名校验成功后，记录固件升级包的版本号。
  4. 如权利要求2所述的固件安全升级方法，其特征在于，在所述应答指令验证步骤中，如果所述设备发送的应答指令与预先存储的所接收的固件升级包中预置的应答算法中的预设应答指令相同，则确定固件安全升级；如果所述设备发送的应答指令与预先存储的所接收的固件升级包中预置的应答算法中的预设应答指令不同，则确定固件升级异常。
  5. 如权利要求1所述的固件安全升级方法，其特征在于，在固件升级包刷写过程中，对所述设备进行安全检测，以确保固件升级过程中的安全性。
  6. 如权利要求1所述的固件安全升级方法，其特征在于，进一步包括，当所述应答指令与所述预设应答指令不一致时，发送异常告警。
  7. 一种固件安全升级装置，其特征在于，所述固件安全升级装置包括固件升级包获取模块、固件刷写指令发送模块、安全校验指令发送模块、应答指令接收模块和判断模块，其中，
    固件升级包获取模块对接收的固件升级包进行解密和签名校验；
    固件刷写指令发送模块基于所述固件升级包向相应的待升级设备发送固件刷写指令；
    安全校验指令发送模块基于接收的所述设备发送的刷写成功指令，向所述设备发送安全校验指令；
    应答指令接收模块接收所述设备基于所述安全校验指令发送的应答指令；
    判断模块在所述应答指令为预设应答指令时发送升级成功的消息以完成固件升级。
  8. 一种固件安全升级方法，其特征在于，包括以下步骤：
    接收对待升级设备的固件刷写指令，进入监听模式；
    监听到待升级设备的固件升级包刷写成功指令后，向所述设备发送安全校验指令；
    接收所述设备基于所述安全校验指令发送的应答指令并验证；
    当所述应答指令为预设应答指令时，发送升级成功的消息以完成固件升级。
  9. 如权利要求8所述的固件安全升级方法，其特征在于，所述固件升级包中预先内置有针对安全校验指令生成相应应答指令的应答算法，其中固件升级包的不同版本对应相同的安全校验指令和不同的应答指 令，且所述固件升级包的不同版本与其安全校验指令及应答指令存在唯一对应关系。
  10. 如权利要求9所述的固件安全升级方法，其特征在于，接收所述设备发送的应答指令的同时，接收所述固件升级包的版本号。
  11. 如权利要求9所述的固件安全升级方法，其特征在于，在所述应答指令验证步骤中，如果所述设备发送的应答指令与预先存储的所述固件升级包中预置的应答算法中的预设应答指令相同，则确定固件安全升级；如果所述设备发送的应答指令与预先存储的所述固件升级包中预置的应答算法中的预设应答指令不同，则确定固件升级异常。
  12. 如权利要求9所述的固件安全升级方法，其特征在于，进一步包括，当所述应答指令与所述预设应答指令不一致时，发送异常告警。
  13. 一种固件安全升级装置，其特征在于，所述固件安全升级装置包括监听模块、安全校验指令发送模块、应答指令接收模块和判断模块，其中，
    监听模块，接收对待升级设备的固件刷写指令，进入监听模式；
    安全校验指令发送模块，在监听模块监听到所述设备的刷写成功指令后，向所述设备发送安全校验指令；
    应答指令接收模块，接收所述设备基于所述安全校验指令发送的应答指令；
    判断模块，当所述应答指令为预设应答指令时，发送升级成功的消息以完成固件升级。
  14. 一种车载系统，其特征在于，所述车载系统内置有如权利要求7和/或13所述的固件安全升级装置。
  15. 一种车辆，其特征在于，所述车辆包括如权利要求14所述的车载系统。
PCT/CN2019/093435 2018-12-19 2019-06-28 固件安全升级方法、装置、车载系统和车辆 WO2020124985A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP19901007.5A EP3889766B1 (en) 2018-12-19 2019-06-28 Secure firmware upgrade method, device, on-board system, and vehicle

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201811558091.5 2018-12-19
CN201811558091.5A CN109697081B (zh) 2018-12-19 2018-12-19 固件安全升级方法、装置、车载系统和车辆

Publications (2)

Publication Number Publication Date
WO2020124985A1 WO2020124985A1 (zh) 2020-06-25
WO2020124985A9 true WO2020124985A9 (zh) 2021-06-24

Family

ID=66231772

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/093435 WO2020124985A1 (zh) 2018-12-19 2019-06-28 固件安全升级方法、装置、车载系统和车辆

Country Status (3)

Country Link
EP (1) EP3889766B1 (zh)
CN (1) CN109697081B (zh)
WO (1) WO2020124985A1 (zh)

Families Citing this family (18)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109697081B (zh) * 2018-12-19 2021-04-13 广州小鹏汽车科技有限公司 固件安全升级方法、装置、车载系统和车辆
CN110276201B (zh) * 2019-06-18 2021-09-03 广州小鹏汽车科技有限公司 一种车载系统的安全检测方法、系统及服务设备
CN110347412B (zh) * 2019-06-27 2023-05-30 中国第一汽车股份有限公司 电子控制单元固件升级管理方法、装置、设备和存储介质
CN111158736B (zh) * 2019-12-25 2023-04-28 北京珞安科技有限责任公司 一种智能捕获windows操作系统补丁更新文件的方法
CN113138775B (zh) * 2020-01-20 2022-11-18 上海交通大学 车载诊断系统固件保护方法及系统
CN111880824A (zh) * 2020-07-24 2020-11-03 欧姆龙(上海)有限公司 固件数据的校验设备和方法、固件更新设备和方法及系统
CN111964922A (zh) * 2020-08-28 2020-11-20 福瑞泰克智能系统有限公司 智能驾驶车辆测试系统
CN112202602B (zh) * 2020-09-24 2023-06-23 蜂鸟智超新能源技术(上海)有限公司 一种基于can总线的充电桩远程升级系统及方法
CN112527326A (zh) * 2020-12-02 2021-03-19 上海星融汽车科技有限公司 免拆板ecu跨厂家刷写系统及方法
CN112559419A (zh) * 2020-12-21 2021-03-26 厦门市美亚柏科信息股份有限公司 一种pcie存储模块的固件升级保护方法、装置
CN115145610A (zh) * 2021-03-31 2022-10-04 上海擎感智能科技有限公司 一种车载系统及其软件的升级方法
CN113778489B (zh) * 2021-09-14 2024-01-30 上海芯钛信息科技有限公司 一种从硬件层面支持不停车ota的方法及系统
CN114428630B (zh) * 2022-03-31 2022-07-01 浙江地芯引力科技有限公司 芯片算法升级方法、装置和芯片
CN114866585A (zh) * 2022-04-24 2022-08-05 深圳市元征科技股份有限公司 远程升级方法、装置、系统及设备端接头
CN114793196B (zh) * 2022-06-21 2022-09-13 国汽智控(北京)科技有限公司 固件升级方法、装置、设备和存储介质
CN114995860B (zh) * 2022-08-01 2022-11-11 摩尔线程智能科技(北京)有限责任公司 图形处理器固件升级的方法和图形处理器
CN115314386B (zh) * 2022-08-08 2024-02-20 矩阵时光数字科技有限公司 一种量子安全设备的固件升级系统
CN116661821A (zh) * 2023-05-10 2023-08-29 浙江简捷物联科技有限公司 一种应用升级方法、装置、电子设备及存储介质

Family Cites Families (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8429643B2 (en) * 2007-09-05 2013-04-23 Microsoft Corporation Secure upgrade of firmware update in constrained memory
CN102981881B (zh) * 2012-12-10 2018-03-27 中兴通讯股份有限公司 一种防止移动终端升级到非法固件版本的方法及系统
CN105760750B (zh) * 2016-02-01 2019-06-14 北京华胜天成科技股份有限公司 软件篡改识别方法和系统
US10855462B2 (en) * 2016-06-14 2020-12-01 Honeywell International Inc. Secure in-band upgrade using key revocation lists and certificate-less asymmetric tertiary key pairs
CN106843932B (zh) * 2016-12-26 2020-07-24 歌尔科技有限公司 虚拟现实设备固件的升级方法及系统
CN106843942B (zh) * 2016-12-31 2021-04-30 歌尔科技有限公司 穿戴式设备的固件升级方法及穿戴式设备
US20180300477A1 (en) * 2017-04-13 2018-10-18 Argus Cyber Security Ltd. In-vehicle cyber protection
CN107479924B (zh) * 2017-08-09 2020-07-28 四川长虹电器股份有限公司 基于Android系统的软件升级校验方法
CN108037931B (zh) * 2017-12-06 2021-02-02 广州路派电子科技有限公司 一种对微处理器存储单元进行文件烧写的方法
CN108170447A (zh) * 2017-12-08 2018-06-15 摩比天线技术（深圳）有限公司 芯片在线自动烧录方法和系统
CN108304722A (zh) * 2017-12-21 2018-07-20 广州小鹏汽车科技有限公司 一种软件安装包及其生成方法、升级方法和系统
CN107992321B (zh) * 2017-12-28 2021-04-27 国机智骏汽车有限公司 Ecu软件更新方法、装置、车载t-box及车辆
CN108196867A (zh) * 2018-03-08 2018-06-22 深圳市文鼎创数据科技有限公司 设备的固件升级装置、设备及其固件升级方法
CN109697081B (zh) * 2018-12-19 2021-04-13 广州小鹏汽车科技有限公司 固件安全升级方法、装置、车载系统和车辆

Also Published As

Publication number Publication date
EP3889766A1 (en) 2021-10-06
EP3889766A4 (en) 2022-06-08
WO2020124985A1 (zh) 2020-06-25
CN109697081A (zh) 2019-04-30
EP3889766B1 (en) 2024-01-24
CN109697081B (zh) 2021-04-13

Similar Documents

Publication Publication Date Title
WO2020124985A9 (zh) 固件安全升级方法、装置、车载系统和车辆
CN103685214B (zh) 用于汽车电子控制单元的安全访问方法
US20110083161A1 (en) Vehicle, maintenance device, maintenance service system, and maintenance service method
US11182485B2 (en) In-vehicle apparatus for efficient reprogramming and controlling method thereof
CN107430658B (zh) 安全软件认证及验证
US11409872B2 (en) Confirming a version of firmware loaded to a processor-based device
US9767264B2 (en) Apparatus, method for controlling apparatus, and program
CN111142500B (zh) 车辆诊断数据的权限设置方法、装置及车载网关控制器
JP6712538B2 (ja) 改竄検知システム
CN112104603B (zh) 车辆接口的访问权限控制方法、装置及系统
CN113138775B (zh) 车载诊断系统固件保护方法及系统
CN111651748A (zh) 一种车内ecu的安全访问处理系统及其方法
CN113645590B (zh) 基于加密算法的远程控制车辆的方法、装置、设备及介质
JP2007534544A (ja) 車両内の制御機器の認証
US20040003232A1 (en) Method and system for vehicle component authentication of another vehicle component
JP6659180B2 (ja) 制御装置および制御方法
CN111508110B (zh) 一种实现车辆远程锁定的方法及装置
CN110633172A (zh) U盘以及u盘的数据同步方法
US20230401317A1 (en) Security method and security device
US20200050799A1 (en) Storage device and data tampering detection method
US20220182248A1 (en) Secure startup method, controller, and control system
CN113935013A (zh) 用于对控制设备进行安全更新的方法
US10789365B2 (en) Control device and control method
WO2020090418A1 (ja) 電子制御装置、電子制御装置のリプログラミング方法
Schneider et al. Cyber Security in the Automotive Domain–An Overview

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19901007

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2019901007

Country of ref document: EP

Effective date: 20210628