WO2021159530A1 - 一种车载设备升级方法及相关装置 - Google Patents

一种车载设备升级方法及相关装置 Download PDF

Info

Publication number
WO2021159530A1
WO2021159530A1 PCT/CN2020/075427 CN2020075427W WO2021159530A1 WO 2021159530 A1 WO2021159530 A1 WO 2021159530A1 CN 2020075427 W CN2020075427 W CN 2020075427W WO 2021159530 A1 WO2021159530 A1 WO 2021159530A1
Authority
WO
WIPO (PCT)
Prior art keywords
vehicle
data segment
check value
segment
mounted device
Prior art date
Application number
PCT/CN2020/075427
Other languages
English (en)
French (fr)
Inventor
殷新星
魏卓
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to JP2021540470A priority Critical patent/JP7371103B2/ja
Priority to EP20897624.1A priority patent/EP3893108B1/en
Priority to CN202080004114.7A priority patent/CN112534793A/zh
Priority to PCT/CN2020/075427 priority patent/WO2021159530A1/zh
Priority to MX2021009503A priority patent/MX2021009503A/es
Priority to US17/345,542 priority patent/US11321074B2/en
Publication of WO2021159530A1 publication Critical patent/WO2021159530A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00—Arrangements for software engineering
    • G06F8/60—Software deployment
    • G06F8/65—Updates
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/575—Secure boot
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0869—Network architectures or network communication protocols for network security for authentication of entities for achieving mutual authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/123—Applying verification of the received information received data contents, e.g. message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/126—Applying verification of the received information the source of the received data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/16—Implementing security features at a particular protocol layer
    • H04L63/166—Implementing security features at a particular protocol layer at the transport layer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/16—Implementing security features at a particular protocol layer
    • H04L63/168—Implementing security features at a particular protocol layer above the transport layer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/12—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/34—Network arrangements or protocols for supporting network services or applications involving the movement of software or configuration parameters 
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3239—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3242—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3271—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response
    • H04L9/3273—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response for mutual authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/50—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using hash chains, e.g. blockchains or hash trees
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/30—Services specially adapted for particular environments, situations or purposes
    • H04W4/40—Services specially adapted for particular environments, situations or purposes for vehicles, e.g. vehicle-to-pedestrians [V2P]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/84—Vehicles

Definitions

  • This application relates to the field of information technology, and in particular to a method for upgrading on-board equipment and related devices.
  • Over the air is a technology for remotely managing and updating firmware in electronic devices through an air interface.
  • OTA upgrade has the characteristics of high efficiency, convenience, and low cost.
  • OTA technology has been deployed by many vehicle manufacturers (original equipment manufacturer, OEM) models to upgrade the vehicle's electronic control unit (ECU) and other firmware.
  • OEM original equipment manufacturer
  • the vehicle's on-board unit (telematics box, Tbox) can obtain the software upgrade package issued by the OEM cloud server through a wireless link, and flash the software upgrade package to the vehicle's ECU and other firmware.
  • the embodiments of the present application disclose a method and related devices for upgrading on-board equipment, which can effectively improve the security of the upgrade file transmission process.
  • an embodiment of the present application discloses a method for upgrading an in-vehicle device, and the method includes:
  • the first in-vehicle device processes the first data segment by the first algorithm to obtain the first check value; the first data segment is used to upgrade the second in-vehicle device in the multiple data segments contained in the upgrade file In any data segment, the first check value is used to send to the second vehicle-mounted device;
  • the first encrypted segment to the second in-vehicle device for the second in-vehicle device to pass the first check value when the first algorithm is used to verify that the first check value is passed.
  • the first data segment obtained by decrypting the first encrypted segment with a key is stored in the second vehicle-mounted device; the first data segment is used for the second vehicle-mounted device to compose the Upgrade files to upgrade.
  • each of the multiple data segments used to upgrade the upgrade file of the second vehicle-mounted device is individually encrypted and transmitted, which can effectively reduce the risk of each data segment being stolen.
  • the receiving end that is, the second vehicle-mounted device
  • the second vehicle-mounted device needs to verify the check value corresponding to each data segment, instead of verifying the entire upgrade file only after the transmission of the last data segment is completed, it can be found in time.
  • the tampered abnormal data segment is triggered and the transmission of the new data segment is stopped in time after the abnormal data segment is found, thereby effectively improving the security of the upgrade file transmission process.
  • the method before the first in-vehicle device processes the first data segment by the first algorithm to obtain the first check value, the method further includes:
  • the first vehicle-mounted device and the download server perform two-way authentication of Hypertext Transfer Security Protocol HTTPS; the download server is used to provide the upgrade file for the second vehicle-mounted device;
  • the encrypted file is decrypted to obtain the upgrade file.
  • the download server that provides the upgrade file is a server that performs two-way authentication of the HTTPS protocol with the first in-vehicle device, ensuring the legitimacy of the source of the upgrade file, and avoiding unauthorized platforms from sending malicious upgrade files to the first in-vehicle device It also avoids the situation that the attacker imitates the first in-vehicle device and steals the upgrade file containing important information issued by the download server.
  • the encrypted upgrade file is transmitted between the download server and the first in-vehicle device, which can effectively reduce the risk of the upgrade file being stolen, thereby effectively improving the security of the upgrade file transmission process.
  • the first check value is Output data obtained by using the first data segment as the input of the first algorithm
  • the first check value is the first data segment And a second check value as output data obtained by inputting the first algorithm; the second check value is obtained by processing the previous data segment of the first data segment by the first algorithm.
  • the check values corresponding to the other data segments except the first data segment are all related to the check value corresponding to the previous data segment, which is realized by the hash chain
  • the sequence detection mechanism of data segmentation avoids the situation that the successful flashing of out-of-sequence segmentation leads to errors in the assembly of the upgrade file.
  • the verification value is realized by the hash chain method and also increases the difficulty of malicious cracking.
  • the first encrypted segment is obtained by encrypting the first data segment and the first check value by using the first key.
  • the first check value can also be encrypted, thereby further improving the security of the upgrade file transmission process.
  • the first key is a pre-shared key configured in advance for the first in-vehicle device and the second in-vehicle device.
  • each data segment can be ensured through the pre-configured pre-shared key, rather than the key obtained through the negotiation of a security protocol or a security algorithm, which can effectively reduce the cost of the first vehicle device and the second vehicle device. LF.
  • the first key is a key obtained by mutual authentication and negotiation of the transport layer security protocol TLS between the first vehicle-mounted device and the second vehicle-mounted device.
  • the encryption of each data segment with the key obtained through the TLS protocol negotiation can ensure the confidentiality of each data segment, and for different second vehicle devices, the first vehicle device and the second vehicle device perform the The two-way authentication process is different, and the negotiated first key can also be different, that is, the encryption and decryption keys corresponding to different upgrade files can be different, thereby greatly improving the security of the upgrade file transmission process.
  • the first key is a key obtained by performing mutual authentication negotiation of the TLS protocol between the first in-vehicle device and the second in-vehicle device;
  • the first check value is a message authentication code of the first data segment obtained by processing the first data segment by the first algorithm based on the TLS protocol.
  • an embodiment of the present application provides a method for upgrading an in-vehicle device, including:
  • the second in-vehicle device receives the first encrypted segment sent by the first in-vehicle device; the first encrypted segment is obtained by encrypting the first data segment with the first key, and the first data segment is used for Upgrading any one of the multiple data segments included in the upgrade file of the second vehicle-mounted device;
  • the first check value is verified by the first algorithm
  • the first data is stored in the second vehicle-mounted device in segments
  • the first check value is the first vehicle-mounted device Obtained by processing the first data segment by a first algorithm, the first check value is received by the second vehicle-mounted device from the first vehicle-mounted device;
  • the upgrade file is formed based on the first data segment for upgrade.
  • each of the multiple data segments used to upgrade the upgrade file of the second vehicle-mounted device is individually encrypted and transmitted, which can effectively reduce the risk of each data segment being stolen.
  • the receiving end that is, the second vehicle-mounted device
  • the second vehicle-mounted device needs to verify the check value corresponding to each data segment, instead of verifying the entire upgrade file only after the transmission of the last data segment is completed, it can be found in time.
  • the tampered abnormal data segment is triggered and the transmission of the new data segment is stopped in time after the abnormal data segment is found, thereby effectively improving the security of the upgrade file transmission process.
  • the first check value is Output data obtained by using the first data segment as an input of the first algorithm
  • the first check value is the first data segment And a second check value as output data obtained by inputting the first algorithm; the second check value is obtained by processing the previous data segment of the first data segment by the first algorithm.
  • the check values corresponding to the other data segments except the first data segment are all related to the check value corresponding to the previous data segment, which is realized by the hash chain
  • the sequence detection mechanism of data segmentation avoids the situation that the successful flashing of out-of-sequence segmentation leads to errors in the assembly of the upgrade file.
  • the verification value is realized by the hash chain method and also increases the difficulty of malicious cracking.
  • the first encrypted segment is obtained by encrypting the first data segment and the first check value by using the first key.
  • the first check value can also be encrypted, thereby further improving the security of the upgrade file transmission process.
  • the first key is a pre-shared key configured in advance for the first in-vehicle device and the second in-vehicle device.
  • each data segment can be ensured through the pre-configured pre-shared key, rather than the key obtained through the negotiation of a security protocol or a security algorithm, which can effectively reduce the cost of the first vehicle device and the second vehicle device. LF.
  • the first key is a key obtained by mutual authentication and negotiation of the transport layer security protocol TLS between the first vehicle-mounted device and the second vehicle-mounted device.
  • the encryption of each data segment with the key obtained through the TLS protocol negotiation can ensure the confidentiality of each data segment, and for different second vehicle devices, the first vehicle device and the second vehicle device perform the The two-way authentication process is different, and the negotiated first key can also be different, that is, the encryption and decryption keys corresponding to different upgrade files can be different, thereby greatly improving the security of the upgrade file transmission process.
  • the first key is a key obtained by performing mutual authentication negotiation of the TLS protocol between the first in-vehicle device and the second in-vehicle device;
  • the first check value is a message authentication code of the first data segment obtained by processing the first data segment by the first algorithm based on the TLS protocol.
  • an embodiment of the present application provides a method for upgrading an in-vehicle device, which is applied to a vehicle.
  • the vehicle includes a first in-vehicle device and a second in-vehicle device, and the method includes:
  • the first in-vehicle device processes a first data segment by a first algorithm to obtain a first check value; the first data segment is used to upgrade multiple data contained in an upgrade file of the second in-vehicle device Any one of the data segments in the segments, where the first check value is used to send to the second vehicle-mounted device;
  • the second in-vehicle device decrypts the first encrypted segment by using the first key to obtain the first data segment
  • the second in-vehicle device stores the first data in segments in the second in-vehicle device when the first check value is verified by the first algorithm
  • the second in-vehicle device composes the upgrade file based on the first data segment for upgrade.
  • each of the multiple data segments used to upgrade the upgrade file of the second vehicle-mounted device is individually encrypted and transmitted, which can effectively reduce the risk of each data segment being stolen.
  • the receiving end that is, the second vehicle-mounted device
  • the second vehicle-mounted device needs to verify the check value corresponding to each data segment, instead of verifying the entire upgrade file only after the transmission of the last data segment is completed, it can be found in time.
  • the tampered abnormal data segment is triggered and the transmission of the new data segment is stopped in time after the abnormal data segment is found, thereby effectively improving the security of the upgrade file transmission process.
  • the method before the first in-vehicle device processes the first data segment by the first algorithm to obtain the first check value, the method further includes:
  • the first vehicle-mounted device and the download server perform two-way authentication of the HTTPS protocol; the download server is used to provide the upgrade file for the second vehicle-mounted device;
  • the first vehicle-mounted device decrypts the encrypted file to obtain the upgrade file.
  • the download server that provides the upgrade file is a server that performs two-way authentication of the HTTPS protocol with the first in-vehicle device, ensuring the legitimacy of the source of the upgrade file, and avoiding unauthorized platforms from sending malicious upgrade files to the first in-vehicle device It also avoids the situation that the attacker imitates the first in-vehicle device and steals the upgrade file containing important information issued by the download server.
  • the encrypted upgrade file is transmitted between the download server and the first in-vehicle device, which can effectively reduce the risk of the upgrade file being stolen, thereby effectively improving the security of the upgrade file transmission process.
  • the first check value is Output data obtained by using the first data segment as the input of the first algorithm
  • the first check value is the first data segment And a second check value as output data obtained by inputting the first algorithm; the second check value is obtained by processing the previous data segment of the first data segment by the first algorithm.
  • the check values corresponding to the other data segments except the first data segment are all related to the check value corresponding to the previous data segment, which is realized by the hash chain
  • the sequence detection mechanism of data segmentation avoids the situation that the successful flashing of out-of-sequence segmentation leads to errors in the assembly of the upgrade file.
  • the verification value is realized by the hash chain method and also increases the difficulty of malicious cracking.
  • the first encrypted segment is obtained by encrypting the first data segment and the first check value by using the first key.
  • the first check value can also be encrypted, thereby further improving the security of the upgrade file transmission process.
  • the first key is a pre-shared key configured for the first in-vehicle device and the second in-vehicle device in advance.
  • each data segment can be ensured through the pre-configured pre-shared key, rather than the key obtained through the negotiation of a security protocol or a security algorithm, which can effectively reduce the cost of the first vehicle device and the second vehicle device. LF.
  • the first key is a key obtained by mutual authentication and negotiation of the transport layer security protocol TLS between the first vehicle-mounted device and the second vehicle-mounted device.
  • the encryption of each data segment with the key obtained through the TLS protocol negotiation can ensure the confidentiality of each data segment, and for different second vehicle devices, the first vehicle device and the second vehicle device perform the The two-way authentication process is different, and the negotiated first key can also be different, that is, the encryption and decryption keys corresponding to different upgrade files can be different, thereby greatly improving the security of the upgrade file transmission process.
  • the first key is a key obtained by performing mutual authentication negotiation of the TLS protocol between the first in-vehicle device and the second in-vehicle device;
  • the first check value is a message authentication code of the first data segment obtained by processing the first data segment by the first algorithm based on the TLS protocol.
  • an embodiment of the present application provides a first vehicle-mounted device, including:
  • the processing unit is configured to process the first data segment by the first algorithm to obtain the first check value; the first data segment is used to upgrade the multiple data segments contained in the upgrade file of the second vehicle-mounted device Any one of the data segments in, the first check value is used to send to the second vehicle-mounted device;
  • An encryption unit configured to encrypt the first data segment by using a first key to obtain a first encrypted segment
  • the communication unit is configured to send the first encrypted segment to the second in-vehicle device for use in the case that the second in-vehicle device verifies that the first check value is passed through the first algorithm,
  • the first data segment obtained by decrypting the first encrypted segment with the first key is stored in the second vehicle-mounted device; the first data segment is used for the second
  • the vehicle-mounted equipment composes the upgrade file for upgrade.
  • each of the multiple data segments used to upgrade the upgrade file of the second in-vehicle device is individually encrypted and transmitted, which can effectively reduce the risk of each data segment being stolen.
  • the receiving end that is, the second vehicle-mounted device
  • the second vehicle-mounted device needs to verify the check value corresponding to each data segment, instead of verifying the entire upgrade file only after the transmission of the last data segment is completed, it can be found in time.
  • the tampered abnormal data segment is triggered and the transmission of the new data segment is stopped in time after the abnormal data segment is found, thereby effectively improving the security of the upgrade file transmission process.
  • the first vehicle-mounted device further includes a negotiation unit and a decryption unit, wherein:
  • the negotiation unit is configured to perform HTTPS mutual authentication with the download server before the processing unit processes the first data segment through the first algorithm to obtain the first check value;
  • the download server is configured to provide the second vehicle-mounted device with The upgrade file;
  • the communication unit is further configured to receive an encrypted file sent by the download server, where the encrypted file is obtained by encrypting the upgrade file;
  • the decryption unit is configured to decrypt the encrypted file to obtain the upgrade file when the preset upgrade condition is met.
  • the download server that provides the upgrade file is a server that performs two-way authentication of the HTTPS protocol with the first in-vehicle device, ensuring the legitimacy of the source of the upgrade file, and avoiding unauthorized platforms from sending malicious upgrade files to the first in-vehicle device It also avoids the situation that the attacker imitates the first in-vehicle device and steals the upgrade file containing important information issued by the download server.
  • the encrypted upgrade file is transmitted between the download server and the first in-vehicle device, which can effectively reduce the risk of the upgrade file being stolen, thereby effectively improving the security of the upgrade file transmission process.
  • the first check value is Output data obtained by using the first data segment as the input of the first algorithm
  • the first check value is the first data segment And a second check value as output data obtained by inputting the first algorithm; the second check value is obtained by processing the previous data segment of the first data segment by the first algorithm.
  • the check values corresponding to the other data segments except the first data segment are all related to the check value corresponding to the previous data segment, which is realized by the hash chain
  • the sequence detection mechanism of data segmentation avoids the situation that the successful flashing of out-of-sequence segmentation leads to errors in the assembly of the upgrade file.
  • the verification value is realized by the hash chain method and also increases the difficulty of malicious cracking.
  • the first encrypted segment is obtained by encrypting the first data segment and the first check value by using the first key.
  • the first check value can also be encrypted, thereby further improving the security of the upgrade file transmission process.
  • the first key is a pre-shared key configured in advance for the first in-vehicle device and the second in-vehicle device.
  • each data segment can be ensured through the pre-configured pre-shared key, rather than the key obtained through the negotiation of a security protocol or a security algorithm, which can effectively reduce the cost of the first vehicle device and the second vehicle device. LF.
  • the first key is a key obtained by mutual authentication and negotiation of the transport layer security protocol TLS between the first vehicle-mounted device and the second vehicle-mounted device.
  • the encryption of each data segment with the key obtained through the TLS protocol negotiation can ensure the confidentiality of each data segment, and for different second vehicle devices, the first vehicle device and the second vehicle device perform the The two-way authentication process is different, and the negotiated first key can also be different, that is, the encryption and decryption keys corresponding to different upgrade files can be different, thereby greatly improving the security of the upgrade file transmission process.
  • the first key is a key obtained by performing mutual authentication negotiation of the TLS protocol between the first in-vehicle device and the second in-vehicle device;
  • the first check value is a message authentication code of the first data segment obtained by processing the first data segment by the first algorithm based on the TLS protocol.
  • an embodiment of the present application provides a second in-vehicle device, including:
  • the communication unit is configured to receive a first encrypted segment sent by the first vehicle-mounted device; the first encrypted segment is obtained by encrypting a first data segment with a first key, and the first data segment is used To upgrade any one of the multiple data segments included in the upgrade file of the second in-vehicle device;
  • a decryption unit configured to decrypt the first encrypted segment by using the first key to obtain the first data segment
  • the verification unit is configured to store the first data segmentally in the second vehicle-mounted device when the first check value is verified by the first algorithm;
  • the first check value is The first vehicle-mounted device is obtained by processing the first data segment by using a first algorithm, and the first check value is received by the second vehicle-mounted device from the first vehicle-mounted device;
  • the upgrade unit is configured to form the upgrade file based on the first data segment for upgrade.
  • each of the multiple data segments used to upgrade the upgrade file of the second in-vehicle device is individually encrypted and transmitted, which can effectively reduce the risk of each data segment being stolen.
  • the receiving end that is, the second vehicle-mounted device
  • the second vehicle-mounted device needs to verify the check value corresponding to each data segment, instead of verifying the entire upgrade file only after the transmission of the last data segment is completed, it can be found in time.
  • the tampered abnormal data segment is triggered and the transmission of the new data segment is stopped in time after the abnormal data segment is found, thereby effectively improving the security of the upgrade file transmission process.
  • the first check value is Output data obtained by using the first data segment as an input of the first algorithm
  • the first check value is the first data segment And a second check value as output data obtained by inputting the first algorithm; the second check value is obtained by processing the previous data segment of the first data segment by the first algorithm.
  • the check values corresponding to the other data segments except the first data segment are all related to the check value corresponding to the previous data segment, which is realized by the hash chain
  • the sequence detection mechanism of data segmentation avoids the situation that the upgrade file assembly error is caused by the successful flashing of out-of-sequence segments.
  • the verification value is realized by the hash chain method and also increases the difficulty of malicious cracking.
  • the first encrypted segment is obtained by encrypting the first data segment and the first check value by using the first key.
  • the first check value can also be encrypted, thereby further improving the security of the upgrade file transmission process.
  • the first key is a pre-shared key configured in advance for the first in-vehicle device and the second in-vehicle device.
  • each data segment can be ensured through the pre-configured pre-shared key, rather than the key obtained through the negotiation of a security protocol or a security algorithm, which can effectively reduce the cost of the first vehicle device and the second vehicle device. LF.
  • the first key is a key obtained by mutual authentication and negotiation of the transport layer security protocol TLS between the first vehicle-mounted device and the second vehicle-mounted device.
  • the encryption of each data segment with the key obtained through the TLS protocol negotiation can ensure the confidentiality of each data segment, and for different second vehicle devices, the first vehicle device and the second vehicle device perform the The two-way authentication process is different, and the negotiated first key can also be different, that is, the encryption and decryption keys corresponding to different upgrade files can be different, thereby greatly improving the security of the upgrade file transmission process.
  • the first key is a key obtained by performing mutual authentication negotiation of the TLS protocol between the first in-vehicle device and the second in-vehicle device;
  • the first check value is a message authentication code of the first data segment obtained by processing the first data segment by the first algorithm based on the TLS protocol.
  • an embodiment of the present application provides a first vehicle-mounted device.
  • the first vehicle-mounted device includes a transceiver, a processor, and a memory.
  • the memory is used to store a computer program, and the processor calls the computer program. Used to perform the following operations:
  • the first data segment is processed by the first algorithm to obtain the first check value;
  • the first data segment is any one of the multiple data segments contained in the upgrade file used to upgrade the second vehicle-mounted device Paragraph, the first check value is used to send to the second vehicle-mounted device;
  • the first data segment obtained by decrypting the first encrypted segment with the first key is stored in the second vehicle-mounted device; the first data segment is used for the second
  • the vehicle-mounted equipment composes the upgrade file for upgrade.
  • each of the multiple data segments used to upgrade the upgrade file of the second in-vehicle device is individually encrypted and transmitted, which can effectively reduce the risk of each data segment being stolen.
  • the receiving end that is, the second vehicle-mounted device
  • the second vehicle-mounted device needs to verify the check value corresponding to each data segment, instead of verifying the entire upgrade file only after the transmission of the last data segment is completed, it can be found in time.
  • the tampered abnormal data segment is triggered and the transmission of the new data segment is stopped in time after the abnormal data segment is found, thereby effectively improving the security of the upgrade file transmission process.
  • the processor before the first data segment is processed by the first algorithm to obtain the first check value, the processor is further configured to:
  • the download server is used to provide the upgrade file for the second vehicle-mounted device
  • the encrypted file is decrypted to obtain the upgrade file.
  • the download server that provides the upgrade file is a server that performs two-way authentication of the HTTPS protocol with the first in-vehicle device, ensuring the legitimacy of the source of the upgrade file, and avoiding unauthorized platforms from sending malicious upgrade files to the first in-vehicle device It also avoids the situation that the attacker imitates the first in-vehicle device and steals the upgrade file containing important information issued by the download server.
  • the encrypted upgrade file is transmitted between the download server and the first in-vehicle device, which can effectively reduce the risk of the upgrade file being stolen, thereby effectively improving the security of the upgrade file transmission process.
  • the first check value is Output data obtained by using the first data segment as the input of the first algorithm
  • the first check value is the first data segment And a second check value as output data obtained by inputting the first algorithm; the second check value is obtained by processing the previous data segment of the first data segment by the first algorithm.
  • the check values corresponding to the other data segments except the first data segment are all related to the check value corresponding to the previous data segment, which is realized by the hash chain.
  • the sequence detection mechanism of data segmentation avoids the situation that the successful flashing of out-of-sequence segmentation leads to errors in the assembly of the upgrade file.
  • the verification value is realized through a hash chain and it also increases the difficulty of malicious cracking.
  • the first encrypted segment is obtained by encrypting the first data segment and the first check value by using the first key.
  • the first check value can also be encrypted, thereby further improving the security of the upgrade file transmission process.
  • the first key is a pre-shared key configured in advance for the first in-vehicle device and the second in-vehicle device.
  • each data segment can be ensured through the pre-configured pre-shared key, rather than the key obtained through the negotiation of a security protocol or a security algorithm, which can effectively reduce the cost of the first vehicle device and the second vehicle device. LF.
  • the first key is a key obtained by the first vehicle-mounted device and the second vehicle-mounted device through mutual authentication negotiation of the transport layer security protocol TLS.
  • the encryption of each data segment with the key obtained through the TLS protocol negotiation can ensure the confidentiality of each data segment, and for different second vehicle devices, the first vehicle device and the second vehicle device perform the The two-way authentication process is different, and the negotiated first key can also be different, that is, the encryption and decryption keys corresponding to different upgrade files can be different, thereby greatly improving the security of the upgrade file transmission process.
  • the first key is a key obtained by performing mutual authentication negotiation of the TLS protocol between the first vehicle-mounted device and the second vehicle-mounted device;
  • the first check value is a message authentication code of the first data segment obtained by processing the first data segment by the first algorithm based on the TLS protocol.
  • an embodiment of the present application provides a second vehicle-mounted device.
  • the second vehicle-mounted device includes a transceiver, a processor, and a memory.
  • the memory is used to store a computer program, and the processor calls the computer program. Used to perform the following operations:
  • the transceiver to receive the first encrypted segment sent by the first in-vehicle device;
  • the first encrypted segment is obtained by encrypting the first data segment with the first key, and the first data segment is used To upgrade any one of the multiple data segments included in the upgrade file of the second in-vehicle device;
  • the first check value is verified by the first algorithm
  • the first data is stored in the second vehicle-mounted device in segments
  • the first check value is the first vehicle-mounted device Obtained by processing the first data segment by a first algorithm, the first check value is received by the second vehicle-mounted device from the first vehicle-mounted device;
  • the upgrade file is formed based on the first data segment for upgrade.
  • each of the multiple data segments used to upgrade the upgrade file of the second in-vehicle device is individually encrypted and transmitted, which can effectively reduce the risk of each data segment being stolen.
  • the receiving end that is, the second vehicle-mounted device
  • the second vehicle-mounted device needs to verify the check value corresponding to each data segment, instead of verifying the entire upgrade file only after the transmission of the last data segment is completed, it can be found in time.
  • the tampered abnormal data segment is triggered and the transmission of the new data segment is stopped in time after the abnormal data segment is found, thereby effectively improving the security of the upgrade file transmission process.
  • the first check value is Output data obtained by using the first data segment as an input of the first algorithm
  • the first check value is the first data segment And a second check value as output data obtained by inputting the first algorithm; the second check value is obtained by processing the previous data segment of the first data segment by the first algorithm.
  • the check values corresponding to the other data segments except the first data segment are all related to the check value corresponding to the previous data segment, which is realized by the hash chain.
  • the sequence detection mechanism of data segmentation avoids the situation that the successful flashing of out-of-sequence segmentation leads to errors in the assembly of the upgrade file.
  • the verification value is realized through a hash chain and it also increases the difficulty of malicious cracking.
  • the first encrypted segment is obtained by encrypting the first data segment and the first check value by using the first key.
  • the first check value can also be encrypted, thereby further improving the security of the upgrade file transmission process.
  • the first key is a pre-shared key configured in advance for the first in-vehicle device and the second in-vehicle device.
  • each data segment can be ensured through the pre-configured pre-shared key, rather than the key obtained through the negotiation of a security protocol or a security algorithm, which can effectively reduce the cost of the first vehicle device and the second vehicle device. LF.
  • the first key is a key obtained by mutual authentication and negotiation of the transport layer security protocol TLS between the first vehicle-mounted device and the second vehicle-mounted device.
  • the encryption of each data segment with the key obtained through the TLS protocol negotiation can ensure the confidentiality of each data segment, and for different second vehicle devices, the first vehicle device and the second vehicle device perform the The two-way authentication process is different, and the negotiated first key can also be different, that is, the encryption and decryption keys corresponding to different upgrade files can be different, thereby greatly improving the security of the upgrade file transmission process.
  • the first key is a key obtained by performing mutual authentication negotiation of the TLS protocol between the first in-vehicle device and the second in-vehicle device;
  • the first check value is a message authentication code of the first data segment obtained by processing the first data segment by the first algorithm based on the TLS protocol.
  • an embodiment of the present application provides a vehicle, including a first in-vehicle device and a second in-vehicle device, wherein: the first in-vehicle device is the fourth aspect, or any one of the possible implementation manners of the fourth aspect The first in-vehicle device described; the second in-vehicle device is the second in-vehicle device described in the fifth aspect, or any one of the possible implementation manners of the fifth aspect.
  • an embodiment of the present application provides a vehicle, including a first in-vehicle device and a second in-vehicle device, wherein: the first in-vehicle device is the sixth aspect, or any one of the possible implementation manners of the sixth aspect
  • the second vehicle-mounted device is the second vehicle-mounted device described in the seventh aspect, or any one of the possible implementation manners of the seventh aspect.
  • an embodiment of the present application provides a computer-readable storage medium that stores instructions in the computer-readable storage medium, and when it runs on a processor, it implements any one of the first and second aspects Or the method described in the alternative scheme of any aspect.
  • FIG. 1 is a schematic diagram of the architecture of a vehicle-mounted equipment upgrade system provided by an embodiment of the present application
  • FIG. 2 is a schematic flowchart of a method for upgrading on-board equipment provided by an embodiment of the present application
  • FIG. 3 is a schematic flowchart of another method for upgrading on-board equipment provided by an embodiment of the present application.
  • FIG. 4 is a schematic flowchart of another method for upgrading on-board equipment provided by an embodiment of the present application.
  • FIG. 5 is a schematic flowchart of another method for upgrading on-board equipment provided by an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of a first device provided by an embodiment of the present application.
  • FIG. 7 is a schematic structural diagram of a second device provided by an embodiment of the present application.
  • FIG. 8 is a schematic structural diagram of yet another first device provided by an embodiment of the present application.
  • FIG. 9 is a schematic structural diagram of yet another second device provided by an embodiment of the present application.
  • FIG. 1 is a schematic diagram of the architecture of a vehicle-mounted device upgrade system provided by an embodiment of the present application.
  • the schematic diagram of the architecture includes a download server 110 and a vehicle 120. Bluetooth and mobile device network, etc.) for communication and downloading.
  • the vehicle 120 includes a communication bus 121 and a plurality of in-vehicle devices 122 that communicate with each other through the communication bus 121. The number of devices in the plurality of in-vehicle devices 122 is not limited here.
  • the download server 110 may be a server set by an original equipment manufacturer (OEM) to provide an upgrade file for the vehicle 120.
  • the download server 110 may be a single server or a server cluster composed of multiple servers; the download server 110 may be a hardware server or a cloud server, which is not limited here.
  • the vehicle 120 may also be a smart vehicle, a smart “charging dog” (a movable device for charging smart vehicles) and other devices.
  • the communication bus 121 may be, but is not limited to, a local interconnect network (LIN) bus, a controller area network (controller area network, CAN) bus, and the like.
  • the in-vehicle device 122 may be an electronic device or control unit in the vehicle 120 that can upgrade the system through an upgrade file, such as an electronic control unit (ECU), a vehicle control unit (VCU), etc.; the in-vehicle device 122 is also It may be an electronic device in the vehicle 120 that can obtain the upgrade file provided by the download server 110 via a wireless link, and transmit the upgrade file to other vehicle-mounted devices that need to upgrade the system, such as a vehicle-mounted unit (telematics box, Tbox).
  • a vehicle-mounted unit such as a vehicle-mounted unit (telematics box, Tbox).
  • GW gateway
  • TCU automatic transmission control unit
  • auxiliary control unit auxiliary control unit
  • the Tbox in the vehicle 120 may communicate with the download server 110 through a wireless link.
  • the Tbox may obtain the upgrade file issued by the download server 110 through the wireless link for upgrading the control unit (such as ECU or VCU) of the vehicle 120, and based on it
  • the protocol specification of unified diagnostic services (UDS) flashes the upgrade file in segments to the address unit corresponding to the local cache (flash) of the corresponding control unit, thereby completing the over the air (OTA) process .
  • UDS unified diagnostic services
  • Tbox is referred to as the first vehicle-mounted device
  • control unit such as ECU or VCU
  • the second vehicle-mounted device the control unit that assists segment flashing of upgrade files through the Tbox
  • FIG. 2 is an on-board device upgrade method provided by an embodiment of the present application.
  • the method can be implemented based on the on-board device upgrade system shown in FIG. 1.
  • the method includes but is not limited to the following steps:
  • Step S201 The download server and the first vehicle-mounted device perform two-way authentication of a hypertext transfer protocol (hypertexttransfer protocol over secure socket layer, HTTPS).
  • hypertext transfer protocol hypertexttransfer protocol over secure socket layer, HTTPS.
  • the download server is used to provide the upgrade file for the second in-vehicle device through the first in-vehicle device.
  • the HTTPS protocol can be understood as ensuring the security of the transmission process through the secure sockets layer (SSL) or the transport layer security (TLS) on the basis of the hypertext transfer protocol (HTTP) Since the TLS protocol is newer than the SSL protocol and has a wider application, the embodiment of the present application uses the TLS protocol as an example for description.
  • SSL secure sockets layer
  • TLS transport layer security
  • HTTP hypertext transfer protocol
  • the mutual authentication of the HTTPS protocol is actually the mutual authentication of the TLS protocol, which is also called the interactive process of the TLS handshake protocol.
  • the download server sends the root certificate or OTA certificate of the download server to the first in-vehicle device for the first in-vehicle device to authenticate the download server; similarly, the first in-vehicle device also sends the first in-vehicle device to the first in-vehicle device.
  • the device certificate of the device is sent to the download server for the download server to perform identity authentication on the first vehicle-mounted device.
  • the OTA certificate may be a certificate derived by the download server based on the above-mentioned root certificate for safe interaction with the first in-vehicle device.
  • the download server and the first vehicle-mounted device perform the two-way authentication of the HTTPS protocol, which can effectively prevent the unauthorized download server from publishing malicious upgrade files to the first vehicle-mounted device, and the attacker will steal the authorized first vehicle-mounted device.
  • Download the upgrade file issued by the server that contains important information such as key experience calibration configuration, key algorithm, user privacy, etc.
  • Step S202 The download server encrypts and signs the upgrade file to obtain the encrypted file and the first signature.
  • the upgrade file is used to upgrade the second in-vehicle device, and the download server can encrypt the upgrade file with a second key to obtain the encrypted file, where the second key can be a key randomly generated by the download server, or It can be a key negotiated by the download server and the first in-vehicle device in advance, or a key that is pre-configured (for example, configured by a trusted third-party device), or of course, it can also be a key obtained by other means. .
  • the download server can sign the upgrade file with the private key of the first certificate to obtain the first signature, where the first certificate can be the root certificate of the download server, or the above-mentioned OTA certificate, of course, it can also be another one that can identify the download The certificate of the identity of the server.
  • Step S203 The download server sends the encrypted file and the first signature to the first vehicle-mounted device.
  • Step S204 The first vehicle-mounted device receives the encrypted file and the first signature.
  • Step S205 the first in-vehicle device stores the encrypted file when the first signature is verified.
  • the first signature is used to verify the integrity of the upgrade file sent by the download server and the legitimacy of the source of the upgrade file (ie, the download server).
  • the download server can sign the upgrade file through a certificate that can identify the identity of the download server to obtain
  • the first signature is sent to the first in-vehicle device.
  • the first in-vehicle device can verify the first signature through the public key of the certificate that can identify the identity of the download server, and the first in-vehicle device considers that the upgrade file has not been tampered with (that is, if the first signature verification is passed)
  • the integrity verification passed) and the node that sent the encrypted file and the first signature is considered to be the download server (that is, the legality verification passed).
  • the embodiment of the present application does not limit the specific method of signing the download server and the specific method of verifying the signature by the first in-vehicle device; for ease of understanding, several optional signature verification schemes are listed below.
  • the first certificate used by the first vehicle-mounted device may be sent by the download server to the first vehicle-mounted device. Accordingly, the first vehicle-mounted device passes the root certificate The public key verifies the first signature.
  • the first certificate used by the first vehicle-mounted device may be sent by the download server to the first vehicle-mounted device, and the download server may also send the root of the download server to the first vehicle-mounted device. Certificate.
  • the first vehicle-mounted device verifies the legitimacy of the received OTA certificate through the root certificate, and if the verification is passed, the first signature is verified through the public key of the OTA certificate.
  • the encrypted file is stored; if the legality verification of the OTA certificate fails or the first signature verification fails, the first vehicle-mounted device is used in the vehicle to realize the entire vehicle system failure Diagnostic protection of on-board equipment, such as VCU, reports an alarm about an abnormal encrypted file.
  • Step S206 When the preset upgrade condition is met, the first vehicle-mounted device decrypts the encrypted file to obtain the upgrade file.
  • the preset upgrade conditions may be, but not limited to, the vehicle receiving the upgrade instruction and the vehicle is in a stationary state, etc., where the upgrade instruction may be, but not limited to, being instructed by the user through the on-board terminal built in the vehicle, and the user is instructed by the user through a wireless connection with the vehicle. Instructed by the Internet of Vehicles application (application, APP).
  • application, APP Instructed by the Internet of Vehicles application
  • the preset upgrade condition is not met, the upgrade file is stored in the first in-vehicle device in the form of an encrypted file.
  • the first in-vehicle device decrypts the encrypted file with the second key to obtain Upgrade files, instead of decrypting and storing the upgrade files immediately after receiving the encrypted files, this prevents the upgrade files from being stolen and tampered with during storage and ensures the security of the upgrade files.
  • the download server may also encrypt the second key with the public key of the device certificate of the first vehicle-mounted device, and use the encrypted second key.
  • the key is sent to the first vehicle-mounted device.
  • the first vehicle-mounted device receives the encrypted second key sent by the download server, and then decrypts the encrypted second key with the private key of the device certificate of the first vehicle-mounted device to obtain the second key .
  • the second key obtained in this way is used for the first vehicle-mounted device to decrypt the encrypted encrypted file to obtain the upgraded file.
  • the first in-vehicle device can also decrypt and store the upgrade file immediately after receiving the encrypted file.
  • the security of this method is relatively low.
  • Step S207 The first vehicle-mounted device processes the first data segment by the first algorithm to obtain the first check value.
  • the first in-vehicle device may divide the upgrade file into multiple data segments based on the receiving capability of the second in-vehicle device. Take n data segments as an example for illustration.
  • the size of the upgrade file is 64 bytes.
  • the size of the data packet that the second vehicle-mounted device can receive each time is 8 bytes, so the first vehicle-mounted device needs to divide the 64-byte upgrade file into 8 data segments.
  • the first in-vehicle device sends one data segment of the n data segments to the second in-vehicle device each time, and when all the n data segments are sent to the second in-vehicle device, the process of segment flashing the upgrade file is completed.
  • the above-mentioned first data segment is any one of the multiple data segments contained in the upgrade file, that is, the characteristics of each data segment in the multiple data segments are suitable for subsequent analysis of the first data segment.
  • the relevant description of the segment is any one of the multiple data segments contained in the upgrade file, that is, the characteristics of each data segment in the multiple data segments are suitable for subsequent analysis of the first data segment.
  • the first algorithm and the first check value are used to ensure the integrity of each data segment.
  • the first algorithm is a hash algorithm, for example, SHA-256, SHA-384, SHA-512, MD2, MD4, MD5, etc.
  • the first check value is the hash value corresponding to the first data segment, where :
  • the first check value is the output data obtained by using the first data segment as the input of the first algorithm
  • the first check value is to use the first data segment and the second check value as the first data segment.
  • the output data obtained by the input of an algorithm; the second check value is obtained by processing the previous data segment of the first data segment by the first algorithm.
  • the upgrade file File includes 3 data segments, which are data1, data2, and data3 in order, and the first algorithm is the MD5 algorithm, then:
  • the first check value check1 MD5(data1);
  • the first check value check2 MD5(data2, check1);
  • the first check value check3 MD5(data3, check2).
  • the first algorithm is an algorithm used to calculate a message authentication code (MAC), for example, a hash-based message authentication code (HMAC) algorithm and other algorithms dedicated to calculating MAC, data Encryption algorithms such as data encryption standard (DES);
  • MAC message authentication code
  • HMAC hash-based message authentication code
  • DES data Encryption algorithms
  • the first check value is the MAC of the first data segment obtained by processing the first data segment through the first algorithm based on the TLS protocol.
  • the upgrade file File includes 2 data segments, data1 and data2 in order, and the first algorithm is the HMAC algorithm, then:
  • the first check value check1 HMAC(data1);
  • the first check value check2 HMAC(data2).
  • Step S208 The first vehicle-mounted device encrypts the first data segment with the first key to obtain the first encrypted segment.
  • the first key can be a pre-shared key (PSK) pre-configured for the first in-vehicle device and the second in-vehicle device, or it can be the first in-vehicle device and the second in-vehicle device.
  • PSK pre-shared key
  • the in-vehicle device negotiates a key through a security algorithm or a security protocol, such as the TLS protocol.
  • the first vehicle-mounted device may encrypt the first data segment and the first check value by using the first key to obtain the first encrypted segment.
  • the first key may be a key obtained through negotiation through a security protocol, such as the TLS protocol.
  • the first vehicle-mounted device may encrypt the first data segment with the first key to obtain the first encrypted segment.
  • Step S209 the first in-vehicle device sends the first encrypted segment to the second in-vehicle device.
  • the first in-vehicle device sends the first encrypted segment to the second in-vehicle device, and the first encrypted segment is the first data segment and the first check that the first in-vehicle device encrypts through the first algorithm Value.
  • the first in-vehicle device sends the first encrypted segment and the first check value to the second in-vehicle device.
  • Step S210 The second vehicle-mounted device receives the first encrypted segment.
  • the second in-vehicle device receives the first encrypted segment sent by the first in-vehicle device. Obtained from the experimental value.
  • the second in-vehicle device receives the first encrypted segment and the first check value sent by the first in-vehicle device.
  • Step S211 The second vehicle-mounted device decrypts the first encrypted segment by using the first key to obtain the first data segment.
  • the second vehicle-mounted device optionally, such as the bootloader BootLoader in the second vehicle-mounted device, decrypts the first encrypted segment with the first key to obtain the first data segment and the first calibration. Value.
  • the second in-vehicle device optionally, such as the BootLoader in the second in-vehicle device, decrypts the first encrypted segment with the first key to obtain the first data segment.
  • Step S212 The second vehicle-mounted device stores the first data in segments in the second vehicle-mounted device when the first check value is verified by the first algorithm.
  • the second vehicle-mounted device calculates and decrypts the check value corresponding to the first data segment obtained by the first algorithm, and then compares the check value with the received check value. Or the first check value obtained by decryption. If the two are the same and the integrity check is passed, the first data will be segmented and stored in the address unit corresponding to the flash of the second in-vehicle device; if the two are different, the integrity If the verification fails, the process of flashing the upgrade file is stopped, and an alarm that the first data segment is abnormal is reported to the on-board equipment in the vehicle, such as the VCU, which is used to realize the fault diagnosis and protection of the entire vehicle system.
  • the on-board equipment in the vehicle such as the VCU, which is used to realize the fault diagnosis and protection of the entire vehicle system.
  • Step S213 The second vehicle-mounted device composes an upgrade file based on the first data segment to perform upgrade.
  • steps S207-S212 correspond to the secure flashing process of a data segment, and each data segment of the n data segments of the upgrade file is flashed to the second vehicle-mounted device in the manner described in steps S207-S212
  • the second in-vehicle device can assemble n data segments to obtain an upgrade file, and upgrade the system based on the upgrade file.
  • each of the multiple data segments used to upgrade the upgrade file of the second on-board device is individually encrypted and transmitted, which effectively reduces the amount of data that is stolen during the in-vehicle transmission process. Risk, to ensure the confidentiality of each data segment in the vehicle transmission process. And at the receiving end (that is, the second vehicle-mounted device) needs to verify the check value corresponding to each data segment, instead of verifying the entire upgrade file only after the last data segment is transmitted, it can be found in time.
  • Falsify the abnormal data segment and trigger the stop of the transmission of the new data segment in time after the abnormal data segment is found, so as to avoid the abnormal data segment flashing to the second on-board device, causing the second on-board device to work abnormally or waste resources Circumstances, the integrity of each data segment is guaranteed, thereby effectively improving the security of the upgrade file transfer process.
  • FIG. 3 is a schematic flowchart of another method for upgrading on-board equipment according to an embodiment of the present application.
  • the method can be implemented based on the on-board equipment upgrade system shown in FIG. 1, and the method includes but is not limited to the following steps:
  • Step S301 The first vehicle-mounted device configures the first key.
  • Step S302 the second in-vehicle device configures the first key.
  • the first key is a pre-shared key (PSK) pre-configured for the first vehicle-mounted device and the second vehicle-mounted device.
  • the first key may be a key manually set in the first vehicle-mounted device and the second vehicle-mounted device, or it may be a key generated by a third-party device and sent to the first vehicle-mounted device and the second vehicle-mounted device; where ,
  • the third-party device can communicate with the first in-vehicle device and the second in-vehicle device through a wired link or a wireless link.
  • Step S303 The first vehicle-mounted device uses the first data segment as the input of the first algorithm to obtain the check value corresponding to the output first data segment.
  • the first algorithm is a hash algorithm
  • the check value is a hash value obtained by the first in-vehicle device through the first algorithm.
  • the first in-vehicle device can update multiple data included in the upgrade file used to upgrade the second in-vehicle device.
  • the first data segment in the segments (such as n data segments) is used as the input of the first algorithm to obtain the output hash value, that is, the first check value.
  • the first vehicle-mounted device uses the first data segment as the input of the first algorithm to obtain the check value corresponding to the first data segment.
  • check1 MD5(data1).
  • Step S304 The first in-vehicle device encrypts the first data segment and the check value corresponding to the first data segment by using the first key to obtain the encrypted segment corresponding to the first data segment.
  • Step S305 The first in-vehicle device sends the encrypted segment corresponding to the first data segment to the second in-vehicle device.
  • Step S306 The second vehicle-mounted device receives the encrypted segment corresponding to the first data segment.
  • Step S307 The second vehicle-mounted device decrypts the encrypted segment corresponding to the first data segment by using the first key to obtain the first data segment and the check value corresponding to the first data segment.
  • Step S308 The second vehicle-mounted device stores the first data segment in the second vehicle-mounted device under the condition that the check value corresponding to the first data segment is passed through the first algorithm.
  • the second vehicle-mounted device uses the first data segment obtained by decryption as the input of the first algorithm to obtain the output hash value, and compares the hash value with the check value corresponding to the first data segment obtained by decryption, if The two are the same. If it is considered that the first data segment has not been tampered with (that is, the integrity check passes), the second vehicle-mounted device stores the first data segment in the address unit corresponding to the flash of the second vehicle-mounted device; if both Different, if it is considered that the first data segment has been tampered with (that is, the integrity check fails), stop flashing the upgrade file and report the first one to the on-board equipment used to realize the fault diagnosis and protection of the entire vehicle system, such as the VCU. Alarm for abnormal data segmentation.
  • the first algorithm is the MD5 algorithm
  • the first data segment obtained by decryption is data1
  • the check value corresponding to the first data segment obtained by decryption is check1
  • the second vehicle-mounted device will decrypt the first data segment obtained by decryption.
  • Step S309 The first vehicle-mounted device uses the check value corresponding to the first data segment and the second data segment as the input of the first algorithm to obtain the output check value corresponding to the second data segment.
  • the check value corresponding to the first data segment is the hash value obtained by processing the first data segment through the first algorithm
  • the check value corresponding to the first data segment is the first data segment of the first vehicle device.
  • the second vehicle-mounted device may use the check value corresponding to the first data segment and the second data segment as the input of the first algorithm to obtain the check value corresponding to the second data segment.
  • the first algorithm is the MD5 algorithm
  • the first data segment is data1
  • the second data segment is data2
  • Step S310 The first vehicle-mounted device encrypts the second data segment and the check value corresponding to the second data segment by using the first key to obtain the second encrypted segment.
  • Step S311 The first in-vehicle device sends the second encrypted segment to the second in-vehicle device.
  • Step S312 The second in-vehicle device receives the second encrypted segment.
  • Step S313 The second vehicle-mounted device decrypts the second encrypted segment by using the first key to obtain the second data segment and the check value corresponding to the second data segment.
  • Step S314 The second vehicle-mounted device stores the second data segment in the second vehicle-mounted device after verifying that the check value corresponding to the second data segment passes through the first algorithm.
  • the second in-vehicle device uses the decrypted second data segment and the check value corresponding to the first data segment decrypted in the transmission process of the first data segment as the input of the first algorithm to obtain the output hash Value, compare the hash value with the check value corresponding to the second data segment obtained by decryption. If the two are the same and the integrity check passes, the second data segment obtained by decryption will be stored in the second vehicle In the address unit corresponding to the device’s flash; if the two are different and the integrity check fails, stop flashing the upgrade file and report to the vehicle’s on-board equipment, such as the VCU, that is used to implement the fault diagnosis and protection of the entire vehicle system. Two alarms for abnormal data segmentation.
  • the second in-vehicle device can assemble n data segments to obtain an upgrade file, and upgrade the system based on the upgrade file.
  • the upgrade file File includes 3 data segments, which are data1, data2, and data3 in order.
  • the first algorithm is the MD5 algorithm
  • the first data segment is data1
  • the second data segment is data2
  • the check value corresponding to the first data segment is check1
  • the check value corresponding to the second data segment is check2.
  • the transmission process of data1 and data2 has been exemplified in Figure 3 above, and will not be repeated here.
  • the third data segment is data3.
  • the first vehicle-mounted device uses the check value corresponding to the second data segment and the third data segment as the input of the first algorithm to obtain the output corresponding to the third data segment.
  • the second vehicle-mounted device receives and decrypts the received third encrypted segment with the first key to obtain the third data segment data33 and the check value check33 corresponding to the third data segment, and then pass the first key
  • the second vehicle-mounted device can assemble data1, data2, and data3 in the order of reception to obtain an upgrade file File, and upgrade the system based on the upgrade file File.
  • the check values corresponding to other data segments except the first data segment are all related to the check value corresponding to the previous data segment, which is implemented through a hash chain
  • the sequence detection mechanism of data segmentation is used to avoid the situation that the successful flashing of out-of-sequence segmentation leads to errors in the assembly of the upgrade file.
  • the verification value is realized by the hash chain method, which also increases the difficulty of malicious cracking.
  • the confidentiality of each data segment is ensured through a pre-configured pre-shared key instead of a key negotiated through a security protocol or a security algorithm, which can effectively reduce the resource consumption of the first and second in-vehicle devices .
  • FIG. 4 is a schematic flowchart of another method for upgrading on-board equipment provided by an embodiment of the present application.
  • the method can be implemented based on the on-board equipment upgrade system shown in FIG. 1, and the method includes but is not limited to the following steps:
  • Step S401 The first vehicle-mounted device and the second vehicle-mounted device perform mutual authentication of the TLS protocol to obtain a first key through negotiation.
  • the first key is a key negotiated between the first in-vehicle device and the second in-vehicle device through the TLS protocol.
  • the mutual authentication of the TLS protocol is the same as the mutual authentication principle of HTTPS described in Figure 2.
  • the first in-vehicle device and the second in-vehicle device can achieve two-way identity authentication through their respective device certificates or preset keys to prevent attackers from imitating the first
  • the first in-vehicle device and the second in-vehicle device can negotiate and transmit the parameters used in the mutual authentication of the TLS protocol, such as the first The type of algorithm, the first key used for encryption and decryption, etc.
  • Step S402 The first vehicle-mounted device uses the first data segment as the input of the first algorithm to obtain the check value corresponding to the output first data segment.
  • Step S403 The first vehicle-mounted device encrypts the first data segment and the check value corresponding to the first data segment by using the first key to obtain the encrypted segment corresponding to the first data segment.
  • Step S404 The first in-vehicle device sends the encrypted segment corresponding to the first data segment to the second in-vehicle device.
  • Step S405 The second vehicle-mounted device receives the encrypted segment corresponding to the first data segment.
  • Step S406 The second vehicle-mounted device decrypts the encrypted segment corresponding to the first data segment by using the first key to obtain the first data segment and the check value corresponding to the first data segment.
  • Step S407 The second vehicle-mounted device stores the first data segment in the second vehicle-mounted device after verifying that the check value corresponding to the first data segment passes through the first algorithm.
  • Step S408 The first vehicle-mounted device uses the check value corresponding to the first data segment and the second data segment as the input of the first algorithm to obtain the output check value corresponding to the second data segment.
  • Step S409 The first vehicle-mounted device encrypts the second data segment and the check value corresponding to the second data segment by using the first key to obtain the second encrypted segment.
  • Step S410 The first vehicle-mounted device sends the second encrypted segment to the second vehicle-mounted device.
  • Step S411 The second in-vehicle device receives the second encrypted segment.
  • Step S412 The second vehicle-mounted device decrypts the second encrypted segment by using the first key to obtain the second data segment and the check value corresponding to the second data segment.
  • Step S413 The second vehicle-mounted device stores the second data segment in the second vehicle-mounted device when the check value corresponding to the second data segment is passed through the first algorithm.
  • the process of flashing the upgrade file in sections described in steps S402-S413 is the same as the process of flashing the upgrade file in sections described in steps S303-S314 in FIG. 3, and will not be repeated here.
  • encrypting each data segment with a key negotiated through the TLS protocol can ensure the confidentiality of each data segment, and for different second in-vehicle devices, the first in-vehicle device and the second in-vehicle device perform
  • the two-way authentication process is different, and the first key obtained through negotiation can also be different, that is, the encryption and decryption keys corresponding to different upgrade files can be different, thereby greatly improving the security of the upgrade file transmission process.
  • Figure 5 is a schematic flow diagram of another vehicle-mounted device upgrade method provided in an embodiment of the present application. This method can be implemented based on the vehicle-mounted device upgrade system shown in FIG. Applied to the process of flashing the upgrade file in segments, the method includes but not limited to the following steps:
  • Step S501 The first vehicle-mounted device and the second vehicle-mounted device perform mutual authentication of the TLS protocol.
  • the RFC5246 standard TLS protocol includes a handshake phase and a transmission phase.
  • the handshake phase ie, mutual authentication of the TLS protocol
  • the first vehicle-mounted device and the second vehicle-mounted device implement identity authentication through mutual authentication of the TLS protocol, and negotiate subsequent transmissions
  • the integrity protection algorithm i.e., the first algorithm
  • the transmission phase the first vehicle-mounted device and the second vehicle-mounted device compare each data based on the TLS protocol.
  • the confidentiality and integrity of the segmented transmission process is protected, which helps to ensure the security of the on-board equipment upgrade process.
  • Step S502 The first vehicle-mounted device and the second vehicle-mounted device perform encryption and integrity protection on the transmission process of the first data segment based on the TLS protocol.
  • the first in-vehicle device and the second in-vehicle device can perform the first data segment among multiple data segments (such as n data segments) included in the upgrade file used to upgrade the second in-vehicle device based on the TLS protocol of the RFC5246 standard. Confidentiality protection and integrity protection.
  • the first vehicle-mounted device encrypts the first data segment through the negotiated first key to obtain the encrypted segment corresponding to the first data segment, and calculates the MAC corresponding to the first data segment through the negotiated first algorithm , That is, the check value corresponding to the first data segment, and the encrypted segment corresponding to the first data segment and the MAC corresponding to the first data segment are sent to the second vehicle-mounted device.
  • the second vehicle-mounted device receives the encrypted segment corresponding to the first data segment and the MAC corresponding to the first data segment, and decrypts the encrypted segment corresponding to the first data segment with the negotiated first key to obtain
  • the MAC corresponding to the first data segment obtained by decryption is calculated through the negotiated first algorithm, and then the MAC calculated by the second vehicle-mounted device is compared with the MAC corresponding to the first data segment received.
  • the decrypted first data segment is stored in the address unit corresponding to the flash of the second vehicle device; if the two are different, it is considered If the first data segment is tampered with (that is, the integrity check fails), stop flashing the upgrade file and report the first data segment to the vehicle's on-board equipment used to realize the fault diagnosis and protection of the entire vehicle system, such as the VCU Abnormal warning.
  • Step S503 The first vehicle-mounted device and the second vehicle-mounted device perform encryption and integrity protection on the transmission process of the second data segment based on the TLS protocol.
  • each data segment except the first data segment in the n data segments of the upgrade file is flashed to the second in-vehicle device in step S502.
  • the second in-vehicle device can Assemble n data segments to obtain an upgrade file, and upgrade the system based on the upgrade file.
  • the TLS protocol based on the RFC5246 standard protects the confidentiality and integrity of each data segment, which helps to ensure the security of the upgrade file transmission process.
  • each of the multiple data segments used to upgrade the upgrade file of the second vehicle-mounted device is individually encrypted and transmitted, which ensures the confidentiality of the in-vehicle transmission process;
  • the device and the second in-vehicle device implement the integrity protection of each data segment through the integrity protection algorithm commonly used in the Hash chain or the TLS protocol, and can detect abnormal data segments in time, and trigger to stop the new data in time after the abnormal data segments are found.
  • the segmented data transmission avoids the situation that the abnormal data segment is flashed to the second in-vehicle device, causing the second in-vehicle device to work abnormally or waste resources.
  • the download server that provides the upgrade file for the vehicle is a server that performs two-way authentication of the HTTPS protocol with the first in-vehicle device, thereby ensuring the legitimacy of the source of the upgrade package; the download server and the first in-vehicle device are encrypted
  • the upgrade file ensures the confidentiality of the transmission process outside the vehicle; the first vehicle-mounted device stores the encrypted upgrade file, which ensures the confidentiality during the storage of the upgrade file.
  • FIG. 6 is a schematic structural diagram of a first vehicle-mounted device provided by an embodiment of the present application.
  • the first vehicle-mounted device 600 may include a processing unit 601, an encryption unit 602, and a communication unit 603. The detailed description of each unit as follows:
  • the processing unit 601 is configured to process a first data segment by a first algorithm to obtain a first check value; the first data segment is a plurality of data segments contained in an upgrade file used to upgrade the second vehicle-mounted device Any one of the data segments in, the first check value is used to send to the second vehicle-mounted device;
  • the encryption unit 602 is configured to encrypt the first data segment by using the first key to obtain the first encrypted segment;
  • the communication unit 603 is configured to send the first encrypted segment to the second in-vehicle device for use in the case that the second in-vehicle device verifies that the first check value is passed through the first algorithm , Storing the first data segment obtained by decrypting the first encrypted segment with the first key in the second vehicle-mounted device; the first data segment is used for the first 2.
  • the vehicle-mounted equipment composes the upgrade file for upgrade.
  • each of the multiple data segments used to upgrade the upgrade file of the second vehicle device is encrypted and transmitted separately, which effectively reduces the risk of each data segment being stolen during the in-vehicle transmission.
  • the receiving end that is, the second vehicle-mounted device
  • the second vehicle-mounted device needs to verify the check value corresponding to each data segment, instead of verifying the entire upgrade file only after the last data segment is transmitted, it can be found in time.
  • Falsify the abnormal data segment and trigger the stop of the transmission of the new data segment in time after the abnormal data segment is found, so as to avoid the abnormal data segment flashing to the second on-board device, causing the second on-board device to work abnormally or waste resources Circumstances, the integrity of each data segment is guaranteed, thereby effectively improving the security of the upgrade file transfer process.
  • the first in-vehicle device 600 further includes a negotiation unit and a decryption unit, where:
  • the negotiation unit is configured to perform two-way authentication of HTTPS protocol with the download server before the processing unit 601 processes the first data segment through the first algorithm to obtain the first check value;
  • the download server is configured to provide the second vehicle-mounted The device provides the upgrade file;
  • the communication unit 603 is further configured to receive an encrypted file sent by the download server, where the encrypted file is obtained by encrypting the upgrade file;
  • the decryption unit is configured to decrypt the encrypted file to obtain the upgrade file when the preset upgrade condition is met.
  • the download server that provides the upgrade file is a server that performs two-way authentication of the HTTPS protocol with the first in-vehicle device, ensuring the legitimacy of the source of the upgrade file, and avoiding unauthorized platforms from sending malicious upgrade files to the first in-vehicle device It also avoids the situation that the attacker imitates the first in-vehicle device and steals the upgrade file containing important information issued by the download server.
  • the encrypted upgrade file is transmitted between the download server and the first in-vehicle device, and the encrypted upgrade file is stored in the first in-vehicle device, which can effectively reduce the risk of the upgrade file being stolen and ensure that the upgrade file is outside the vehicle. Confidentiality during the transfer process and storage period, thereby effectively improving the security of the upgrade file transfer process.
  • the first check value is the first data segment Output data obtained by using a data segment as the input of the first algorithm
  • the first check value is the first data segment And a second check value as output data obtained by inputting the first algorithm; the second check value is obtained by processing the previous data segment of the first data segment by the first algorithm.
  • the check values corresponding to the other data segments except the first data segment are all related to the check value corresponding to the previous data segment, which is realized by the hash chain
  • the sequence detection mechanism of data segmentation avoids the situation that the successful flashing of out-of-sequence segmentation leads to errors in the assembly of the upgrade file.
  • the verification value is realized by the hash chain method and also increases the difficulty of malicious cracking.
  • the first encrypted segment is obtained by encrypting the first data segment and the first check value by using the first key.
  • the first check value can also be encrypted, thereby further improving the security of the upgrade file transmission process.
  • the first key is a pre-shared key configured in advance for the first in-vehicle device and the second in-vehicle device.
  • each data segment can be ensured through the pre-configured pre-shared key, rather than the key obtained through the negotiation of a security protocol or a security algorithm, which can effectively reduce the cost of the first vehicle device and the second vehicle device. LF.
  • the first key is a key obtained by mutual authentication and negotiation of the TLS protocol between the first vehicle-mounted device and the second vehicle-mounted device.
  • the encryption of each data segment with the key obtained through the TLS protocol negotiation can ensure the confidentiality of each data segment, and for different second vehicle devices, the first vehicle device and the second vehicle device perform the The two-way authentication process is different, and the negotiated first key can also be different, that is, the encryption and decryption keys corresponding to different upgrade files can be different, thereby greatly improving the security of the upgrade file transmission process.
  • the first key is a key obtained by performing mutual authentication negotiation of the TLS protocol between the first vehicle-mounted device and the second vehicle-mounted device;
  • the first check value is a message authentication code of the first data segment obtained by processing the first data segment by the first algorithm based on the TLS protocol.
  • the first vehicle-mounted device 600 is the first vehicle-mounted device in the method embodiments shown in FIG. 2, FIG. 3, FIG. 4, and FIG. 5.
  • FIG. 7 is a schematic structural diagram of a second vehicle-mounted device according to an embodiment of the present application.
  • the second vehicle-mounted device 700 may include a communication unit 701, a decryption unit 702, and a verification unit 703. The detailed description of each unit as follows:
  • the communication unit 701 is configured to receive a first encrypted segment sent by a first vehicle-mounted device; the first encrypted segment is obtained by encrypting a first data segment with a first key, and the first data segment is Any one of the multiple data segments included in the upgrade file used to upgrade the second vehicle-mounted device;
  • the decryption unit 702 is configured to decrypt the first encrypted segment by using the first key to obtain the first data segment;
  • the verification unit 703 is configured to store the first data in segments in the second vehicle-mounted device when the first check value is verified by the first algorithm; the first check value is Obtained by processing the first data segment by the first in-vehicle device through a first algorithm, and the first check value is received by the second in-vehicle device from the first in-vehicle device;
  • the upgrade unit 704 is configured to form the upgrade file based on the first data segment to perform upgrade.
  • the first data segment is the first data segment among the multiple data segments of the upgrade file
  • the first check value is the first data segment
  • Data segmentation is used as output data obtained from the input of the first algorithm
  • the first check value is the first data segment And a second check value as output data obtained by inputting the first algorithm; the second check value is obtained by processing the previous data segment of the first data segment by the first algorithm.
  • the first encrypted segment is obtained by encrypting the first data segment and the first check value by using the first key.
  • the first key is a pre-shared key configured in advance for the first in-vehicle device and the second in-vehicle device.
  • the first key is a key obtained by mutual authentication and negotiation of the TLS protocol between the first vehicle-mounted device and the second vehicle-mounted device.
  • the first key is a key obtained by performing mutual authentication negotiation of the TLS protocol between the first vehicle-mounted device and the second vehicle-mounted device;
  • the first check value is a message authentication code of the first data segment obtained by processing the first data segment by the first algorithm based on the TLS protocol.
  • the second in-vehicle device 700 is the second in-vehicle device in the method embodiments shown in FIG. 2, FIG. 3, FIG. 4, and FIG. 5.
  • FIG. 8 is a schematic structural diagram of another first vehicle-mounted device according to an embodiment of the present application.
  • the first vehicle-mounted device 800 may include a processor 801, a memory 802, and a transceiver 803.
  • the processor 801, the memory 802, and the The transceivers 803 are connected to each other through a bus.
  • the memory 802 includes but is not limited to random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), or Portable read-only memory (compact disc read-only memory, CD-ROM).
  • RAM random access memory
  • ROM read-only memory
  • EPROM erasable programmable read-only memory
  • CD-ROM Compact disc read-only memory
  • the memory 802 is used to store related computer programs and data.
  • the transceiver 803 is used to receive and send data.
  • the processor 801 may be one or more central processing units (CPU).
  • CPU central processing units
  • the CPU may be a single-core CPU or a multi-core CPU.
  • the processor 801 in the first in-vehicle device 800 may be used to read the computer program code stored in the memory 802 and perform the following operations:
  • the first data segment is processed by the first algorithm to obtain the first check value;
  • the first data segment is any one of the multiple data segments contained in the upgrade file used to upgrade the second vehicle-mounted device Paragraph, the first check value is used to send to the second vehicle-mounted device;
  • the first data segment obtained by decrypting the first encrypted segment by the first key is stored in the second vehicle-mounted device; the first data segment is used for the second vehicle-mounted device
  • the device composes the upgrade file for upgrade.
  • the processor 801 before processing the first data segment by the first algorithm to obtain the first check value, the processor 801 is further configured to:
  • the download server is used to provide the upgrade file for the second vehicle-mounted device
  • the control transceiver 803 receives the encrypted file sent by the download server, where the encrypted file is obtained by encrypting the upgrade file;
  • the encrypted file is decrypted to obtain the upgrade file.
  • the first check value is the first data segment Output data obtained by using a data segment as the input of the first algorithm
  • the first check value is the first data segment And a second check value as output data obtained by inputting the first algorithm; the second check value is obtained by processing the previous data segment of the first data segment by the first algorithm.
  • the first encrypted segment is obtained by encrypting the first data segment and the first check value by using the first key.
  • the first key is a pre-shared key configured in advance for the first in-vehicle device and the second in-vehicle device.
  • the first key is a key obtained by mutual authentication and negotiation of the TLS protocol between the first vehicle-mounted device and the second vehicle-mounted device.
  • the first key is a key obtained by performing mutual authentication negotiation of the TLS protocol between the first vehicle-mounted device and the second vehicle-mounted device;
  • the first check value is a message authentication code of the first data segment obtained by processing the first data segment by the first algorithm based on the TLS protocol.
  • the first vehicle-mounted device 800 is the first vehicle-mounted device in the method embodiments shown in FIG. 2, FIG. 3, FIG. 4, and FIG. 5.
  • FIG. 9 is a schematic structural diagram of another second vehicle-mounted device provided by an embodiment of the present application.
  • the second vehicle-mounted device 900 may include a processor 901, a memory 902, and a transceiver 903.
  • the processor 901, the memory 902, and the The transceivers 903 are connected to each other through a bus.
  • the memory 902 includes, but is not limited to, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), or Portable read-only memory (compact disc read-only memory, CD-ROM).
  • RAM random access memory
  • ROM read-only memory
  • EPROM erasable programmable read-only memory
  • CD-ROM Compact disc read-only memory
  • the memory 902 is used to store related computer programs and data.
  • the transceiver 903 is used to receive and send data.
  • the processor 901 may be one or more central processing units (CPU).
  • the processor 901 is a CPU
  • the CPU may be a single-core CPU or a multi-core CPU.
  • the processor 901 in the second in-vehicle device 900 may be used to read the computer program code stored in the memory 902, and perform the following operations:
  • the control transceiver 903 receives the first encrypted segment sent by the first vehicle-mounted device; the first encrypted segment is obtained by encrypting the first data segment with the first key, and the first data segment is used for Upgrading any one of the multiple data segments included in the upgrade file of the second vehicle-mounted device;
  • the first check value is verified by the first algorithm
  • the first data is stored in the second vehicle-mounted device in segments
  • the first check value is the first vehicle-mounted device Obtained by processing the first data segment by a first algorithm, the first check value is received by the second vehicle-mounted device from the first vehicle-mounted device;
  • the upgrade file is formed based on the first data segment for upgrade.
  • the first data segment is the first data segment among the multiple data segments of the upgrade file
  • the first check value is the first data segment
  • Data segmentation is used as output data obtained from the input of the first algorithm
  • the first check value is the first data segment And a second check value as output data obtained by inputting the first algorithm; the second check value is obtained by processing the previous data segment of the first data segment by the first algorithm.
  • the first encrypted segment is obtained by encrypting the first data segment and the first check value by using the first key.
  • the first key is a pre-shared key configured in advance for the first in-vehicle device and the second in-vehicle device.
  • the first key is a key obtained by mutual authentication and negotiation of the TLS protocol between the first vehicle-mounted device and the second vehicle-mounted device.
  • the first key is a key obtained by performing mutual authentication negotiation of the TLS protocol between the first vehicle-mounted device and the second vehicle-mounted device;
  • the first check value is a message authentication code of the first data segment obtained by processing the first data segment by the first algorithm based on the TLS protocol.
  • the second in-vehicle device 900 is the second in-vehicle device in the method embodiments shown in FIG. 2, FIG. 3, FIG. 4, and FIG. 5.
  • An embodiment of the present application also provides a chip system.
  • the chip system includes at least one processor, a memory, and an interface circuit.
  • the memory, a transceiver, and at least one processor are interconnected by wires, and the at least one memory stores a computer program.
  • the computer program When the computer program is executed by the processor, it implements the operations performed by the first vehicle-mounted device in the embodiment shown in Figure 2, Figure 3, Figure 4, or Figure 5, or implements the implementation shown in Figure 2, Figure 3, Figure 4, or Figure 5 The operation performed by the second in-vehicle device in the example.
  • the embodiment of the present application also provides a computer-readable storage medium.
  • the computer-readable storage medium stores a computer program. When it runs on a processor, the embodiment shown in FIG. 2, FIG. 3, FIG. 4, or FIG. 5 is implemented. The operations performed by the first in-vehicle device in FIG. 2, or the operations performed by the second in-vehicle device in the embodiment shown in FIG. 2, FIG. 3, FIG. 4, or FIG. 5 are implemented.
  • the embodiments of the present application also provide a computer program product, which when the computer program product runs on a processor, realizes the operations performed by the first vehicle-mounted device in the embodiment shown in FIG. 2, FIG. 3, FIG. 4, or FIG. 5, or The operation performed by the second vehicle-mounted device in the embodiment shown in FIG. 2, FIG. 3, FIG. 4, or FIG. 5 is realized.
  • the computer program can be stored in a computer readable storage medium.
  • the computer program During execution, it may include the procedures of the foregoing method embodiments.
  • the aforementioned storage media include: ROM or random storage RAM, magnetic disks or optical discs and other media that can store computer program codes.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • General Engineering & Computer Science (AREA)
  • Computing Systems (AREA)
  • Computer Hardware Design (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Medical Informatics (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Power Engineering (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Storage Device Security (AREA)
  • Stored Programmes (AREA)
  • Small-Scale Networks (AREA)

Abstract

一种车载设备升级方法及相关装置，应用于车辆信息安全领域，该方法包括：车辆的车载单元通过第一算法处理第一数据分段以得到第一校验值；第一数据分段是用于升级车辆的控制单元的升级文件所包含的多个数据分段中的任意一个数据分段，第一校验值用于发送给控制单元；该车载设备通过第一密钥加密第一数据分段以得到第一加密分段，并向控制单元发送第一加密分段，以用于控制单元将通过第一密钥解密第一加密分段所得到的第一数据分段存储到控制单元中；第一数据分段用于供控制单元组成上述升级文件进行升级。该方法能够有效提高升级文件在车内传输过程中的安全性。

Description

一种车载设备升级方法及相关装置 技术领域
本申请涉及信息技术领域，尤其涉及一种车载设备升级方法及相关装置。
背景技术
空中升级(over the air，OTA)是一种通过空中接口远程管理、更新电子设备中固件的技术，OTA升级具备高效便捷、低成本的特性。OTA技术目前已被很多整车制造商(original equipmentmanufacturer，OEM)的车型部署，用于升级车辆的电子控制单元(electronic control unit，ECU)等固件。车辆的车载单元(telematics box，Tbox)能通过无线链路获取OEM云端服务器发布的软件升级包，并将软件升级包刷写到车辆的ECU等固件中。
但是，目前对于OTA升级的安全性考虑明显不足，软件升级包的传输过程存在安全隐患，如软件升级包包含的关键算法、用户隐私等重要信息容易被篡改和窃取，如何提高软件升级包传输过程的安全性是本领域的技术人员正在研究的问题。
发明内容
本申请实施例公开了一种车载设备升级方法及相关装置，能够有效提高升级文件传输过程的安全性。
第一方面，本申请实施例公开一种车载设备升级方法，该方法包括：
第一车载设备通过第一算法处理第一数据分段以得到第一校验值；所述第一数据分段是用于升级第二车载设备的升级文件所包含的多个数据分段中的任意一个数据分段，所述第一校验值用于发送给所述第二车载设备；
通过第一密钥加密所述第一数据分段以得到第一加密分段；
向所述第二车载设备发送所述第一加密分段，以用于所述第二车载设备在通过所述第一算法验证所述第一校验值通过的情况下，将通过所述第一密钥解密所述第一加密分段所得到的所述第一数据分段存储到所述第二车载设备中；所述第一数据分段用于供所述第二车载设备组成所述升级文件进行升级。
在上述方法中，用于升级第二车载设备的升级文件的多个数据分段中的每个数据分段均单独进行加密和传输，能够有效降低每个数据分段被窃取的风险。并且在接收端(即第二车载设备)均需验证每个数据分段对应的校验值，而不是仅在最后一个数据分段传输完成后才进行整个升级文件的校验，能够及时发现被篡改的异常数据分段，并在发现异常数据分段之后及时触发停止新的数据分段的传输，从而有效提高升级文件传输过程的安全性。
在第一方面的一种可选的方案中，所述第一车载设备通过第一算法处理第一数据分段以得到第一校验值之前，还包括：
所述第一车载设备与下载服务器进行超文本传输安全协议HTTPS的双向认证；所述下载服务器用于为所述第二车载设备提供所述升级文件；
接收所述下载服务器发送的加密文件，所述加密文件为对所述升级文件进行加密获得；
当满足预设的升级条件时解密所述加密文件以得到所述升级文件。
可以看出，提供升级文件的下载服务器为与第一车载设备进行HTTPS协议的双向认证的服务器，确保了升级文件来源的合法性，避免了非授权平台向第一车载设备下发恶意升级文件的情况，以及避免了攻击者仿冒第一车载设备窃取下载服务器发布的包含重要信息的升级文件的情况。并且，下载服务器和第一车载设备之间传输的是经过加密的升级文件，能够有效降低升级文件被窃取的风险，从而有效提高升级文件传输过程的安全性。
在第一方面的又一种可选的方案中，若所述第一数据分段为所述升级文件的多个数据分段中的首个数据分段，则所述第一校验值是将所述第一数据分段作为所述第一算法的输入得到的输出数据；
若所述第一数据分段为所述升级文件的多个数据分段中除首个数据分段以外的一个数据分段，则所述第一校验值是将所述第一数据分段和第二校验值作为所述第一算法的输入得到的输出数据；所述第二校验值是通过所述第一算法处理所述第一数据分段的前一个数据分段得到的。
可以看出，升级文件的多个数据分段中除首个数据分段外的其他数据分段对应的校验值均与前一个数据分段对应的校验值相关，通过哈希链实现了数据分段的顺序检测机制，避免乱序分段刷写成功导致升级文件组装出错的情况，校验值通过哈希链的方式来实现也增加了被恶意破解的难度。
在第一方面的又一种可选的方案中，所述第一加密分段是通过所述第一密钥加密所述第一数据分段和所述第一校验值得到的。
可以看出，在对第一数据分段加密的基础上，还可以对第一校验值加密，从而进一步提高升级文件传输过程的安全性。
在第一方面的又一种可选的方案中，所述第一密钥为预先为所述第一车载设备和所述第二车载设备配置的预共享密钥。
可以看出，通过预先配置的预共享密钥，而非通过安全协议或安全算法协商得到的密钥来保障每个数据分段的机密性，能够有效减少第一车载设备和第二车载设备的资源消耗。
在第一方面的又一种可选的方案中，所述第一密钥为所述第一车载设备和所述第二车载设备进行传输层安全协议TLS的双向认证协商得到的密钥。
可以看出，通过TLS协议协商得到的密钥对每个数据分段加密能够保障每个数据分段的机密性，并且对于不同的第二车载设备，第一车载设备和第二车载设备进行的双向认证过程不同，协商得到的第一密钥也可以不同，即不同的升级文件对应的加解密密钥可以不同，从而大大提高升级文件传输过程的安全性。
在第一方面的又一种可选的方案中，所述第一密钥为所述第一车载设备和所述第二车载设备进行TLS协议的双向认证协商得到的密钥；
所述第一校验值是基于TLS协议通过所述第一算法处理所述第一数据分段得到的所述第一数据分段的消息认证码。
可以看出，基于TLS协议对每个数据分段进行机密性保护和完整性保护，有利于保障升级文件传输过程的安全性。
第二方面，本申请实施例提供一种车载设备升级方法，包括：
第二车载设备接收第一车载设备发送的第一加密分段；所述第一加密分段是通过第一密钥对第一数据分段加密得到的，所述第一数据分段是用于升级所述第二车载设备的升级文件所包含的多个数据分段中的任意一个数据分段；
通过所述第一密钥解密所述第一加密分段以得到所述第一数据分段；
在通过所述第一算法验证第一校验值通过的情况下，将所述第一数据分段存储到所述第二车载设备中；所述第一校验值是所述第一车载设备通过第一算法处理所述第一数据分段得到的，所述第一校验值为所述第二车载设备从所述第一车载设备处接收；
基于所述第一数据分段组成所述升级文件进行升级。
在上述方法中，用于升级第二车载设备的升级文件的多个数据分段中的每个数据分段均单独进行加密和传输，能够有效降低每个数据分段被窃取的风险。并且在接收端(即第二车载设备)均需验证每个数据分段对应的校验值，而不是仅在最后一个数据分段传输完成后才进行整个升级文件的校验，能够及时发现被篡改的异常数据分段，并在发现异常数据分段之后及时触发停止新的数据分段的传输，从而有效提高升级文件传输过程的安全性。
在第二方面的一种可选的方案中，若所述第一数据分段为所述升级文件的多个数据分段中的首个数据分段，则所述第一校验值是将所述第一数据分段作为所述第一算法的输入得到的输出数据；
若所述第一数据分段为所述升级文件的多个数据分段中除首个数据分段以外的一个数据分段，则所述第一校验值是将所述第一数据分段和第二校验值作为所述第一算法的输入得到的输出数据；所述第二校验值是通过所述第一算法处理所述第一数据分段的前一个数据分段得到的。
可以看出，升级文件的多个数据分段中除首个数据分段外的其他数据分段对应的校验值均与前一个数据分段对应的校验值相关，通过哈希链实现了数据分段的顺序检测机制，避免乱序分段刷写成功导致升级文件组装出错的情况，校验值通过哈希链的方式来实现也增加了被恶意破解的难度。
在第二方面的又一种可选的方案中，所述第一加密分段是通过所述第一密钥加密所述第一数据分段和所述第一校验值得到的。
可以看出，在对第一数据分段加密的基础上，还可以对第一校验值加密，从而进一步提高升级文件传输过程的安全性。
在第二方面的又一种可选的方案中，所述第一密钥为预先为所述第一车载设备和所述第二车载设备配置的预共享密钥。
可以看出，通过预先配置的预共享密钥，而非通过安全协议或安全算法协商得到的密钥来保障每个数据分段的机密性，能够有效减少第一车载设备和第二车载设备的资源消耗。
在第二方面的又一种可选的方案中，所述第一密钥为所述第一车载设备和所述第二车载设备进行传输层安全协议TLS的双向认证协商得到的密钥。
可以看出，通过TLS协议协商得到的密钥对每个数据分段加密能够保障每个数据分段的机密性，并且对于不同的第二车载设备，第一车载设备和第二车载设备进行的双向认证过程不同，协商得到的第一密钥也可以不同，即不同的升级文件对应的加解密密钥可以不 同，从而大大提高升级文件传输过程的安全性。
在第二方面的又一种可选的方案中，所述第一密钥为所述第一车载设备和所述第二车载设备进行TLS协议的双向认证协商得到的密钥；
所述第一校验值是基于TLS协议通过所述第一算法处理所述第一数据分段得到的所述第一数据分段的消息认证码。
可以看出，基于TLS协议对每个数据分段进行机密性保护和完整性保护，有利于保障升级文件传输过程的安全性。
第三方面，本申请实施例提供一种车载设备升级方法，应用于车辆，所述车辆包括第一车载设备和第二车载设备，所述方法包括：
所述第一车载设备通过第一算法处理第一数据分段以得到第一校验值；所述第一数据分段是用于升级所述第二车载设备的升级文件所包含的多个数据分段中的任意一个数据分段，所述第一校验值用于发送给所述第二车载设备；
所述第一车载设备通过第一密钥加密所述第一数据分段以得到第一加密分段；
所述第一车载设备向所述第二车载设备发送所述第一加密分段；
所述第二车载设备接收所述第一车载设备发送的所述第一加密分段；
所述第二车载设备通过所述第一密钥解密所述第一加密分段以得到所述第一数据分段；
所述第二车载设备在通过所述第一算法验证所述第一校验值通过的情况下，将所述第一数据分段存储到所述第二车载设备中；
所述第二车载设备基于所述第一数据分段组成所述升级文件进行升级。
在上述方法中，用于升级第二车载设备的升级文件的多个数据分段中的每个数据分段均单独进行加密和传输，能够有效降低每个数据分段被窃取的风险。并且在接收端(即第二车载设备)均需验证每个数据分段对应的校验值，而不是仅在最后一个数据分段传输完成后才进行整个升级文件的校验，能够及时发现被篡改的异常数据分段，并在发现异常数据分段之后及时触发停止新的数据分段的传输，从而有效提高升级文件传输过程的安全性。
在第三方面的一种可选的方案中，所述第一车载设备通过第一算法处理第一数据分段以得到第一校验值之前，还包括：
所述第一车载设备与下载服务器进行HTTPS协议的双向认证；所述下载服务器用于为所述第二车载设备提供所述升级文件；
所述第一车载设备接收所述下载服务器发送的加密文件，所述加密文件为对所述升级文件进行加密获得；
当满足预设的升级条件时，所述第一车载设备解密所述加密文件以得到所述升级文件。
可以看出，提供升级文件的下载服务器为与第一车载设备进行HTTPS协议的双向认证的服务器，确保了升级文件来源的合法性，避免了非授权平台向第一车载设备下发恶意升级文件的情况，以及避免了攻击者仿冒第一车载设备窃取下载服务器发布的包含重要信息的升级文件的情况。并且，下载服务器和第一车载设备之间传输的是经过加密的升级文件，能够有效降低升级文件被窃取的风险，从而有效提高升级文件传输过程的安全性。
在第三方面的又一种可选的方案中，若所述第一数据分段为所述升级文件的多个数据 分段中的首个数据分段，则所述第一校验值是将所述第一数据分段作为所述第一算法的输入得到的输出数据；
若所述第一数据分段为所述升级文件的多个数据分段中除首个数据分段以外的一个数据分段，则所述第一校验值是将所述第一数据分段和第二校验值作为所述第一算法的输入得到的输出数据；所述第二校验值是通过所述第一算法处理所述第一数据分段的前一个数据分段得到的。
可以看出，升级文件的多个数据分段中除首个数据分段外的其他数据分段对应的校验值均与前一个数据分段对应的校验值相关，通过哈希链实现了数据分段的顺序检测机制，避免乱序分段刷写成功导致升级文件组装出错的情况，校验值通过哈希链的方式来实现也增加了被恶意破解的难度。
在第三方面的又一种可选的方案中，所述第一加密分段是通过所述第一密钥加密所述第一数据分段和所述第一校验值得到的。
可以看出，在对第一数据分段加密的基础上，还可以对第一校验值加密，从而进一步提高升级文件传输过程的安全性。
在第三方面的又一种可选的方案中，所述第一密钥为预先为所述第一车载设备和所述第二车载设备配置的预共享密钥。
可以看出，通过预先配置的预共享密钥，而非通过安全协议或安全算法协商得到的密钥来保障每个数据分段的机密性，能够有效减少第一车载设备和第二车载设备的资源消耗。
在第三方面的又一种可选的方案中，所述第一密钥为所述第一车载设备和所述第二车载设备进行传输层安全协议TLS的双向认证协商得到的密钥。
可以看出，通过TLS协议协商得到的密钥对每个数据分段加密能够保障每个数据分段的机密性，并且对于不同的第二车载设备，第一车载设备和第二车载设备进行的双向认证过程不同，协商得到的第一密钥也可以不同，即不同的升级文件对应的加解密密钥可以不同，从而大大提高升级文件传输过程的安全性。
在第三方面的又一种可选的方案中，所述第一密钥为所述第一车载设备和所述第二车载设备进行TLS协议的双向认证协商得到的密钥；
所述第一校验值是基于TLS协议通过所述第一算法处理所述第一数据分段得到的所述第一数据分段的消息认证码。
可以看出，基于TLS协议对每个数据分段进行机密性保护和完整性保护，有利于保障升级文件传输过程的安全性。
第四方面，本申请实施例提供一种第一车载设备，包括：
处理单元，用于通过第一算法处理第一数据分段以得到第一校验值；所述第一数据分段是用于升级第二车载设备的升级文件所包含的多个数据分段中的任意一个数据分段，所述第一校验值用于发送给所述第二车载设备；
加密单元，用于通过第一密钥加密所述第一数据分段以得到第一加密分段；
通信单元，用于向所述第二车载设备发送所述第一加密分段，以用于所述第二车载设备在通过所述第一算法验证所述第一校验值通过的情况下，将通过所述第一密钥解密所述 第一加密分段所得到的所述第一数据分段存储到所述第二车载设备中；所述第一数据分段用于供所述第二车载设备组成所述升级文件进行升级。
在上述装置中，用于升级第二车载设备的升级文件的多个数据分段中的每个数据分段均单独进行加密和传输，能够有效降低每个数据分段被窃取的风险。并且在接收端(即第二车载设备)均需验证每个数据分段对应的校验值，而不是仅在最后一个数据分段传输完成后才进行整个升级文件的校验，能够及时发现被篡改的异常数据分段，并在发现异常数据分段之后及时触发停止新的数据分段的传输，从而有效提高升级文件传输过程的安全性。
在第四方面的一种可选的方案中，所述第一车载设备还包括协商单元和解密单元，其中：
协商单元，用于在处理单元通过第一算法处理第一数据分段以得到第一校验值之前，与下载服务器进行HTTPS的双向认证；所述下载服务器用于为所述第二车载设备提供所述升级文件；
通信单元，还用于接收所述下载服务器发送的加密文件，所述加密文件为对所述升级文件进行加密获得；
解密单元，用于当满足预设的升级条件时解密所述加密文件以得到所述升级文件。
可以看出，提供升级文件的下载服务器为与第一车载设备进行HTTPS协议的双向认证的服务器，确保了升级文件来源的合法性，避免了非授权平台向第一车载设备下发恶意升级文件的情况，以及避免了攻击者仿冒第一车载设备窃取下载服务器发布的包含重要信息的升级文件的情况。并且，下载服务器和第一车载设备之间传输的是经过加密的升级文件，能够有效降低升级文件被窃取的风险，从而有效提高升级文件传输过程的安全性。
在第四方面的又一种可选的方案中，若所述第一数据分段为所述升级文件的多个数据分段中的首个数据分段，则所述第一校验值是将所述第一数据分段作为所述第一算法的输入得到的输出数据；
若所述第一数据分段为所述升级文件的多个数据分段中除首个数据分段以外的一个数据分段，则所述第一校验值是将所述第一数据分段和第二校验值作为所述第一算法的输入得到的输出数据；所述第二校验值是通过所述第一算法处理所述第一数据分段的前一个数据分段得到的。
可以看出，升级文件的多个数据分段中除首个数据分段外的其他数据分段对应的校验值均与前一个数据分段对应的校验值相关，通过哈希链实现了数据分段的顺序检测机制，避免乱序分段刷写成功导致升级文件组装出错的情况，校验值通过哈希链的方式来实现也增加了被恶意破解的难度。
在第四方面的又一种可选的方案中，所述第一加密分段是通过所述第一密钥加密所述第一数据分段和所述第一校验值得到的。
可以看出，在对第一数据分段加密的基础上，还可以对第一校验值加密，从而进一步提高升级文件传输过程的安全性。
在第四方面的又一种可选的方案中，所述第一密钥为预先为所述第一车载设备和所述第二车载设备配置的预共享密钥。
可以看出，通过预先配置的预共享密钥，而非通过安全协议或安全算法协商得到的密 钥来保障每个数据分段的机密性，能够有效减少第一车载设备和第二车载设备的资源消耗。
在第四方面的又一种可选的方案中，所述第一密钥为所述第一车载设备和所述第二车载设备进行传输层安全协议TLS的双向认证协商得到的密钥。
可以看出，通过TLS协议协商得到的密钥对每个数据分段加密能够保障每个数据分段的机密性，并且对于不同的第二车载设备，第一车载设备和第二车载设备进行的双向认证过程不同，协商得到的第一密钥也可以不同，即不同的升级文件对应的加解密密钥可以不同，从而大大提高升级文件传输过程的安全性。
在第四方面的又一种可选的方案中，所述第一密钥为所述第一车载设备和所述第二车载设备进行TLS协议的双向认证协商得到的密钥；
所述第一校验值是基于TLS协议通过所述第一算法处理所述第一数据分段得到的所述第一数据分段的消息认证码。
可以看出，基于TLS协议对每个数据分段进行机密性保护和完整性保护，有利于保障升级文件传输过程的安全性。
第五方面，本申请实施例提供一种第二车载设备，包括：
通信单元，用于接收第一车载设备发送的第一加密分段；所述第一加密分段是通过第一密钥对第一数据分段加密得到的，所述第一数据分段是用于升级所述第二车载设备的升级文件所包含的多个数据分段中的任意一个数据分段；
解密单元，用于通过所述第一密钥解密所述第一加密分段以得到所述第一数据分段；
验证单元，用于在通过所述第一算法验证第一校验值通过的情况下，将所述第一数据分段存储到所述第二车载设备中；所述第一校验值是所述第一车载设备通过第一算法处理所述第一数据分段得到的，所述第一校验值为所述第二车载设备从所述第一车载设备处接收；
升级单元，用于基于所述第一数据分段组成所述升级文件进行升级。
在上述装置中，用于升级第二车载设备的升级文件的多个数据分段中的每个数据分段均单独进行加密和传输，能够有效降低每个数据分段被窃取的风险。并且在接收端(即第二车载设备)均需验证每个数据分段对应的校验值，而不是仅在最后一个数据分段传输完成后才进行整个升级文件的校验，能够及时发现被篡改的异常数据分段，并在发现异常数据分段之后及时触发停止新的数据分段的传输，从而有效提高升级文件传输过程的安全性。
在第五方面的一种可选的方案中，若所述第一数据分段为所述升级文件的多个数据分段中的首个数据分段，则所述第一校验值是将所述第一数据分段作为所述第一算法的输入得到的输出数据；
若所述第一数据分段为所述升级文件的多个数据分段中除首个数据分段以外的一个数据分段，则所述第一校验值是将所述第一数据分段和第二校验值作为所述第一算法的输入得到的输出数据；所述第二校验值是通过所述第一算法处理所述第一数据分段的前一个数据分段得到的。
可以看出，升级文件的多个数据分段中除首个数据分段外的其他数据分段对应的校验值均与前一个数据分段对应的校验值相关，通过哈希链实现了数据分段的顺序检测机制， 避免乱序分段刷写成功导致升级文件组装出错的情况，校验值通过哈希链的方式来实现也增加了被恶意破解的难度。
在第五方面的又一种可选的方案中，所述第一加密分段是通过所述第一密钥加密所述第一数据分段和所述第一校验值得到的。
可以看出，在对第一数据分段加密的基础上，还可以对第一校验值加密，从而进一步提高升级文件传输过程的安全性。
在第五方面的又一种可选的方案中，所述第一密钥为预先为所述第一车载设备和所述第二车载设备配置的预共享密钥。
可以看出，通过预先配置的预共享密钥，而非通过安全协议或安全算法协商得到的密钥来保障每个数据分段的机密性，能够有效减少第一车载设备和第二车载设备的资源消耗。
在第五方面的又一种可选的方案中，所述第一密钥为所述第一车载设备和所述第二车载设备进行传输层安全协议TLS的双向认证协商得到的密钥。
可以看出，通过TLS协议协商得到的密钥对每个数据分段加密能够保障每个数据分段的机密性，并且对于不同的第二车载设备，第一车载设备和第二车载设备进行的双向认证过程不同，协商得到的第一密钥也可以不同，即不同的升级文件对应的加解密密钥可以不同，从而大大提高升级文件传输过程的安全性。
在第五方面的又一种可选的方案中，所述第一密钥为所述第一车载设备和所述第二车载设备进行TLS协议的双向认证协商得到的密钥；
所述第一校验值是基于TLS协议通过所述第一算法处理所述第一数据分段得到的所述第一数据分段的消息认证码。
可以看出，基于TLS协议对每个数据分段进行机密性保护和完整性保护，有利于保障升级文件传输过程的安全性。
第六方面，本申请实施例提供一种第一车载设备，所述第一车载设备包括收发器、处理器和存储器，所述存储器用于存储计算机程序，所述处理器调用所述计算机程序，用于执行如下操作：
通过第一算法处理第一数据分段以得到第一校验值；所述第一数据分段是用于升级第二车载设备的升级文件所包含的多个数据分段中的任意一个数据分段，所述第一校验值用于发送给所述第二车载设备；
通过第一密钥加密所述第一数据分段以得到第一加密分段；
控制所述收发器向所述第二车载设备发送所述第一加密分段，以用于所述第二车载设备在通过所述第一算法验证所述第一校验值通过的情况下，将通过所述第一密钥解密所述第一加密分段所得到的所述第一数据分段存储到所述第二车载设备中；所述第一数据分段用于供所述第二车载设备组成所述升级文件进行升级。
在上述装置中，用于升级第二车载设备的升级文件的多个数据分段中的每个数据分段均单独进行加密和传输，能够有效降低每个数据分段被窃取的风险。并且在接收端(即第二车载设备)均需验证每个数据分段对应的校验值，而不是仅在最后一个数据分段传输完成后才进行整个升级文件的校验，能够及时发现被篡改的异常数据分段，并在发现异常数 据分段之后及时触发停止新的数据分段的传输，从而有效提高升级文件传输过程的安全性。
在第六方面的一种可选的方案中，所述通过第一算法处理第一数据分段以得到第一校验值之前，所述处理器还用于：
与下载服务器进行HTTPS协议的双向认证；所述下载服务器用于为所述第二车载设备提供所述升级文件；
控制所述收发器接收所述下载服务器发送的加密文件，所述加密文件为对所述升级文件进行加密获得；
当满足预设的升级条件时解密所述加密文件以得到所述升级文件。
可以看出，提供升级文件的下载服务器为与第一车载设备进行HTTPS协议的双向认证的服务器，确保了升级文件来源的合法性，避免了非授权平台向第一车载设备下发恶意升级文件的情况，以及避免了攻击者仿冒第一车载设备窃取下载服务器发布的包含重要信息的升级文件的情况。并且，下载服务器和第一车载设备之间传输的是经过加密的升级文件，能够有效降低升级文件被窃取的风险，从而有效提高升级文件传输过程的安全性。
在第六方面的又一种可选的方案中，若所述第一数据分段为所述升级文件的多个数据分段中的首个数据分段，则所述第一校验值是将所述第一数据分段作为所述第一算法的输入得到的输出数据；
若所述第一数据分段为所述升级文件的多个数据分段中除首个数据分段以外的一个数据分段，则所述第一校验值是将所述第一数据分段和第二校验值作为所述第一算法的输入得到的输出数据；所述第二校验值是通过所述第一算法处理所述第一数据分段的前一个数据分段得到的。
可以看出，升级文件的多个数据分段中除首个数据分段外的其他数据分段对应的校验值均与前一个数据分段对应的校验值相关，通过哈希链实现了数据分段的顺序检测机制，避免乱序分段刷写成功导致升级文件组装出错的情况，校验值通过哈希链的方式来实现也增加了被恶意破解的难度。
在第六方面的又一种可选的方案中，所述第一加密分段是通过所述第一密钥加密所述第一数据分段和所述第一校验值得到的。
可以看出，在对第一数据分段加密的基础上，还可以对第一校验值加密，从而进一步提高升级文件传输过程的安全性。
在第六方面的又一种可选的方案中，所述第一密钥为预先为所述第一车载设备和所述第二车载设备配置的预共享密钥。
可以看出，通过预先配置的预共享密钥，而非通过安全协议或安全算法协商得到的密钥来保障每个数据分段的机密性，能够有效减少第一车载设备和第二车载设备的资源消耗。
在第六方面的又一种可选的方案中，所述第一密钥为所述第一车载设备和所述第二车载设备进行传输层安全协议TLS的双向认证协商得到的密钥。
可以看出，通过TLS协议协商得到的密钥对每个数据分段加密能够保障每个数据分段的机密性，并且对于不同的第二车载设备，第一车载设备和第二车载设备进行的双向认证过程不同，协商得到的第一密钥也可以不同，即不同的升级文件对应的加解密密钥可以不同，从而大大提高升级文件传输过程的安全性。
在第六方面的又一种可选的方案中，所述第一密钥为所述第一车载设备和所述第二车载设备进行TLS协议的双向认证协商得到的密钥；
所述第一校验值是基于TLS协议通过所述第一算法处理所述第一数据分段得到的所述第一数据分段的消息认证码。
可以看出，基于TLS协议对每个数据分段进行机密性保护和完整性保护，有利于保障升级文件传输过程的安全性。
第七方面，本申请实施例提供一种第二车载设备，所述第二车载设备包括收发器、处理器和存储器，所述存储器用于存储计算机程序，所述处理器调用所述计算机程序，用于执行如下操作：
控制所述收发器接收第一车载设备发送的第一加密分段；所述第一加密分段是通过第一密钥对第一数据分段加密得到的，所述第一数据分段是用于升级所述第二车载设备的升级文件所包含的多个数据分段中的任意一个数据分段；
通过所述第一密钥解密所述第一加密分段以得到所述第一数据分段；
在通过所述第一算法验证第一校验值通过的情况下，将所述第一数据分段存储到所述第二车载设备中；所述第一校验值是所述第一车载设备通过第一算法处理所述第一数据分段得到的，所述第一校验值为所述第二车载设备从所述第一车载设备处接收；
基于所述第一数据分段组成所述升级文件进行升级。
在上述装置中，用于升级第二车载设备的升级文件的多个数据分段中的每个数据分段均单独进行加密和传输，能够有效降低每个数据分段被窃取的风险。并且在接收端(即第二车载设备)均需验证每个数据分段对应的校验值，而不是仅在最后一个数据分段传输完成后才进行整个升级文件的校验，能够及时发现被篡改的异常数据分段，并在发现异常数据分段之后及时触发停止新的数据分段的传输，从而有效提高升级文件传输过程的安全性。
在第七方面的一种可选的方案中，若所述第一数据分段为所述升级文件的多个数据分段中的首个数据分段，则所述第一校验值是将所述第一数据分段作为所述第一算法的输入得到的输出数据；
若所述第一数据分段为所述升级文件的多个数据分段中除首个数据分段以外的一个数据分段，则所述第一校验值是将所述第一数据分段和第二校验值作为所述第一算法的输入得到的输出数据；所述第二校验值是通过所述第一算法处理所述第一数据分段的前一个数据分段得到的。
可以看出，升级文件的多个数据分段中除首个数据分段外的其他数据分段对应的校验值均与前一个数据分段对应的校验值相关，通过哈希链实现了数据分段的顺序检测机制，避免乱序分段刷写成功导致升级文件组装出错的情况，校验值通过哈希链的方式来实现也增加了被恶意破解的难度。
在第七方面的又一种可选的方案中，所述第一加密分段是通过所述第一密钥加密所述第一数据分段和所述第一校验值得到的。
可以看出，在对第一数据分段加密的基础上，还可以对第一校验值加密，从而进一步提高升级文件传输过程的安全性。
在第七方面的又一种可选的方案中，所述第一密钥为预先为所述第一车载设备和所述第二车载设备配置的预共享密钥。
可以看出，通过预先配置的预共享密钥，而非通过安全协议或安全算法协商得到的密钥来保障每个数据分段的机密性，能够有效减少第一车载设备和第二车载设备的资源消耗。
在第七方面的又一种可选的方案中，所述第一密钥为所述第一车载设备和所述第二车载设备进行传输层安全协议TLS的双向认证协商得到的密钥。
可以看出，通过TLS协议协商得到的密钥对每个数据分段加密能够保障每个数据分段的机密性，并且对于不同的第二车载设备，第一车载设备和第二车载设备进行的双向认证过程不同，协商得到的第一密钥也可以不同，即不同的升级文件对应的加解密密钥可以不同，从而大大提高升级文件传输过程的安全性。
在第七方面的又一种可选的方案中，所述第一密钥为所述第一车载设备和所述第二车载设备进行TLS协议的双向认证协商得到的密钥；
所述第一校验值是基于TLS协议通过所述第一算法处理所述第一数据分段得到的所述第一数据分段的消息认证码。
可以看出，基于TLS协议对每个数据分段进行机密性保护和完整性保护，有利于保障升级文件传输过程的安全性。
第八方面，本申请实施例提供一种车辆，包括第一车载设备和第二车载设备，其中：所述第一车载设备为第四方面，或者第四方面的任意一种可能的实现方式所描述的第一车载设备；所述第二车载设备为第五方面，或者第五方面的任意一种可能的实现方式所描述的第二车载设备。
第八方面，本申请实施例提供一种车辆，包括第一车载设备和第二车载设备，其中：所述第一车载设备为第六方面，或者第六方面的任意一种可能的实现方式所描述的第一车载设备，所述第二车载设备为第七方面，或者第七方面的任意一种可能的实现方式所描述的第二车载设备。
第九方面，本申请实施例提供一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，当其在处理器上运行时，实现第一方面和第二方面中任意一方面或者任意一方面的可选的方案所描述的方法。
附图说明
图1是本申请实施例提供的一种车载设备升级系统的架构示意图；
图2是本申请实施例提供的一种车载设备升级方法的流程示意图；
图3是本申请实施例提供的又一种车载设备升级方法的流程示意图；
图4是本申请实施例提供的又一种车载设备升级方法的流程示意图；
图5是本申请实施例提供的又一种车载设备升级方法的流程示意图；
图6是本申请实施例提供的一种第一设备的结构示意图；
图7是本申请实施例提供的一种第二设备的结构示意图；
图8是本申请实施例提供的又一种第一设备的结构示意图；
图9是本申请实施例提供的又一种第二设备的结构示意图。
具体实施方式
下面结合本申请实施例中的附图对本申请实施例进行描述。
请参见图1，图1是本申请实施例提供的一种车载设备升级系统的架构示意图，该架构示意图包括下载服务器110和车辆120，服务器110和车辆120可以通过无线链路(例如，WIFI、蓝牙和移动设备网络等)进行通信下载。车辆120包括通信总线121以及通过通信总线121互相通信的多个车载设备122，该多个车载设备122具体包括多少个设备，此处不做限定。
下载服务器110可以是整车制造商(original equipmentmanufacturer，OEM)设置的用于为车辆120提供升级文件的服务器。下载服务器110可以是单个服务器，也可以是多个服务器组成的服务器集群；下载服务器110可以是硬件服务器，也可以是云服务器，此处不做限定。
车辆120也可以是智能车辆、智能“充电狗”(一种可移动的用于为智能车辆充电的设备)等设备。通信总线121可以但不限于是局域互联网络(local interconnect network，LIN)总线和控制器局域网络(controller area network，CAN)总线等。车载设备122可以是车辆120中能够通过升级文件升级系统的电子设备或控制单元，例如电子控制单元(electronic control unit，ECU)，整车控制单元(vehicle control unit，VCU)等；车载设备122也可以是车辆120中能够通过无线链路获取下载服务器110提供的升级文件，并将该升级文件传输给其他需升级系统的车载设备的电子设备，例如车载单元(telematics box，Tbox)等。其中，ECU的种类繁多，不同的ECU可以用于实现不同的功能，例如，网关(gateway，GW)、自动变速箱控制单元(transmission control unit，TCU)、辅助控制单元(auxiliary control unit，ACU)等。
车辆120中的Tbox可以通过无线链路与下载服务器110通信，例如，Tbox可以通过无线链路获取下载服务器110发布的用于升级车辆120的控制单元(如ECU或VCU)的升级文件，并基于统一诊断服务(unified diagnostic services，UDS)的协议规范将该升级文件分段刷写到对应的控制单元的本地缓存(flash)对应的地址单元中，从而完成空中升级(over the air，OTA)过程。
为了便于描述，下面称Tbox为第一车载设备、称通过Tbox辅助分段刷写升级文件的控制单元(如ECU或VCU)为第二车载设备。
请参见图2，图2是本申请实施例提供的一种车载设备升级方法，该方法可以基于图1所示的车载设备升级系统实现，该方法包括但不限于如下步骤：
步骤S201：下载服务器和第一车载设备进行超文本传输安全协议(hyper texttransferprotocol over secure socket layer，HTTPS)的双向认证。
具体地，下载服务器用于通过第一车载设备为第二车载设备提供升级文件。
具体地，HTTPS协议可以理解为是在超文本传输协议(hyper texttransferprotocol，HTTP)的基础上通过安全套接层(securesocketslayer，SSL)或传输层安全协议(transport layer security，TLS)来保证传输过程的安全性的协议，由于TLS协议比SSL协议更新，应用更 广，本申请实施例以TLS协议为例进行说明。
HTTPS协议的双向认证实际是TLS协议的双向认证，也称为TLS握手协议的交互过程。在双向认证的过程中，下载服务器将下载服务器的根证书或OTA证书发送给第一车载设备，以供第一车载设备对下载服务器进行身份认证；同样地，第一车载设备也将第一车载设备的设备证书发送给下载服务器，以供下载服务器对第一车载设备进行身份认证。其中，OTA证书可以是下载服务器基于上述根证书派生得到的用于与第一车载设备安全交互的证书。
本申请实施例中，下载服务器和第一车载设备进行HTTPS协议的双向认证，能够有效避免非授权的下载服务器向第一车载设备发布恶意的升级文件，以及攻击者仿冒授权的第一车载设备窃取下载服务器发布的包含关键经验校准配置、关键算法、用户隐私等重要信息的升级文件的情况。
步骤S202：下载服务器对升级文件进行加密和签名，以得到加密文件和第一签名。
具体地，升级文件用于升级第二车载设备，下载服务器可以通过第二密钥对升级文件进行加密以得到加密文件，其中，该第二密钥可以是下载服务器随机生成的一个密钥，也可以是下载服务器与第一车载设备预先协商得到的一个密钥，还可以是预先配置(如通过可信的第三方设备进行配置)的一个密钥，当然还可以是通过其他方式获得的密钥。下载服务器可以通过第一证书的私钥对升级文件进行签名以得到第一签名，其中，该第一证书可以是下载服务器的根证书，也可以是上述OTA证书，当然也可以是其他能够标识下载服务器的身份的证书。
步骤S203：下载服务器向第一车载设备发送加密文件和第一签名。
步骤S204：第一车载设备接收加密文件和第一签名。
步骤S205：第一车载设备在验证第一签名通过的情况下，存储加密文件。
具体地，第一签名用于验证下载服务器发送的升级文件的完整性和升级文件来源(即下载服务器)的合法性，下载服务器可以通过能够标识下载服务器的身份的证书对升级文件进行签名以得到第一签名并发送给第一车载设备。相应地，第一车载设备可以通过该能够标识下载服务器的身份的证书的公钥验证第一签名，第一车载设备在第一签名验证通过的情况下，认为该升级文件没有被篡改过(即完整性校验通过)，以及认为发送该加密文件和第一签名的节点为该下载服务器(即合法性验证通过)。其中，本申请实施例对下载服务器进行签名的具体方式和第一车载设备验证签名的具体方式不做限定；为了便于理解，下面例举几种可选的验证签名的方案。
可选的，如果第一证书是下载服务器的根证书，那么该第一车载设备用到的第一证书可以是下载服务器发送给第一车载设备的，相应地，第一车载设备通过该根证书的公钥验证第一签名。
可选的，如果第一证书是OTA证书，那么该第一车载设备用到的第一证书可以是下载服务器发送给第一车载设备的，该下载服务器还向第一车载设备发送下载服务器的根证书。相应地，第一车载设备通过该根证书验证接收的OTA证书的合法性，若验证通过，则通过该OTA证书的公钥验证第一签名。
本申请实施例中，若第一签名验证通过，则存储加密文件；若OTA证书的合法性验证 不通过或第一签名验证不通过，则第一车载设备向车辆中用于实现整车系统故障诊断保护的车载设备，如VCU，上报加密文件异常的告警。
步骤S206：当满足预设的升级条件时，第一车载设备解密加密文件以得到升级文件。
具体地，预设的升级条件可以但不限于是车辆接收升级指令及车辆处于静止状态等，其中，升级指令可以但不限于是用户通过车辆内置的车载终端指示的，用户通过与车辆无线连接的车联网应用程序(application，APP)指示的。当不满足预设的升级条件时，升级文件以加密文件的形式存储在第一车载设备中，当满足预设的升级条件时，第一车载设备才通过第二密钥解密该加密文件以得到升级文件，而不是在接收到加密文件后立即解密得到并存储升级文件，从而避免升级文件在存储期间被窃取和篡改的情况，保障了升级文件的安全性。
可选的，如果第二密钥是下载服务器随机产生的一个密钥，那么下载服务器还可以通过第一车载设备的设备证书的公钥对第二密钥进行加密并将经过加密的第二密钥发送给第一车载设备。相应地，第一车载设备接收该下载服务器发送的经过加密的第二密钥，然后通过第一车载设备的设备证书的私钥对加密后的第二密钥进行解密，得到该第二密钥。通过这种方式得到的第二密钥用于该第一车载设备解密经加密的加密文件，得到升级文件。
可选的，该第一车载设备也可以在接收到加密文件后立即解密得到并存储升级文件，当然这种方式的安全性就相对较低了。
步骤S207：第一车载设备通过第一算法处理第一数据分段以得到第一校验值。
具体地，第一车载设备可以基于第二车载设备的接收能力将升级文件划分为多个数据分段，以n个数据分段为例进行说明，例如，升级文件的大小为64个字节，第二车载设备每次能接收数据包的大小为8个字节，因此第一车载设备需将64字节的升级文件划分为8个数据分段。第一车载设备每次向第二车载设备发送n个数据分段中的一个数据分段，当n个数据分段全部发送给第二车载设备时，完成分段刷写升级文件的过程。
上述第一数据分段是升级文件所包含的多个数据分段中的任意一个数据分段，即该多个数据分段中的每个数据分段的特性均适用于后续对第一数据分段的相关描述。
另外，第一算法和第一校验值用于保障每个数据分段的完整性，下面分情况举例说明：
情况一，第一算法是哈希算法，例如，SHA-256、SHA-384、SHA-512、MD2、MD4、MD5等，第一校验值是第一数据分段对应的哈希值，其中：
若第一数据分段为升级文件的多个数据分段中的首个数据分段，则第一校验值是将第一数据分段作为第一算法的输入得到的输出数据；
若第一数据分段为升级文件的多个数据分段中除首个数据分段以外的一个数据分段，则第一校验值是将第一数据分段和第二校验值作为第一算法的输入得到的输出数据；第二校验值是通过第一算法处理第一数据分段的前一个数据分段得到的。
例如，若升级文件File包括3个数据分段，按照顺序依次为data1，data2和data3，第一算法是MD5算法，那么：
若第一数据分段为data1，则第一校验值check1＝MD5(data1)；
若第一数据分段为data2，则第一校验值check2＝MD5(data2，check1)；
若第一数据分段为data3，则第一校验值check3＝MD5(data3，check2)。
情况二，第一算法是用于计算消息认证码(message authentication code，MAC)的算法，例如，哈希消息认证码(hash-based message authentication code，HMAC)算法等专用于计算MAC的算法，数据加密标准(data encryption standard，DES)等加密算法；第一校验值是基于TLS协议通过第一算法处理第一数据分段得到的第一数据分段的MAC。
例如，若升级文件File包括2个数据分段，按照顺序依次为data1和data2，第一算法是HMAC算法，那么：
若第一数据分段为data1，则第一校验值check1＝HMAC(data1)；
若第一数据分段为data2，则第一校验值check2＝HMAC(data2)。
步骤S208：第一车载设备通过第一密钥加密第一数据分段以得到第一加密分段。
在上述情况一的前提下，第一密钥可以是预先为第一车载设备和第二车载设备配置的预共享密钥(pre-shared key，PSK)，也可以是第一车载设备和第二车载设备通过安全算法或安全协议，如TLS协议，协商得到的密钥。第一车载设备可以通过该第一密钥加密第一数据分段和第一校验值以得到第一加密分段。
在上述情况二的前提下，第一密钥可以是通过安全协议，如TLS协议，协商得到的密钥。第一车载设备可以通过该第一密钥加密第一数据分段以得到第一加密分段。
步骤S209：第一车载设备向第二车载设备发送第一加密分段。
在上述情况一的前提下，第一车载设备向第二车载设备发送第一加密分段，该第一加密分段为第一车载设备通过第一算法加密第一数据分段和第一校验值得到的。
在上述情况二的前提下，第一车载设备向第二车载设备发送第一加密分段和第一校验值。
步骤S210：第二车载设备接收第一加密分段。
在上述情况一的前提下，第二车载设备接收第一车载设备发送的第一加密分段，该第一加密分段为第一车载设备通过第一算法加密第一数据分段和第一校验值得到的。
在上述情况二的前提下，第二车载设备接收第一车载设备发送的第一加密分段和第一校验值。
步骤S211：第二车载设备通过第一密钥解密第一加密分段以得到第一数据分段。
在上述情况一的前提下，第二车载设备，可选的，如第二车载设备中的引导程序BootLoader，通过第一密钥解密第一加密分段以得到第一数据分段和第一校验值。
在上述情况二的前提下，第二车载设备，可选的，如第二车载设备中的引导程序BootLoader，通过第一密钥解密第一加密分段以得到第一数据分段。
步骤S212：第二车载设备在通过第一算法验证第一校验值通过的情况下，将第一数据分段存储到第二车载设备中。
具体地，第二车载设备，可选的，如第二车载设备中的引导程序BootLoader，通过第一算法计算解密得到的第一数据分段对应的校验值，然后比较该校验值和接收或解密得到的第一校验值，若二者相同，完整性校验通过，则将该第一数据分段存储到第二车载设备的flash对应的地址单元中；若二者不同，完整性校验不通过，则停止刷写升级文件的过程并向车辆中用于实现整车系统故障诊断保护的车载设备，如VCU，上报第一数据分段异常的告警。
步骤S213：第二车载设备基于第一数据分段组成升级文件进行升级。
具体地，步骤S207-S212对应一个数据分段的安全刷写过程，升级文件的n个数据分段中的每个数据分段均按照步骤S207-S212所述的方式刷写到第二车载设备中，在n个数据分段全部刷写到第二车载设备中之后，第二车载设备可以组装n个数据分段以得到升级文件，并基于该升级文件升级系统。
在上述方法中，用于升级第二车载设备的升级文件的多个数据分段中的每个数据分段均单独进行加密和传输，有效降低车内传输过程中每个数据分段被窃取的风险，保障每个数据分段在车内传输过程的机密性。并且在接收端(即第二车载设备)均需验证每个数据分段对应的校验值，而不是仅在最后一个数据分段传输完成后才进行整个升级文件的校验，能够及时发现被篡改的异常数据分段，并在发现异常数据分段之后及时触发停止新的数据分段的传输，避免异常数据分段刷写到第二车载设备中造成第二车载设备工作异常或资源浪费的情况，保障了每个数据分段的完整性，从而有效提高升级文件传输过程的安全性。
以上图2所示的方法实施例中包含了很多可能的实现方案，下面分别结合图3、图4、图5对其中的部分实现方案进行举例说明，需要说明的是，图3、图4、图5未解释到的相关概念或者操作或者逻辑关系可以参照图2所示实施例中的相应描述，因此不再赘述。
请参见图3，图3是本申请实施例提供的又一种车载设备升级方法的流程示意图，该方法可以基于图1所示的车载设备升级系统实现，该方法包括但不限于如下步骤：
步骤S301：第一车载设备配置第一密钥。
步骤S302：第二车载设备配置第一密钥。
具体地，第一密钥是预先为第一车载设备和第二车载设备配置的预共享密钥(pre-shared key，PSK)。第一密钥可以是人工设置在第一车载设备和第二车载设备中的一个密钥，也可以是通过第三方设备生成并发送给第一车载设备和第二车载设备的一个密钥；其中，第三方设备可以通过有线链路或无线链路与第一车载设备和第二车载设备通信。
步骤S303：第一车载设备将首个数据分段作为第一算法的输入得到输出的首个数据分段对应的校验值。
具体地，第一算法是哈希算法，校验值是第一车载设备通过第一算法得到的哈希值，第一车载设备可以将用于升级第二车载设备的升级文件包括的多个数据分段(如n个数据分段)中的首个数据分段作为第一算法的输入得到输出的哈希值，即第一校验值。
例如，若首个数据分段为data1，第一算法是MD5算法，则第一车载设备通过将首个数据分段作为第一算法的输入得到输出的首个数据分段对应的校验值为check1＝MD5(data1)。
步骤S304：第一车载设备通过第一密钥加密首个数据分段和首个数据分段对应的校验值以得到首个数据分段对应的加密分段。
步骤S305：第一车载设备向第二车载设备发送首个数据分段对应的加密分段。
步骤S306：第二车载设备接收首个数据分段对应的加密分段。
步骤S307：第二车载设备通过第一密钥解密首个数据分段对应的加密分段以得到首个数据分段和首个数据分段对应的校验值。
步骤S308：第二车载设备在通过第一算法验证首个数据分段对应的校验值通过的情况下，将首个数据分段存储到第二车载设备中。
具体地，第二车载设备将解密得到的首个数据分段作为第一算法的输入得到输出的哈希值，比较该哈希值与解密得到的首个数据分段对应的校验值，若二者相同，认为首个数据分段没有被篡改(即完整性校验通过)，则第二车载设备将首个数据分段存储到第二车载设备的flash对应的地址单元中；若二者不同，认为首个数据分段被篡改(即完整性校验不通过)，则停止刷写该升级文件并向车辆中用于实现整车系统故障诊断保护的车载设备，如VCU，上报首个数据分段异常的告警。
例如，若第一算法是MD5算法，解密得到的首个数据分段为data1，解密得到的首个数据分段对应的校验值是check1，则第二车载设备将解密得到的首个数据分段作为第一算法的输入得到输出的哈希值为hash1＝MD5(data1)，比较hash1和check1，若二者相同则完整性校验通过，若二者不同则完整性校验不通过。
步骤S309：第一车载设备将首个数据分段对应的校验值和第二个数据分段作为第一算法的输入得到输出的第二个数据分段对应的校验值。
具体地，首个数据分段对应的校验值是通过第一算法处理首个数据分段得到的哈希值，首个数据分段对应的校验值是第一车载设备在首个数据分段的传输过程中向第二车载设备发送的。第二车载设备可以将首个数据分段对应的校验值和第二个数据分段作为第一算法的输入得到第二个数据分段对应的校验值。
例如，若第一算法是MD5算法，首个数据分段为data1，首个数据分段对应的校验值是check1＝MD5(data1)，第二个数据分段为data2，第一车载设备将首个数据分段对应的校验值和第二个数据分段作为第一算法的输入得到的第二个数据分段对应的校验值为check2＝MD5(data2，check1)。
步骤S310：第一车载设备通过第一密钥加密第二个数据分段和第二个数据分段对应的校验值以得到第二加密分段。
步骤S311：第一车载设备向第二车载设备发送第二加密分段。
步骤S312：第二车载设备接收第二加密分段。
步骤S313：第二车载设备通过第一密钥解密第二加密分段以得到第二个数据分段和第二个数据分段对应的校验值。
步骤S314：第二车载设备在通过第一算法验证第二个数据分段对应的校验值通过的情况下，将第二个数据分段存储到第二车载设备中。
具体地，第二车载设备将解密得到的第二个数据分段和首个数据分段传输过程中解密得到的首个数据分段对应的校验值作为第一算法的输入得到输出的哈希值，比较该哈希值与解密得到的第二个数据分段对应的校验值，若二者相同，完整性校验通过，则将解密得到的第二个数据分段存储到第二车载设备的flash对应的地址单元中；若二者不同，完整性校验不通过，则停止刷写该升级文件并向车辆中用于实现整车系统故障诊断保护的车载设备，如VCU，上报第二个数据分段异常的告警。
接下来继续将升级文件中除首个数据分段和第二个数据分段外的其他n-2个数据分段按照上述步骤S309-S314的方式刷写到第二车载设备中，在n个数据分段全部刷写到第二 车载设备中之后，第二车载设备可以组装n个数据分段以此得到升级文件，并基于该升级文件升级系统。
例如，若n为3，即升级文件File包括3个数据分段，按照顺序依次为data1，data2和data3，第一算法是MD5算法，首个数据分段为data1，第二个数据分段为data2，首个数据分段对应的校验值为check1，第二个数据分段对应的校验值为check2，data1和data2的传输过程在上述图3已经示例，此处不予赘述。第三个数据分段为data3，第一车载设备将第二个数据分段对应的校验值和第三个数据分段作为第一算法的输入得到输出的第三个数据分段对应的校验值为check3＝MD5(data3，check2)，然后通过第一密钥加密data3和check3得到第三加密分段，并将第三加密分段发送给第二车载设备。相应地，第二车载设备接收并通过第一密钥解密接收的第三加密分段以得到解密得到第三个数据分段data33和第三个数据分段对应的校验值check33，然后通过第一算法计算解密得到的第三个数据分段对应的哈希值为hash3＝MD5(data33，check2)，比较hash3和check33，若二者相同则完整性校验通过，若二者不同则完整性校验不通过。当3个数据分段均刷写到第二车载设备中，第二车载设备可以按照接收的顺序将data1、data2和data3组装得到升级文件File，并基于该升级文件File升级系统。
在上述方法中，升级文件的多个数据分段中除首个数据分段外的其他数据分段对应的校验值均与前一个数据分段对应的校验值相关，通过哈希链实现了数据分段的顺序检测机制，避免乱序分段刷写成功导致升级文件组装出错的情况，校验值通过哈希链的方式来实现也增加了被恶意破解的难度。并且，通过预先配置的预共享密钥，而非通过安全协议或安全算法协商得到的密钥来保障每个数据分段的机密性，能够有效减少第一车载设备和第二车载设备的资源消耗。
请参见图4，图4是本申请实施例提供的又一种车载设备升级方法的流程示意图，该方法可以基于图1所示的车载设备升级系统实现，该方法包括但不限于如下步骤：
步骤S401：第一车载设备和第二车载设备进行TLS协议的双向认证以协商得到第一密钥。
具体地，第一密钥是第一车载设备和第二车载设备通过TLS协议协商得到的密钥。TLS协议的双向认证和图2所述的HTTPS的双向认证原理相同，第一车载设备和第二车载设备可以通过各自的设备证书或预置的密钥实现双向的身份认证，避免攻击者仿冒第一车载设备下发恶意升级文件、仿冒第二车载设备窃取升级文件包含的重要信息的情况，并且第一车载设备和第二车载设备可以在TLS协议的双向认证协商传输所用的参数，如第一算法的种类，加解密所用的第一密钥等。
步骤S402：第一车载设备将首个数据分段作为第一算法的输入得到输出的首个数据分段对应的校验值。
步骤S403：第一车载设备通过第一密钥加密首个数据分段和首个数据分段对应的校验值以得到首个数据分段对应的加密分段。
步骤S404：第一车载设备向第二车载设备发送首个数据分段对应的加密分段。
步骤S405：第二车载设备接收首个数据分段对应的加密分段。
步骤S406：第二车载设备通过第一密钥解密首个数据分段对应的加密分段以得到首个数据分段和首个数据分段对应的校验值。
步骤S407：第二车载设备在通过第一算法验证首个数据分段对应的校验值通过的情况下，将首个数据分段存储到第二车载设备中。
步骤S408：第一车载设备将首个数据分段对应的校验值和第二个数据分段作为第一算法的输入得到输出的第二个数据分段对应的校验值。
步骤S409：第一车载设备通过第一密钥加密第二个数据分段和第二个数据分段对应的校验值以得到第二加密分段。
步骤S410：第一车载设备向第二车载设备发送第二加密分段。
步骤S411：第二车载设备接收第二加密分段。
步骤S412：第二车载设备通过第一密钥解密第二加密分段以得到第二个数据分段和第二个数据分段对应的校验值。
步骤S413：第二车载设备在通过第一算法验证第二个数据分段对应的校验值通过的情况下，将第二个数据分段存储到第二车载设备中。
具体地，步骤S402-S413所述的分段刷写升级文件的过程和上述图3中步骤S303-S314所述的分段刷写升级文件的过程一致，此处不再赘述。
在上述方法中，通过TLS协议协商得到的密钥对每个数据分段加密能够保障每个数据分段的机密性，并且对于不同的第二车载设备，第一车载设备和第二车载设备进行的双向认证过程不同，协商得到的第一密钥也可以不同，即不同的升级文件对应的加解密密钥可以不同，从而大大提高升级文件传输过程的安全性。
请参见图5，图5是本申请实施例中提供的又一种车载设备升级方法的流程示意图，该方法可以基于图1所示的车载设备升级系统实现，该方法可以将RFC5246标准的TLS协议应用于分段刷写升级文件的过程中，该方法包括但不限于如下步骤：
步骤S501：第一车载设备和第二车载设备进行TLS协议的双向认证。
具体地，RFC5246标准的TLS协议包括握手阶段和传输阶段，在握手阶段(即TLS协议的双向认证)，第一车载设备和第二车载设备通过TLS协议的双向认证实现身份认证，并协商后续传输阶段中所使用的完整性保护算法(即第一算法)和用于保障升级文件的机密性的第一密钥；在传输阶段，第一车载设备和第二车载设备基于TLS协议对每个数据分段的传输过程进行机密性和完整性的保护，有利于保障车载设备升级过程的安全性。
步骤S502：第一车载设备和第二车载设备基于TLS协议对首个数据分段的传输过程进行加密和完整性保护。
具体地，用于升级第二车载设备的升级文件包括的多个数据分段。第一车载设备和第二车载设备可以基于RFC5246标准的TLS协议对用于升级第二车载设备的升级文件包括的多个数据分段(如n个数据分段)中的首个数据分段进行机密性保护和完整性保护。
具体地，第一车载设备通过协商的第一密钥对首个数据分段进行加密以得到首个数据分段对应的加密分段，通过协商的第一算法计算首个数据分段对应的MAC，即首个数据分段对应的校验值，并将首个数据分段对应的加密分段和首个数据分段对应的MAC发送给 第二车载设备。
相应地，第二车载设备接收首个数据分段对应的加密分段和首个数据分段对应的MAC，通过协商的第一密钥对首个数据分段对应的加密分段进行解密以得到首个数据分段，通过协商的第一算法计算解密得到的首个数据分段对应的MAC，然后比较第二车载设备计算得到的MAC和接收的首个数据分段对应的MAC，若二者相同，认为首个数据分段没有被篡改(即完整性校验通过)，则将解密得到的首个数据分段存储到第二车载设备的flash对应的地址单元中；若二者不同，认为首个数据分段被篡改(即完整性校验不通过)，则停止刷写该升级文件并向车辆中用于实现整车系统故障诊断保护的车载设备，如VCU，上报首个数据分段异常的告警。
例如，若首个数据分段为data1，第一算法是HMAC算法，则第一车载设备通过第一算法计算得到首个数据分段data1对应的MAC值为check1＝HMAC(data1)，相应地，第二车载设备通过第一算法计算解密得到的首个数据分段data11对应的MAC值为mac1＝HMAC(data11)，然后比较check1和mac1，若二者相同，则完整性校验通过；若二者不同，则完整性校验不通过。
步骤S503：第一车载设备和第二车载设备基于TLS协议对第二个数据分段的传输过程进行加密和完整性保护。
具体地，继续基于TLS协议对升级文件的n个数据分段中除首个数据分段外的每个数据分段的传输过程进行加密和完整性保护，即将升级文件的n个数据分段中除首个数据分段外的每个数据分段均按照步骤S502的方式刷写到第二车载设备中，在n个数据分段全部刷写到第二车载设备中之后，第二车载设备可以组装n个数据分段以此得到升级文件，并基于该升级文件升级系统。
在上述方法中，基于RFC5246标准的TLS协议对每个数据分段进行机密性保护和完整性保护，有利于保障升级文件传输过程的安全性。
在本申请实施例中，用于升级第二车载设备的升级文件的多个数据分段中的每个数据分段均单独进行加密和传输，确保了车内传输过程的机密性；第一车载设备和第二车载设备通过哈希链或TLS协议常用的完整性保护算法实现每个数据分段的完整性保护，能够及时发现异常数据分段，并在发现异常数据分段之后及时触发停止新的数据分段的传输，避免异常数据分段刷写到第二车载设备中造成第二车载设备工作异常或资源浪费的情况。
除此以外，为车辆提供升级文件的下载服务器是与第一车载设备进行HTTPS协议的双向认证的服务器，从而确保了升级包来源的合法性；下载服务器和第一车载设备传输的是经过加密的升级文件，确保了车外传输过程的机密性；第一车载设备存储的是经过加密的升级文件，确保了升级文件存储期间的机密性。
上述详细阐述了本申请实施例的方法，下面提供了本申请实施例的装置。
请参见图6，图6是本申请实施例提供的一种第一车载设备的结构示意图，第一车载设备600可以包括处理单元601、加密单元602和通信单元603，其中，各个单元的详细描述如下：
处理单元601，用于通过第一算法处理第一数据分段以得到第一校验值；所述第一数 据分段是用于升级第二车载设备的升级文件所包含的多个数据分段中的任意一个数据分段，所述第一校验值用于发送给所述第二车载设备；
加密单元602，用于通过第一密钥加密所述第一数据分段以得到第一加密分段；
通信单元603，用于向所述第二车载设备发送所述第一加密分段，以用于所述第二车载设备在通过所述第一算法验证所述第一校验值通过的情况下，将通过所述第一密钥解密所述第一加密分段所得到的所述第一数据分段存储到所述第二车载设备中；所述第一数据分段用于供所述第二车载设备组成所述升级文件进行升级。
可以看出，用于升级第二车载设备的升级文件的多个数据分段中的每个数据分段均单独进行加密和传输，有效降低车内传输过程中每个数据分段被窃取的风险，保障每个数据分段在车内传输过程的机密性。并且在接收端(即第二车载设备)均需验证每个数据分段对应的校验值，而不是仅在最后一个数据分段传输完成后才进行整个升级文件的校验，能够及时发现被篡改的异常数据分段，并在发现异常数据分段之后及时触发停止新的数据分段的传输，避免异常数据分段刷写到第二车载设备中造成第二车载设备工作异常或资源浪费的情况，保障了每个数据分段的完整性，从而有效提高升级文件传输过程的安全性。
在一种可选的方案中，第一车载设备600还包括协商单元和解密单元，其中：
协商单元，用于在处理单元601通过第一算法处理第一数据分段以得到第一校验值之前，与下载服务器进行HTTPS协议的双向认证；所述下载服务器用于为所述第二车载设备提供所述升级文件；
通信单元603，还用于接收所述下载服务器发送的加密文件，所述加密文件为对所述升级文件进行加密获得；
解密单元，用于当满足预设的升级条件时解密所述加密文件以得到所述升级文件。
可以看出，提供升级文件的下载服务器为与第一车载设备进行HTTPS协议的双向认证的服务器，确保了升级文件来源的合法性，避免了非授权平台向第一车载设备下发恶意升级文件的情况，以及避免了攻击者仿冒第一车载设备窃取下载服务器发布的包含重要信息的升级文件的情况。并且，下载服务器和第一车载设备之间传输的是经过加密的升级文件，以及第一车载设备存储的是经过加密的升级文件，能够有效降低升级文件被窃取的风险，保障升级文件在车外传输过程和存储期间的机密性，从而有效提高升级文件传输过程的安全性。
在又一种可选的方案中，若所述第一数据分段为所述升级文件的多个数据分段中的首个数据分段，则所述第一校验值是将所述第一数据分段作为所述第一算法的输入得到的输出数据；
若所述第一数据分段为所述升级文件的多个数据分段中除首个数据分段以外的一个数据分段，则所述第一校验值是将所述第一数据分段和第二校验值作为所述第一算法的输入得到的输出数据；所述第二校验值是通过所述第一算法处理所述第一数据分段的前一个数据分段得到的。
可以看出，升级文件的多个数据分段中除首个数据分段外的其他数据分段对应的校验值均与前一个数据分段对应的校验值相关，通过哈希链实现了数据分段的顺序检测机制，避免乱序分段刷写成功导致升级文件组装出错的情况，校验值通过哈希链的方式来实现也 增加了被恶意破解的难度。
在又一种可选的方案中，所述第一加密分段是通过所述第一密钥加密所述第一数据分段和所述第一校验值得到的。
可以看出，在对第一数据分段加密的基础上，还可以对第一校验值加密，从而进一步提高升级文件传输过程的安全性。
在又一种可选的方案中，所述第一密钥为预先为所述第一车载设备和所述第二车载设备配置的预共享密钥。
可以看出，通过预先配置的预共享密钥，而非通过安全协议或安全算法协商得到的密钥来保障每个数据分段的机密性，能够有效减少第一车载设备和第二车载设备的资源消耗。
在又一种可选的方案中，所述第一密钥为所述第一车载设备和所述第二车载设备进行TLS协议的双向认证协商得到的密钥。
可以看出，通过TLS协议协商得到的密钥对每个数据分段加密能够保障每个数据分段的机密性，并且对于不同的第二车载设备，第一车载设备和第二车载设备进行的双向认证过程不同，协商得到的第一密钥也可以不同，即不同的升级文件对应的加解密密钥可以不同，从而大大提高升级文件传输过程的安全性。
在又一种可选的方案中，所述第一密钥为所述第一车载设备和所述第二车载设备进行TLS协议的双向认证协商得到的密钥；
所述第一校验值是基于TLS协议通过所述第一算法处理所述第一数据分段得到的所述第一数据分段的消息认证码。
可以看出，基于TLS协议对每个数据分段进行机密性保护和完整性保护，有利于保障升级文件传输过程的安全性。
需要说明的是，各个操作的实现还可以对应参照图2、图3、图4和图5所示的方法实施例的相应描述。该第一车载设备600为图2、图3、图4和图5所示方法实施例中的第一车载设备。
请参见图7，图7是本申请实施例提供的一种第二车载设备的结构示意图，第二车载设备700可以包括通信单元701、解密单元702和验证单元703，其中，各个单元的详细描述如下：
通信单元701，用于接收第一车载设备发送的第一加密分段；所述第一加密分段是通过第一密钥对第一数据分段加密得到的，所述第一数据分段是用于升级所述第二车载设备的升级文件所包含的多个数据分段中的任意一个数据分段；
解密单元702，用于通过所述第一密钥解密所述第一加密分段以得到所述第一数据分段；
验证单元703，用于在通过所述第一算法验证第一校验值通过的情况下，将所述第一数据分段存储到所述第二车载设备中；所述第一校验值是所述第一车载设备通过第一算法处理所述第一数据分段得到的，所述第一校验值为所述第二车载设备从所述第一车载设备处接收；
升级单元704，用于基于所述第一数据分段组成所述升级文件进行升级。
在一种可选的方案中，若所述第一数据分段为所述升级文件的多个数据分段中的首个数据分段，则所述第一校验值是将所述第一数据分段作为所述第一算法的输入得到的输出数据；
若所述第一数据分段为所述升级文件的多个数据分段中除首个数据分段以外的一个数据分段，则所述第一校验值是将所述第一数据分段和第二校验值作为所述第一算法的输入得到的输出数据；所述第二校验值是通过所述第一算法处理所述第一数据分段的前一个数据分段得到的。
在又一种可选的方案中，所述第一加密分段是通过所述第一密钥加密所述第一数据分段和所述第一校验值得到的。
在又一种可选的方案中，所述第一密钥为预先为所述第一车载设备和所述第二车载设备配置的预共享密钥。
在又一种可选的方案中，所述第一密钥为所述第一车载设备和所述第二车载设备进行TLS协议的双向认证协商得到的密钥。
在又一种可选的方案中，所述第一密钥为所述第一车载设备和所述第二车载设备进行TLS协议的双向认证协商得到的密钥；
所述第一校验值是基于TLS协议通过所述第一算法处理所述第一数据分段得到的所述第一数据分段的消息认证码。
需要说明的是，各个操作的实现还可以对应参照图2、图3、图4和图5所示的方法实施例的相应描述。该第二车载设备700为图2、图3、图4和图5所示方法实施例中的第二车载设备。
请参见图8，图8是本申请实施例提供的又一种第一车载设备的结构示意图，第一车载设备800可以包括处理器801、存储器802和收发器803，处理器801、存储器802和收发器803通过总线相互连接。
存储器802包括但不限于是随机存储记忆体(random access memory，RAM)、只读存储器(read-only memory，ROM)、可擦除可编程只读存储器(erasable programmable read only memory，EPROM)、或便携式只读存储器(compact disc read-only memory，CD-ROM)。该存储器802用于存储相关计算机程序及数据。收发器803用于接收和发送数据。
处理器801可以是一个或多个中央处理器(central processing unit，CPU)。在处理器801是一个CPU的情况下，该CPU可以是单核CPU，也可以是多核CPU。
第一车载设备800中的处理器801可以用于读取存储器802中存储的计算机程序代码，执行以下操作：
通过第一算法处理第一数据分段以得到第一校验值；所述第一数据分段是用于升级第二车载设备的升级文件所包含的多个数据分段中的任意一个数据分段，所述第一校验值用于发送给所述第二车载设备；
通过第一密钥加密所述第一数据分段以得到第一加密分段；
控制收发器803向所述第二车载设备发送所述第一加密分段，以用于所述第二车载设备在通过所述第一算法验证所述第一校验值通过的情况下，将通过所述第一密钥解密所述 第一加密分段所得到的所述第一数据分段存储到所述第二车载设备中；所述第一数据分段用于供所述第二车载设备组成所述升级文件进行升级。
在一种可选的方案中，在通过第一算法处理第一数据分段以得到第一校验值之前，处理器801还用于：
与下载服务器进行HTTPS协议的双向认证；所述下载服务器用于为所述第二车载设备提供所述升级文件；
控制收发器803接收所述下载服务器发送的加密文件，所述加密文件为对所述升级文件进行加密获得；
当满足预设的升级条件时解密所述加密文件以得到所述升级文件。
在又一种可选的方案中，若所述第一数据分段为所述升级文件的多个数据分段中的首个数据分段，则所述第一校验值是将所述第一数据分段作为所述第一算法的输入得到的输出数据；
若所述第一数据分段为所述升级文件的多个数据分段中除首个数据分段以外的一个数据分段，则所述第一校验值是将所述第一数据分段和第二校验值作为所述第一算法的输入得到的输出数据；所述第二校验值是通过所述第一算法处理所述第一数据分段的前一个数据分段得到的。
在又一种可选的方案中，所述第一加密分段是通过所述第一密钥加密所述第一数据分段和所述第一校验值得到的。
在又一种可选的方案中，所述第一密钥为预先为所述第一车载设备和所述第二车载设备配置的预共享密钥。
在又一种可选的方案中，所述第一密钥为所述第一车载设备和所述第二车载设备进行TLS协议的双向认证协商得到的密钥。
在又一种可选的方案中，所述第一密钥为所述第一车载设备和所述第二车载设备进行TLS协议的双向认证协商得到的密钥；
所述第一校验值是基于TLS协议通过所述第一算法处理所述第一数据分段得到的所述第一数据分段的消息认证码。
需要说明的是，各个操作的实现还可以对应参照图2、图3、图4和图5所示的方法实施例的相应描述。该第一车载设备800为图2、图3、图4和图5所示方法实施例中的第一车载设备。
请参见图9，图9是本申请实施例提供的又一种第二车载设备的结构示意图，第二车载设备900可以包括处理器901、存储器902和收发器903，处理器901、存储器902和收发器903通过总线相互连接。
存储器902包括但不限于是随机存储记忆体(random access memory，RAM)、只读存储器(read-only memory，ROM)、可擦除可编程只读存储器(erasable programmable read only memory，EPROM)、或便携式只读存储器(compact disc read-only memory，CD-ROM)。该存储器902用于存储相关计算机程序及数据。收发器903用于接收和发送数据。
处理器901可以是一个或多个中央处理器(central processing unit，CPU)。在处理器 901是一个CPU的情况下，该CPU可以是单核CPU，也可以是多核CPU。
第二车载设备900中的处理器901可以用于读取存储器902中存储的计算机程序代码，执行以下操作：
控制收发器903接收第一车载设备发送的第一加密分段；所述第一加密分段是通过第一密钥对第一数据分段加密得到的，所述第一数据分段是用于升级所述第二车载设备的升级文件所包含的多个数据分段中的任意一个数据分段；
通过所述第一密钥解密所述第一加密分段以得到所述第一数据分段；
在通过所述第一算法验证第一校验值通过的情况下，将所述第一数据分段存储到所述第二车载设备中；所述第一校验值是所述第一车载设备通过第一算法处理所述第一数据分段得到的，所述第一校验值为所述第二车载设备从所述第一车载设备处接收；
基于所述第一数据分段组成所述升级文件进行升级。
在一种可选的方案中，若所述第一数据分段为所述升级文件的多个数据分段中的首个数据分段，则所述第一校验值是将所述第一数据分段作为所述第一算法的输入得到的输出数据；
若所述第一数据分段为所述升级文件的多个数据分段中除首个数据分段以外的一个数据分段，则所述第一校验值是将所述第一数据分段和第二校验值作为所述第一算法的输入得到的输出数据；所述第二校验值是通过所述第一算法处理所述第一数据分段的前一个数据分段得到的。
在又一种可选的方案中，所述第一加密分段是通过所述第一密钥加密所述第一数据分段和所述第一校验值得到的。
在又一种可选的方案中，所述第一密钥为预先为所述第一车载设备和所述第二车载设备配置的预共享密钥。
在又一种可选的方案中，所述第一密钥为所述第一车载设备和所述第二车载设备进行TLS协议的双向认证协商得到的密钥。
在又一种可选的方案中，所述第一密钥为所述第一车载设备和所述第二车载设备进行TLS协议的双向认证协商得到的密钥；
所述第一校验值是基于TLS协议通过所述第一算法处理所述第一数据分段得到的所述第一数据分段的消息认证码。
需要说明的是，各个操作的实现还可以对应参照图2、图3、图4和图5所示的方法实施例的相应描述。该第二车载设备900为图2、图3、图4和图5所示方法实施例中的第二车载设备。
本申请实施例还提供一种芯片系统，芯片系统包括至少一个处理器，存储器和接口电路，存储器、收发器和至少一个处理器通过线路互联，至少一个存储器中存储有计算机程序。计算机程序被处理器执行时，实现图2、图3、图4或图5所示实施例中第一车载设备所执行的操作，或者实现图2、图3、图4或图5所示实施例中第二车载设备所执行的操作。
本申请实施例还提供一种计算机可读存储介质，计算机可读存储介质中存储有计算机程序，当其在处理器上运行时，实现图2、图3、图4或图5所示实施例中第一车载设备所 执行的操作，或者实现图2、图3、图4或图5所示实施例中第二车载设备所执行的操作。
本申请实施例还提供一种计算机程序产品，当计算机程序产品在处理器上运行时，实现图2、图3、图4或图5所示实施例中第一车载设备所执行的操作，或者实现图2、图3、图4或图5所示实施例中第二车载设备所执行的操作。
本领域普通技术人员可以理解实现上述实施例方法中的全部或部分流程，该流程可以由计算机程序来计算机程序相关的硬件完成，该计算机程序可存储于计算机可读取存储介质中，该计算机程序在执行时，可包括如上述各方法实施例的流程。而前述的存储介质包括：ROM或随机存储记忆体RAM、磁碟或者光盘等各种可存储计算机程序代码的介质。

Claims (23)

  1. 一种车载设备升级方法，其特征在于，包括：
    第一车载设备通过第一算法处理第一数据分段以得到第一校验值；所述第一数据分段是用于升级第二车载设备的升级文件所包含的多个数据分段中的任意一个数据分段，所述第一校验值用于发送给所述第二车载设备；
    通过第一密钥加密所述第一数据分段以得到第一加密分段；
    向所述第二车载设备发送所述第一加密分段，以用于所述第二车载设备在通过所述第一算法验证所述第一校验值通过的情况下，将通过所述第一密钥解密所述第一加密分段所得到的所述第一数据分段存储到所述第二车载设备中；所述第一数据分段用于供所述第二车载设备组成所述升级文件进行升级。
  2. 如权利要求1所述的方法，其特征在于，所述第一车载设备通过第一算法处理第一数据分段以得到第一校验值之前，还包括：
    所述第一车载设备与下载服务器进行超文本传输安全协议HTTPS的双向认证；所述下载服务器用于为所述第二车载设备提供所述升级文件；
    接收所述下载服务器发送的加密文件，所述加密文件为对所述升级文件进行加密获得；
    当满足预设的升级条件时解密所述加密文件以得到所述升级文件。
  3. 如权利要求1或2所述的方法，其特征在于，
    若所述第一数据分段为所述升级文件的多个数据分段中的首个数据分段，则所述第一校验值是将所述第一数据分段作为所述第一算法的输入得到的输出数据；
    若所述第一数据分段为所述升级文件的多个数据分段中除首个数据分段以外的一个数据分段，则所述第一校验值是将所述第一数据分段和第二校验值作为所述第一算法的输入得到的输出数据；所述第二校验值是通过所述第一算法处理所述第一数据分段的前一个数据分段得到的。
  4. 如权利要求1-3任一项所述的方法，其特征在于，所述第一加密分段是通过所述第一密钥加密所述第一数据分段和所述第一校验值得到的。
  5. 如权利要求1或2所述的方法，其特征在于，
    所述第一密钥为所述第一车载设备和所述第二车载设备进行传输层安全协议TLS的双向认证协商得到的密钥；
    所述第一校验值是基于TLS协议通过所述第一算法处理所述第一数据分段得到的所述第一数据分段的消息认证码。
  6. 一种车载设备升级方法，其特征在于，包括：
    第二车载设备接收第一车载设备发送的第一加密分段；所述第一加密分段是通过第一 密钥对第一数据分段加密得到的，所述第一数据分段是用于升级所述第二车载设备的升级文件所包含的多个数据分段中的任意一个数据分段；
    通过所述第一密钥解密所述第一加密分段以得到所述第一数据分段；
    在通过所述第一算法验证第一校验值通过的情况下，将所述第一数据分段存储到所述第二车载设备中；所述第一校验值是所述第一车载设备通过第一算法处理所述第一数据分段得到的，所述第一校验值为所述第二车载设备从所述第一车载设备处接收；
    基于所述第一数据分段组成所述升级文件进行升级。
  7. 如权利要求6所述的方法，其特征在于，
    若所述第一数据分段为所述升级文件的多个数据分段中的首个数据分段，则所述第一校验值是将所述第一数据分段作为所述第一算法的输入得到的输出数据；
    若所述第一数据分段为所述升级文件的多个数据分段中除首个数据分段以外的一个数据分段，则所述第一校验值是将所述第一数据分段和第二校验值作为所述第一算法的输入得到的输出数据；所述第二校验值是通过所述第一算法处理所述第一数据分段的前一个数据分段得到的。
  8. 如权利要求6或7所述的方法，其特征在于，所述第一加密分段是通过所述第一密钥加密所述第一数据分段和所述第一校验值得到的。
  9. 如权利要求6所述的方法，其特征在于，
    所述第一密钥为所述第一车载设备和所述第二车载设备进行TLS协议的双向认证协商得到的密钥；
    所述第一校验值是基于TLS协议通过所述第一算法处理所述第一数据分段得到的所述第一数据分段的消息认证码。
  10. 一种车载设备升级方法，其特征在于，应用于车辆，所述车辆包括第一车载设备和第二车载设备，所述方法包括：
    所述第一车载设备通过第一算法处理第一数据分段以得到第一校验值；所述第一数据分段是用于升级所述第二车载设备的升级文件所包含的多个数据分段中的任意一个数据分段，所述第一校验值用于发送给所述第二车载设备；
    所述第一车载设备通过第一密钥加密所述第一数据分段以得到第一加密分段；
    所述第一车载设备向所述第二车载设备发送所述第一加密分段；
    所述第二车载设备接收所述第一车载设备发送的所述第一加密分段；
    所述第二车载设备通过所述第一密钥解密所述第一加密分段以得到所述第一数据分段；
    所述第二车载设备在通过所述第一算法验证所述第一校验值通过的情况下，将所述第一数据分段存储到所述第二车载设备中；
    所述第二车载设备基于所述第一数据分段组成所述升级文件进行升级。
  11. 如权利要求10所述的方法，其特征在于，
    若所述第一数据分段为所述升级文件的多个数据分段中的首个数据分段，则所述第一校验值是将所述第一数据分段作为所述第一算法的输入得到的输出数据；
    若所述第一数据分段为所述升级文件的多个数据分段中除首个数据分段以外的一个数据分段，则所述第一校验值是将所述第一数据分段和第二校验值作为所述第一算法的输入得到的输出数据；所述第二校验值是通过所述第一算法处理所述第一数据分段的前一个数据分段得到的。
  12. 如权利要10所述的方法，其特征在于，
    所述第一密钥为所述第一车载设备和所述第二车载设备进行传输层安全协议TLS协议的双向认证协商得到的密钥；
    所述第一校验值是基于TLS协议通过所述第一算法处理所述第一数据分段得到的所述第一数据分段的消息认证码。
  13. 一种第一车载设备，其特征在于，所述第一车载设备包括收发器、处理器和存储器，所述存储器用于存储计算机程序，所述处理器调用所述计算机程序，用于执行如下操作：
    通过第一算法处理第一数据分段以得到第一校验值；所述第一数据分段是用于升级第二车载设备的升级文件所包含的多个数据分段中的任意一个数据分段，所述第一校验值用于发送给所述第二车载设备；
    通过第一密钥加密所述第一数据分段以得到第一加密分段；
    控制所述收发器向所述第二车载设备发送所述第一加密分段，以用于所述第二车载设备在通过所述第一算法验证所述第一校验值通过的情况下，将通过所述第一密钥解密所述第一加密分段所得到的所述第一数据分段存储到所述第二车载设备中；所述第一数据分段用于供所述第二车载设备组成所述升级文件进行升级。
  14. 如权利要求13所述的第一车载设备，其特征在于，所述通过第一算法处理第一数据分段以得到第一校验值之前，所述处理器还用于：
    与下载服务器进行HTTPS协议的双向认证；所述下载服务器用于为所述第二车载设备提供所述升级文件；
    控制所述收发器接收所述下载服务器发送的加密文件，所述加密文件为对所述升级文件进行加密获得；
    当满足预设的升级条件时解密所述加密文件以得到所述升级文件。
  15. 如权利要求13或14所述的第一车载设备，其特征在于，
    若所述第一数据分段为所述升级文件的多个数据分段中的首个数据分段，则所述第一校验值是将所述第一数据分段作为所述第一算法的输入得到的输出数据；
    若所述第一数据分段为所述升级文件的多个数据分段中除首个数据分段以外的一个数 据分段，则所述第一校验值是将所述第一数据分段和第二校验值作为所述第一算法的输入得到的输出数据；所述第二校验值是通过所述第一算法处理所述第一数据分段的前一个数据分段得到的。
  16. 如权利要求13-15任一项所述的第一车载设备，其特征在于，所述第一加密分段是通过所述第一密钥加密所述第一数据分段和所述第一校验值得到的。
  17. 如权利要求13或14所述的第一车载设备，其特征在于，
    所述第一密钥为所述第一车载设备和所述第二车载设备进行TLS协议的双向认证协商得到的密钥；
    所述第一校验值是基于TLS协议通过所述第一算法处理所述第一数据分段得到的所述第一数据分段的消息认证码。
  18. 一种第二车载设备，其特征在于，所述第二车载设备包括收发器、处理器和存储器，所述存储器用于存储计算机程序，所述处理器调用所述计算机程序，用于执行如下操作：
    控制所述收发器接收第一车载设备发送的第一加密分段；所述第一加密分段是通过第一密钥对第一数据分段加密得到的，所述第一数据分段是用于升级所述第二车载设备的升级文件所包含的多个数据分段中的任意一个数据分段；
    通过所述第一密钥解密所述第一加密分段以得到所述第一数据分段；
    在通过所述第一算法验证第一校验值通过的情况下，将所述第一数据分段存储到所述第二车载设备中；所述第一校验值是所述第一车载设备通过第一算法处理所述第一数据分段得到的，所述第一校验值为所述第二车载设备从所述第一车载设备处接收；
    基于所述第一数据分段组成所述升级文件进行升级。
  19. 如权利要求18所述的第二车载设备，其特征在于，
    若所述第一数据分段为所述升级文件的多个数据分段中的首个数据分段，则所述第一校验值是将所述第一数据分段作为所述第一算法的输入得到的输出数据；
    若所述第一数据分段为所述升级文件的多个数据分段中除首个数据分段以外的一个数据分段，则所述第一校验值是将所述第一数据分段和第二校验值作为所述第一算法的输入得到的输出数据；所述第二校验值是通过所述第一算法处理所述第一数据分段的前一个数据分段得到的。
  20. 如权利要求18或19所述的第二车载设备，其特征在于，所述第一加密分段是通过所述第一密钥加密所述第一数据分段和所述第一校验值得到的。
  21. 如权利要求18所述的第二车载设备，其特征在于，
    所述第一密钥为所述第一车载设备和所述第二车载设备进行TLS协议的双向认证协商 得到的密钥；
    所述第一校验值是基于TLS协议通过所述第一算法处理所述第一数据分段得到的所述第一数据分段的消息认证码。
  22. 一种车辆，其特征在于，包括第一车载设备和第二车载设备，其中：
    所述第一车载设备为权利要求13-17任一项所述的第一车载设备；
    所述第二车载设备为权利要求18-21任一项所述的第二车载设备。
  23. 一种计算机存储介质，其特征在于，所述计算机存储介质存储有计算机程序，所述计算机程序被处理器执行时，实现权利要求1-12任一项所述的方法。
PCT/CN2020/075427 2020-02-14 2020-02-14 一种车载设备升级方法及相关装置 WO2021159530A1 (zh)

Priority Applications (6)

Application Number Priority Date Filing Date Title
JP2021540470A JP7371103B2 (ja) 2020-02-14 2020-02-14 車載デバイスアップグレード方法及び関連装置
EP20897624.1A EP3893108B1 (en) 2020-02-14 2020-02-14 Vehicle-mounted device upgrading method, and related apparatus
CN202080004114.7A CN112534793A (zh) 2020-02-14 2020-02-14 一种车载设备升级方法及相关装置
PCT/CN2020/075427 WO2021159530A1 (zh) 2020-02-14 2020-02-14 一种车载设备升级方法及相关装置
MX2021009503A MX2021009503A (es) 2020-02-14 2020-02-14 Metodo de actualizacion de dispositivo montado en vehiculo y aparato relacionado.
US17/345,542 US11321074B2 (en) 2020-02-14 2021-06-11 Vehicle-mounted device upgrade method and related apparatus

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2020/075427 WO2021159530A1 (zh) 2020-02-14 2020-02-14 一种车载设备升级方法及相关装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/345,542 Continuation US11321074B2 (en) 2020-02-14 2021-06-11 Vehicle-mounted device upgrade method and related apparatus

Publications (1)

Publication Number Publication Date
WO2021159530A1 true WO2021159530A1 (zh) 2021-08-19

Family

ID=74977388

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/075427 WO2021159530A1 (zh) 2020-02-14 2020-02-14 一种车载设备升级方法及相关装置

Country Status (6)

Country Link
US (1) US11321074B2 (zh)
EP (1) EP3893108B1 (zh)
JP (1) JP7371103B2 (zh)
CN (1) CN112534793A (zh)
MX (1) MX2021009503A (zh)
WO (1) WO2021159530A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115835161A (zh) * 2022-11-29 2023-03-21 重庆长安汽车股份有限公司 车辆的程序刷写方法、服务器、车辆、系统及存储介质

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11501027B2 (en) * 2021-02-08 2022-11-15 Micron Technology, Inc. Mechanism to support writing files into a file system mounted in a secure memory device
CN113031978A (zh) * 2021-04-14 2021-06-25 宝能(广州)汽车研究院有限公司 车载系统安装包下载方法、电子设备和存储介质
CN114124842B (zh) * 2021-11-10 2023-07-14 北京经纬恒润科技股份有限公司 一种数据传输方法、系统、电子设备及存储介质
CN114374679A (zh) * 2022-01-11 2022-04-19 深圳市赛格车圣科技有限公司 一种tbox利用doip升级车载设备的方法
CN115189925A (zh) * 2022-06-22 2022-10-14 一汽奔腾轿车有限公司 一种基于tls双向认证的ota安全通信方法
CN117940893A (zh) * 2022-06-30 2024-04-26 华为技术有限公司 一种节点升级方法以及装置
CN116827544B (zh) * 2023-08-31 2023-11-07 北京云驰未来科技有限公司 一种用于更换车载obu信任根的方法及系统
CN117093245B (zh) * 2023-10-18 2024-01-16 湖北芯擎科技有限公司 Ota升级包验证方法、装置、设备及可读存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190034197A1 (en) * 2017-07-25 2019-01-31 Toyota Jidosha Kabushiki Kaisha Implementation Decision to Provide ADAS Function Update for a Vehicle
WO2019083440A2 (zh) * 2017-10-24 2019-05-02 华为国际有限公司 一种车载设备升级方法及相关设备
CN110225063A (zh) * 2019-07-02 2019-09-10 广州小鹏汽车科技有限公司 汽车车载系统的升级方法、升级系统、服务器及车载终端
CN110300406A (zh) * 2019-06-26 2019-10-01 上海擎感智能科技有限公司 基于ota的车辆在线升级方法及系统、存储介质及车载终端

Family Cites Families (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101470411B (zh) 2007-12-28 2011-06-01 联合汽车电子有限公司 Ecu数据安全升级的系统及方法
WO2009157048A1 (ja) 2008-06-27 2009-12-30 独立行政法人情報通信研究機構 無線通信認証方法及び無線通信システムと無線センサ
CN102004657B (zh) * 2010-12-15 2016-02-17 北京壹人壹本信息科技有限公司 一种电子设备及其升级方法
JP5950225B2 (ja) * 2012-01-10 2016-07-13 クラリオン株式会社 サーバ装置、車載端末、情報通信方法および情報配信システム
CN103885437A (zh) 2014-03-12 2014-06-25 潍柴动力股份有限公司 一种数据安全保护方法、装置及电子控制单元
CN106843958A (zh) * 2017-01-18 2017-06-13 成都黑盒子电子技术有限公司 一种嵌入式固件升级方法
CN108347331B (zh) * 2017-01-25 2021-08-03 北京百度网讯科技有限公司 车联网系统中T_Box设备与ECU设备进行安全通信的方法与设备
CN108055585B (zh) * 2017-12-19 2020-12-15 北京四达时代软件技术股份有限公司 数据处理方法、机顶盒升级方法、终端和机顶盒
US10834207B2 (en) * 2018-02-27 2020-11-10 Excelfore Corporation System and method for updating software in an electronic device
CN112055952B (zh) * 2018-04-30 2024-05-03 华为国际有限公司 一种车载设备升级方法及相关设备
CA3103468A1 (en) 2018-06-13 2019-12-19 Konstantinos Bakalis Systems and methods for secure access to property or information using blockchain
CN108449735A (zh) * 2018-06-25 2018-08-24 中国联合网络通信集团有限公司 Ota通信的方法、车载终端、设备及计算机可读存储介质
CN110225124B (zh) * 2019-06-13 2023-04-07 广州小鹏汽车科技有限公司 车辆数据共享处理方法、装置、车辆及介质

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190034197A1 (en) * 2017-07-25 2019-01-31 Toyota Jidosha Kabushiki Kaisha Implementation Decision to Provide ADAS Function Update for a Vehicle
WO2019083440A2 (zh) * 2017-10-24 2019-05-02 华为国际有限公司 一种车载设备升级方法及相关设备
CN110300406A (zh) * 2019-06-26 2019-10-01 上海擎感智能科技有限公司 基于ota的车辆在线升级方法及系统、存储介质及车载终端
CN110225063A (zh) * 2019-07-02 2019-09-10 广州小鹏汽车科技有限公司 汽车车载系统的升级方法、升级系统、服务器及车载终端

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115835161A (zh) * 2022-11-29 2023-03-21 重庆长安汽车股份有限公司 车辆的程序刷写方法、服务器、车辆、系统及存储介质

Also Published As

Publication number Publication date
JP2022522607A (ja) 2022-04-20
JP7371103B2 (ja) 2023-10-30
EP3893108B1 (en) 2023-04-05
EP3893108A4 (en) 2022-03-23
CN112534793A (zh) 2021-03-19
MX2021009503A (es) 2021-09-08
EP3893108A1 (en) 2021-10-13
US11321074B2 (en) 2022-05-03
US20210311720A1 (en) 2021-10-07

Similar Documents

Publication Publication Date Title
WO2021159530A1 (zh) 一种车载设备升级方法及相关装置
EP1712992A1 (en) Updating of data instructions
EP2887576B1 (en) Software key updating method and device
KR20200135775A (ko) 차량 내 전자 제어 유닛들 간의 보안 통신
US20220276855A1 (en) Method and apparatus for processing upgrade package of vehicle
CN110708388B (zh) 用于提供安全服务的车身安全锚节点设备、方法以及网络系统
CN110891257B (zh) 一种具有防攻击双向认证的网联车远程升级系统及方法
CN103166759A (zh) 使用诊断链路连接器（dlc）和onstar系统的用于安全固件下载的方法和装置
WO2015042981A1 (zh) 加解密处理方法、装置和设备
TW201735578A (zh) 受控的安全碼認證
CN114637987B (zh) 基于平台验证的安全芯片固件下载方法及系统
WO2022140903A1 (zh) 一种ota升级方法及装置
WO2013185724A2 (zh) 移动终端及其软件升级的方法
CN111510448A (zh) 汽车ota升级中的通讯加密方法、装置及系统
CN110727455A (zh) 软件远程升级方法及相关设备
KR20220042939A (ko) 차량 내 전자식 제어기 보안성 평가 방법 및 그 장치
WO2021084220A1 (en) Iterative key generation for constrained devices
CN114978751B (zh) 业务证书获取方法、装置和电子设备
CN114629724B (zh) 车联网数据传输方法、装置、服务器及存储介质
WO2019069308A1 (en) SYSTEM AND METHOD FOR VALIDATION OF COMMUNICATION AUTHENTICITY IN ONBOARD NETWORKS
KR20100043799A (ko) Ｍｔｍ 기반 모바일 단말기 간의 비밀 데이터 이전 방법
CN114553542A (zh) 一种数据包加密方法、装置及电子设备
CN112929871A (zh) Ota升级包的获取方法、电子设备以及存储介质
CN117041048A (zh) 车辆系统升级方法、ota升级文件云端处理方法及电子设备
CN114879980A (zh) 车载应用安装方法、装置、计算机设备、存储介质

Legal Events

Date Code Title Description
ENP Entry into the national phase

Ref document number: 2020897624

Country of ref document: EP

Effective date: 20210615

ENP Entry into the national phase

Ref document number: 2021540470

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE