WO2023221251A1

WO2023221251A1 - Controller security management method and apparatus, and vehicle and storage medium

Info

Publication number: WO2023221251A1
Application number: PCT/CN2022/102615
Authority: WO
Inventors: 蒋春阳; 万军; 宋卫桥
Original assignee: 惠州市德赛西威汽车电子股份有限公司
Priority date: 2022-05-19
Filing date: 2022-06-30
Publication date: 2023-11-23
Also published as: CN115766014A

Abstract

Disclosed in the present application are a controller security management method and apparatus, and a vehicle and a storage medium. The method is applied to a control system. The control system comprises a controller and a hardware encryption management module, wherein a memory of the controller comprises a first partition and a second partition. The method comprises: when it is detected that a controller is powered on and started for the first time, calling a secure starting function to store a first area check key and a second area check key in a hardware encryption management module; determining a starting function signature according to the secure starting function and the first area check key, and storing same in the hardware encryption management module; and calling an application function according to the secure starting function combined with the second area check key and an application function signature, so as to realize the secure starting of the controller.

Description

A controller security management method, device, vehicle and storage medium

This application claims priority to the Chinese patent application with application number 202210556446.7, which was submitted to the China Patent Office on May 19, 2022. The entire content of this application is incorporated into this application by reference.

Technical field

The present application relates to the field of vehicle management technology, and in particular to a controller safety management method, device, vehicle and storage medium.

Background technique

With the development of technology and living standards, smart devices are increasingly appearing in people's lives, such as vehicles, mobile phones, etc. Equipment work is usually inseparable from the micro control unit MCU. In order to ensure the normal operation of the MCU, the security of the code in the MCU needs to be ensured. With the development of technology, it often happens that device codes are maliciously invaded. After the device code is maliciously invaded, wrong instructions will be executed, affecting the normal operation of the device system and causing great harm.

Contents of the invention

This application provides a controller security management method, device, vehicle and storage medium to achieve security management of the controller.

According to one aspect of the present application, a controller security management method is provided, which is applied to a control system. The control system includes a controller and a hardware encryption management module. The memory of the controller includes a first partition and a second partition. The first partition stores the secure boot function, the first area verification key and the second area verification key. The second partition stores application functions and application function signatures. The first partition is set to be one-time programmable. area, the methods include:

When it is detected that the controller is powered on for the first time, call the secure startup function to store the first area verification key and the second area verification key into the hardware encryption management module;

Determine a startup function signature according to the secure startup function and the first area verification key, and store it in the hardware encryption management module;

Control the startup of the application function according to the secure startup function in combination with the second area verification key and the application function signature to implement secure startup of the controller.

According to another aspect of the present application, a controller security management device is provided, which is applied to a controller. The memory of the controller includes a first partition and a second partition. The first partition stores a secure startup function, a first Area verification key and second area verification key, the second partition stores application functions and application function signatures, and the first partition is set as a one-time programmable area, including:

A key storage module, configured to call the secure startup function to store the first area verification key and the second area verification key to the hardware encryption management module when it is detected that the controller is powered on for the first time. ;

A signature storage module, configured to determine a startup function signature based on the secure startup function and the first area verification key, and store it in the hardware encryption management module;

A startup module, configured to control the startup of the application function according to the secure startup function in combination with the second area verification key and the application function signature to implement secure startup of the controller.

According to another aspect of the present application, a vehicle is provided, the vehicle including: a control system including a controller and a hardware encryption management module;

The memory is used to store one or more programs;

When the one or more programs are executed by the controller, the controller is caused to implement the controller security management method described in any embodiment of this application.

According to another aspect of the present application, a computer-readable storage medium is provided. The computer-readable storage medium stores computer instructions, and the computer instructions are used to implement any of the embodiments of the present application when executed by a processor. Controller security management methods.

The embodiment of the present application provides a controller security management method, which is applied to a control system. The control system includes a controller and a hardware encryption management module. The memory of the controller includes a first partition and a second partition. The first partition stores a secure startup function. , the first area verification key and the second area verification key, the second partition stores the application function and the application function signature, the first partition is set as a one-time programmable area, the method includes: when the controller is detected for the first time When powering on, the secure startup function is called to store the first area verification key and the second area verification key to the hardware encryption management module; the startup function signature is determined based on the secure startup function and the first area verification key, and Store it in the hardware encryption management module; call the application function based on the secure startup function combined with the second area verification key and application function signature control to achieve safe startup of the controller, solving the problem that function security cannot be guaranteed during the startup process of the controller. , set the first partition and the second partition of the memory to store different data, set the first partition as a one-time programmable area to avoid data tampering, store the first area verification key and the second area verification key in Hardware encryption management module to avoid key loss and tampering. The startup function signature is determined through the secure startup function and the first area verification key, and is stored in the hardware encryption management module so that the secure startup function can be safely verified during subsequent startups. The application function is verified through the secure startup function combined with the second area verification key and the application function signature, and the application function is called based on the verification result to achieve a secure startup of the controller and avoid functions being intruded, tampered and illegal by malware. Injection, etc., to ensure the normal operation of the equipment and ensure the safety of the equipment.

Description of the drawings

Figure 1 is a flow chart of a controller security management method provided according to Embodiment 1 of the present application;

Figure 2 is a flow chart of a controller security management method provided according to Embodiment 2 of the present application;

Figure 3 is a schematic structural diagram of a controller security management device provided according to Embodiment 3 of the present application;

Figure 4 is a schematic structural diagram of a vehicle that implements the controller safety management method according to the embodiment of the present application.

Detailed ways

In order to enable those in the technical field to better understand the solutions of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only These are part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without creative efforts should fall within the scope of protection of this application.

It should be noted that the terms "first", "second", etc. in the description and claims of this application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It is to be understood that the data so used are interchangeable under appropriate circumstances so that the embodiments of the application described herein can be practiced in sequences other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, e.g., a process, method, system, product, or apparatus that encompasses a series of steps or units and need not be limited to those explicitly listed. Those steps or elements may instead include other steps or elements not expressly listed or inherent to the process, method, product or apparatus.

Embodiment 1

Figure 1 is a flow chart of a controller security management method provided in Embodiment 1 of the present application. This embodiment can be applied to the situation of security management of the controller. The method can be executed by the controller security management device. The control The controller security management device can be implemented in the form of hardware and/or software, and the controller security management device can be configured in the controller. The method is applied to a control system. The control system includes a controller and a hardware encryption management module. The memory of the controller includes a first partition and a second partition. The first partition stores the secure startup function, the first area verification key and the second area. Verification key, the second partition stores application functions and application function signatures, and the first partition is set as a one-time programmable area.

This application partitions the memory of the controller and divides the memory into a first partition and a second partition to store different types of data respectively. Store the secure boot function, the first area verification key and the second area verification key in the first partition, and set the first partition as a one-time programmable area (that is, OTP area) to avoid data in the first partition. tampered with to further ensure data security.

As shown in Figure 1, the method includes:

S101. When it is detected that the controller is powered on for the first time, call the secure startup function to store the first area verification key and the second area verification key in the hardware encryption management module.

In this embodiment, the secure startup function can be understood as a function that initializes and starts the system. The first area verification key can be specifically understood as a key used to verify the startup function. The second area verification key is also a key used to verify application functions. The hardware encryption management module can specifically be understood as a module that manages keys. The hardware encryption management module in this application is an HSM (Hardware security module) module. The controller in this application may be a micro control unit MCU.

Specifically, it detects whether the controller is powered on and started. When the controller is powered on and started for the first time, the secure startup function is called to obtain the first area verification key and the second area verification key from the first partition, and the The first area verification key and the second area verification key are loaded into the hardware encryption management module and stored.

What needs to be known is that the first power-on startup of this application is the first power-on startup after the first partition and the second partition write data during the MCU development process. At this time, the device used by the controller may not be officially Factory and application. The second partition in this application can also store other types of data.

S102. Determine the startup function signature according to the secure startup function and the first area verification key, and store it in the hardware encryption management module.

In this embodiment, the startup function signature can specifically be understood as signature information used to verify the security and legality of the secure startup function. The first area verification key is used as the key of the algorithm, a startup function signature corresponding to the secure startup function is generated, and the startup function signature is stored in the hardware encryption management module. The startup function signature in this application can use the message authentication code (Cipher Block Chaining-message authentication code, CMAC) based on block encryption.

S103. Call the application function according to the secure startup function combined with the second area verification key and the application function signature to implement secure startup of the controller.

In this embodiment, the application function signature can be specifically understood as signature information used for security verification of the application function; the application function can be specifically understood as a function that executes or realizes a certain function. Generate a signature based on the secure boot function and the second area verification key, verify the generated signature by applying the function signature, and determine the verification result. When the verification is passed, the application function is called normally and the corresponding function is executed to realize the safe startup of the controller.

The embodiment of the present application provides a controller security management method, which is applied to a control system. The control system includes a controller and a hardware encryption management module. The memory of the controller includes a first partition and a second partition. The first partition stores a secure startup function. , the first area verification key and the second area verification key, the second partition stores application functions and application function signatures, and the first partition is set as a one-time programmable area, which solves the problem that function security cannot be guaranteed during the startup process of the controller. To solve the problem, set the first partition and the second partition of the memory to store different data. Set the first partition as a one-time programmable area to avoid data tampering. Set the first area verification key and the second area verification key. Store it in the hardware encryption management module to avoid key loss and tampering. The startup function signature is determined through the secure startup function and the first area verification key, and is stored in the hardware encryption management module so that the secure startup function can be safely verified during subsequent startups. The application function is verified through the secure startup function combined with the second area verification key and the application function signature, and the application function is called based on the verification result to achieve a secure startup of the controller and avoid functions being intruded, tampered and illegal by malware. Injection, etc., to ensure the normal operation of the equipment and ensure the safety of the equipment.

Embodiment 2

Figure 2 is a flow chart of a controller security management method provided in Embodiment 2 of the present application. This embodiment is refined based on the above embodiment. As shown in Figure 2, the method includes:

S201. When it is detected that the controller is powered on for the first time, call the secure startup function to store the first area verification key and the second area verification key in the hardware encryption management module.

S202. Process the secure startup function and the first area verification key according to the predetermined first preset algorithm, determine the startup function signature, and store it in the hardware encryption management module.

In this embodiment, the first preset algorithm can be specifically understood as an encryption algorithm, such as Hash algorithm, AES128 algorithm, AES-192 algorithm, AE-256 algorithm, etc. A first preset algorithm is determined in advance, the secure startup function and the first area verification key are encrypted according to the first preset algorithm, a startup function signature is generated, and stored in the hardware encryption management module. The secure startup function in this application can be implemented through code. Therefore, when generating the startup function signature, the secure startup code corresponding to the secure startup function can be combined with the first area verification key and encrypted through the first preset algorithm to generate Start function signature.

S203. Process the secure startup function and the second area verification key according to the predetermined second preset algorithm to determine the signature of the application function to be verified.

In this embodiment, the second preset algorithm can be specifically understood as an encryption algorithm, and the second preset algorithm and the first preset algorithm may be the same or different. The signature of the application function to be verified can be specifically understood as a signature with verification requirements, which is used to verify the legality of the application function.

Specifically, a second preset algorithm is determined in advance, and the secure startup function and the second area verification key are encrypted using the second preset algorithm to obtain the application function signature to be verified. When determining the signature of the application function to be verified based on the secure startup function, the signature of the application function to be verified can also be generated based on the secure startup code corresponding to the secure startup function.

S204. If the signature of the application function to be verified is consistent with the signature of the application function, call the application function.

Determine whether the application function signature to be verified is consistent with the application function signature stored in the second partition. If they are consistent, it is determined that the application function has passed the verification, and the application function is called to implement the corresponding function.

S205. When it is detected that the controller is not powered on for the first time, determine the startup function signature to be verified based on the secure startup function and the first area verification key, and obtain the startup function signature stored in the hardware encryption management module.

In this embodiment, the signature of the startup function to be verified can be specifically understood as a signature with verification requirements, and is used to determine whether the secure startup function is legal. When it is detected that the controller is not powered on for the first time, the secure startup function and the first area verification key are obtained from the first partition, and the secure startup function and the first area verification key are processed according to the first preset algorithm. Encryption processing, generates a startup function signature to be verified, and obtains the startup function signature stored in the hardware encryption management module.

S206. If the startup function signature to be verified is consistent with the startup function signature, call the application function according to the secure startup function combined with the second area verification key and the application function signature to achieve secure startup of the controller.

Determine whether the signature of the startup function to be verified is consistent with the signature of the startup function. If they are consistent, it is determined that the secure startup function has passed the verification. The application function is verified according to the secure startup function combined with the second area verification key and the application function signature. If the verification passes, the application function is legal at this time, and the application function is called to implement the corresponding function and realize the safe startup of the controller. The method of verifying and calling the application function based on the secure startup function combined with the second area verification key and the application function signature is the same as S203-S204.

In this embodiment of the present application, after the controller has been running for a period of time, the application function will be upgraded due to function updates or other reasons. When applying function upgrade, the controller can be upgraded after the first power-on and before the second power-on; it can also be upgraded after the n-th power-on and start. Therefore, the execution order of S205-S206 and S207-S210 may be upgrade first or upgrade last. Figure 2 takes the upgrade as an example to illustrate the controller security management method.

S207. When an application function upgrade is detected, obtain the application function signature, random number and second area verification key verification data information to be upgraded.

In this embodiment, the signature of the application function to be upgraded can specifically be understood as signature information used for application function upgrade verification. The second area verification key verification data information can specifically be understood as information used for security verification during the upgrade process.

Specifically, when upgrading application functions, you can determine whether the application functions need to be upgraded by receiving upgrade instructions sent by the cloud, the host computer, etc.; or, detect the application functions stored in the cloud, host computer, file management system, etc., and based on the The version or date is used to determine whether the application function needs to be upgraded. When a new version of the application function exists, the application function is determined to be upgraded; or, the user manually upgrades. The user manual upgrade can be when the user discovers a new version of the application function. Click, double-click, slide, etc. to start the upgrade of the application function; or when the user does not know whether there is a new version of the application function, start the upgrade of the application function by clicking, double-click, slide, etc., the controller communicates with the cloud, The host computer and others establish a connection, determine whether there is a new version of the application function, and determine the application function upgrade when a new version exists.

If it is detected that the application function needs to be upgraded, obtain the signature of the application function to be upgraded, the random number and the second area verification key verification data information required for the upgrade. The application function signature, random number and second area verification key verification data information to be upgraded can be stored in the cloud, host computer, etc., and can be stored in the same space as the new application function.

The signature of the application function to be upgraded, the random number and the second area verification key verification data information can also be stored in the second partition after the upgrade of the application function is completed, so that the random number and second area verification key originally stored in the second partition can be stored. Update of key verification data information. When obtaining the application function signature, random number and second area verification key verification data information to be upgraded, the length information of the application function can also be obtained.

S208. Perform key verification based on the random number and the second area verification key verification data information.

Perform key analysis based on the random number required for upgrade and the second area verification key verification data information to determine the analyzed key, and determine whether the analyzed key is legal based on the second area verification key. If it is legal, determine If the key verification result is verification passed, you can continue to upgrade the application function; if it is illegal, determine that the key verification result is verification failure, end the application function upgrade, and the application function upgrade fails.

As an optional embodiment of this embodiment, key verification will be performed based on random numbers and second area verification key verification data information, which is optimized as:

A1. Determine the real key based on the random number and the second area verification key verification data information combined with the predetermined third preset algorithm.

In this embodiment, the third preset algorithm is a decryption algorithm, for example, the AES algorithm and the Hash algorithm. The AES algorithm and the Hash algorithm can perform both encryption operations and decryption. The third preset algorithm in this application may use the same algorithm as the first preset algorithm and the second preset algorithm, or may use different algorithms. When the same algorithm is used, the first preset algorithm and the second preset algorithm perform encryption operations on the data, and the third preset algorithm performs the decryption operation on the data. The real key can specifically be understood as the key corresponding to the second area verification key verification data information obtained by the decryption process. Decrypt the random number and the second area verification key verification data information according to the third preset algorithm to obtain the real key.

A2. Obtain the second area verification key stored in the hardware encryption management module.

Obtain the second area verification key from the corresponding storage space of the hardware encryption management module.

A3. If the real key is consistent with the second area verification key, it is determined that the key verification result is passed.

Determine whether the real key and the second area verification key are consistent. If they are consistent, the key verification result is determined to be verification passed; if they are inconsistent, the key verification result is determined to be verification failed.

S209. If the verification passes, obtain a new application function.

If the verification is passed, a new application function is obtained. The new application function is an upgraded application function. Generally, the functions of the new application function are more comprehensive than those of the original application function and are an extension of the original application function. optimization. New application functions can be stored in the cloud, host computer, etc. When the verification fails, the upgrade of the application function ends and the application function upgrade fails.

S210. Control the upgrade of the application function according to the new application function, the second area verification key and the signature of the application function to be upgraded.

Obtain the second area verification key stored in the hardware encryption management module, encrypt the new application function and the second area verification key to determine the signature, and use this signature to perform security verification on the signature of the application function to be upgraded. After passing, it is determined that the new application function is legal, and the application function is upgraded and updated through the new application function.

As an optional embodiment of this embodiment, this optional embodiment further controls the upgrade of the application function based on the new application function, the second area verification key and the signature of the application function to be upgraded, including:

B1 processes the new application function and the second area verification key according to the predetermined fourth preset algorithm, and determines the signature of the upgrade function to be verified.

In this embodiment, the fourth preset algorithm is a preset algorithm, which may be the same as the first preset algorithm, the second preset algorithm, and the third preset algorithm, or may be different. The signature of the upgrade function to be verified can be specifically understood as a kind of signature information, used to verify the legality of the new application function. A fourth preset algorithm is determined in advance, the new application function and the second area verification key are encrypted using the fourth preset algorithm, and a signature of the upgrade function to be verified is generated. New application functions can also be implemented through code. Therefore, when determining the signature of the upgrade function to be verified, encryption operations can be performed through the code corresponding to the new application function, thereby determining the signature of the upgrade function to be verified.

B2. If the signature of the upgrade function to be verified is consistent with the signature of the application function to be upgraded, replace the application function with a new application function to achieve the upgrade of the application function.

Determine whether the signature of the upgrade function to be verified is consistent with the signature of the application function to be upgraded. If they are consistent, it is determined that the new application function has passed the verification, the new application function is legal, and the application function is updated through the new application function. When the controller starts, the application function is replaced by a new application function and the new application function is executed to implement the corresponding function. The new application function can replace the application function by directly deleting the original application function and overwriting the original application function with the new application function, or by not deleting the original application function, but after the safe startup function is verified when the controller starts, , when calling the application function, directly call the new application function.

In this application, the application function is stored in the second partition. Since the second partition is not set as a one-time programmable area, the data in the second partition can be modified, so the application function can be upgraded. By setting an unmodifiable first partition and a modifiable second partition, safe startup is ensured without affecting device upgrades. And when encountering an upgrade failure, Bootloader or APP operation error, you can switch to the previous version of the application function through the rollback function, thereby solving the problem of the machine being unable to start and improving the stability and reliability of the product. This application sets regional verification keys for the first area and the second area respectively to ensure regional security. Multiple regional verification keys can also be used for encryption and decryption.

The embodiment of the present application provides a controller security management method, which is applied to a control system. The control system includes a controller and a hardware encryption management module. The memory of the controller includes a first partition and a second partition. The first partition is set to be disposable. The programmable area ensures the security of the safe startup function and prevents the safe startup function from being tampered with. Solve the problem that function security cannot be guaranteed during the startup process of the controller. Set the first and second partitions of the memory to store different data, and store the first and second area verification keys in hardware encryption management. module to avoid key loss and tampering. The startup function signature is determined through the secure startup function and the first area verification key, and is stored in the hardware encryption management module so that the secure startup function can be safely verified during subsequent startups. The application function is verified through the secure startup function combined with the second area verification key and the application function signature, and the application function is called based on the verification result to achieve a secure startup of the controller and avoid functions being intruded, tampered and illegal by malware. Injection, etc., to ensure the normal operation of the equipment and ensure the safety of the equipment. The data in the second partition can be modified, ensuring safe startup without affecting device upgrades. The device startup and upgrade processes require multiple verifications to ensure data security.

Embodiment 3

Figure 3 is a schematic structural diagram of a controller security management device provided in Embodiment 3 of the present application. The device is applied to a controller. The memory of the controller includes a first partition and a second partition. The first partition stores the secure startup function and the third partition. The first area verification key and the second area verification key, the second partition stores application functions and application function signatures, and the first partition is set as a one-time programmable area. As shown in Figure 3, the device includes: a key storage module 31, a signature storage module 32 and a startup module 33.

Among them, the key storage module 31 is used to call the secure startup function to store the first area verification key and the second area verification key to the hardware when it is detected that the controller is powered on for the first time. Encryption management module;

Signature storage module 32, configured to determine the startup function signature according to the secure startup function and the first area verification key, and store it in the hardware encryption management module;

The startup module 33 is configured to control the startup of the application function according to the secure startup function in combination with the second area verification key and the application function signature to achieve secure startup of the controller.

The embodiment of the present application provides a controller security management device, which solves the problem that function security cannot be guaranteed during the startup process of the controller. The startup function signature is determined through the secure startup function and the first area verification key, and is stored in hardware encryption Management module to perform security verification on the safe startup function during subsequent startups. The application function is verified through the secure startup function combined with the second area verification key and the application function signature, and the application function is called based on the verification result to achieve a secure startup of the controller and avoid functions being intruded, tampered and illegal by malware. Injection, etc., to ensure the normal operation of the equipment and ensure the safety of the equipment.

Optionally, the signature storage module 32 is specifically configured to process the secure startup function and the first area verification key according to a predetermined first preset algorithm to determine the startup function signature.

Optionally, the device also includes:

A startup signature verification module, used to determine the startup function signature to be verified based on the secure startup function and the first area verification key when it is detected that the controller is not powered on for the first time, and obtain the hardware encryption management module Stored startup function signature;

An application function calling module is configured to call the application function according to the secure startup function in combination with the second area verification key and the application function signature if the startup function signature to be verified is consistent with the startup function signature to achieve control. The server starts safely.

Optionally, calling the application function according to the secure startup function in combination with the second area verification key and the application function signature includes: combining the secure startup function and the application function signature according to a predetermined second preset algorithm. The second area verification key is processed to determine the signature of the application function to be verified; if the signature of the application function to be verified is consistent with the signature of the application function, the application function is called.

Optionally, the device also includes:

An upgrade information acquisition module, configured to obtain the signature of the application function to be upgraded, the random number and the second area verification key verification data information when an upgrade of the application function is detected;

A random number verification module, configured to perform key verification based on the random number and the second area verification key verification data information;

The application function acquisition module is used to obtain the new application function if the verification is passed;

An application function upgrade module is configured to control the upgrade of the application function according to the new application function, the second area verification key and the signature of the application function to be upgraded.

Optional, random number verification module, including:

A real key determination unit, configured to determine the real key based on the random number and the second area verification key verification data information combined with a predetermined third preset algorithm;

A key acquisition unit, used to acquire the second area verification key stored in the hardware encryption management module;

A key verification unit, configured to determine that the key verification result is that the verification is passed if the real key is consistent with the second area verification key.

Optional, application function upgrade modules include:

An upgrade signature determination unit configured to process the new application function and the second area verification key according to a predetermined fourth preset algorithm to determine the upgrade function signature to be verified;

An upgrade verification unit, configured to replace the application function with the new application function if the signature of the upgrade function to be verified is consistent with the signature of the application function to be upgraded, so as to realize the upgrade of the application function.

The controller security management device provided by the embodiments of this application can execute the controller security management method provided by any embodiment of this application, and has the corresponding functional modules and effects of the execution method.

Embodiment 4

Figure 4 shows a schematic structural diagram of a vehicle that can be used to implement embodiments of the present application. The vehicle includes a control system 41 including a controller 411 and a hardware encryption management module 412 . The components shown herein, their connections and relationships, and their functions are examples only and are not intended to limit the implementation of the present application as described and/or claimed herein.

As shown in Figure 4, the vehicle includes at least one controller 411, and a memory communicatively connected to the at least one controller 411, such as a read-only memory (ROM) 42, a random access memory (RAM) 43, etc., wherein the memory stores data that can be A computer program executed by at least one controller. The controller 411 may execute each program according to a computer program stored in the read-only memory (ROM) 42 or loaded from the storage unit 48 into the random access memory (RAM) 43. appropriate actions and handling. In RAM 43, various programs and data required for vehicle operation can also be stored. The controller 411, ROM 42 and RAM 43 are connected to each other through a bus 44. An input/output (I/O) interface 45 is also connected to bus 44 .

Multiple components in the vehicle are connected to the I/O interface 45, including: input unit 46, such as keyboard, mouse, etc.; output unit 47, such as various types of displays, speakers, etc.; storage unit 48, such as magnetic disk, optical disk, etc.; and a communication unit 49, such as a network card, modem, wireless communication transceiver, etc. The communication unit 49 allows the vehicle to exchange information/data with other devices via computer networks such as the Internet and/or various telecommunications networks.

Controller 411 may be a variety of general and/or special purpose processing components having processing and computing capabilities. Some examples of the controller 411 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processing processor (DSP), and any appropriate processor, controller, microcontroller, etc. The controller 411 performs various methods and processes described above, such as the controller security management method.

In some embodiments, the controller security management method may be implemented as a computer program, which is tangibly embodied in a computer-readable storage medium, such as storage unit 48. In some embodiments, part or all of the computer program may be loaded and/or installed on the vehicle via ROM 42 and/or communication unit 49. When the computer program is loaded into RAM 43 and executed by controller 411, one or more steps of the controller security management method described above may be performed. Alternatively, in other embodiments, the controller 411 may be configured to perform the controller security management method in any other suitable manner (eg, via firmware).

Various implementations of the systems and techniques described above may be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on a chip implemented in a system (SOC), complex programmable logic device (CPLD), computer hardware, firmware, software, and/or combinations thereof. These various embodiments may include implementation in one or more computer programs executable and/or interpreted on a programmable system including at least one programmable processor, the programmable processor The processor, which may be a special purpose or general purpose programmable processor, may receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device. An output device.

Computer programs for implementing the methods of the present application may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that the computer program, when executed by the processor, causes the functions/operations specified in the flowcharts and/or block diagrams to be implemented. A computer program may execute entirely on the machine, partly on the machine, as a stand-alone software package, partly on the machine and partly on a remote machine or entirely on the remote machine or server.

In the context of this application, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in connection with an instruction execution system, apparatus, or device. Computer-readable storage media may include, but are not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or devices, or any suitable combination of the foregoing. Alternatively, the computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media would include one or more wire-based electrical connections, laptop disks, hard drives, random access memory (RAM), read only memory (ROM), erasable programmable read only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the above.

To provide interaction with a user, the systems and techniques described herein may be implemented on a vehicle having: a display device (eg, a CRT (Cathode Ray Tube) or LCD (Liquid Crystal Display) monitor) for displaying information to the user ); and a keyboard and pointing device (eg, a mouse or a trackball) through which a user can provide input to the vehicle. Other kinds of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and may be provided in any form, including Acoustic input, voice input or tactile input) to receive input from the user.

The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., A user's computer having a graphical user interface or web browser through which the user can interact with implementations of the systems and technologies described herein), or including such backend components, middleware components, or any combination of front-end components in a computing system. The components of the system may be interconnected by any form or medium of digital data communication (eg, a communications network). Examples of communication networks include: local area network (LAN), wide area network (WAN), blockchain network, and the Internet.

Computing systems may include clients and servers. Clients and servers are generally remote from each other and typically interact over a communications network. The relationship of client and server is created by computer programs running on corresponding computers and having a client-server relationship with each other. The server can be a cloud server, also known as cloud computing server or cloud host. It is a host product in the cloud computing service system to solve the problems of difficult management and weak business scalability in traditional physical hosts and VPS. .

It should be understood that various forms of the process shown above may be used, with steps reordered, added or deleted. For example, each step described in this application can be executed in parallel, sequentially, or in a different order. As long as the desired results of the technical solution of this application can be achieved, there is no limitation here.

Claims

A controller security management method, applied to a control system. The control system includes a controller and a hardware encryption management module. The memory of the controller includes a first partition and a second partition. The first partition stores a secure startup function. , a first area verification key and a second area verification key, the second partition stores application functions and application function signatures, the first partition is set as a one-time programmable area, and the method includes:

When it is detected that the controller is powered on for the first time, call the secure startup function to store the first area verification key and the second area verification key into the hardware encryption management module;

Determine a startup function signature according to the secure startup function and the first area verification key, and store it in the hardware encryption management module;

The application function is called according to the secure startup function in combination with the second area verification key and the application function signature to implement secure startup of the controller.
The method according to claim 1, wherein the determining a startup function signature according to the secure startup function and the first area verification key includes:

The secure startup function and the first area verification key are processed according to a predetermined first preset algorithm to determine a startup function signature.
The method of claim 1, further comprising:

When it is detected that the controller is not powered on for the first time, determine the startup function signature to be verified based on the secure startup function and the first area verification key, and obtain the startup function signature stored in the hardware encryption management module;

If the startup function signature to be verified is consistent with the startup function signature, the application function is called according to the secure startup function in combination with the second area verification key and the application function signature to implement secure startup of the controller.
The method according to any one of claims 1-3, wherein the calling the application function according to the secure startup function in combination with the second area verification key and the application function signature includes:

Process the secure startup function and the second area verification key according to the predetermined second preset algorithm to determine the application function signature to be verified;

If the application function signature to be verified is consistent with the application function signature, the application function is called.
The method of claim 1, further comprising:

When the application function upgrade is detected, obtain the application function signature, random number and second area verification key verification data information to be upgraded;

Perform key verification based on the random number and the second area verification key verification data information;

If the verification passes, obtain the new application function;

The upgrade of the application function is controlled according to the new application function, the second area verification key and the signature of the application function to be upgraded.
The method according to claim 5, wherein the key verification based on the random number and the second area verification key verification data information includes:

Determine the real key based on the random number and the second area verification key verification data information combined with a predetermined third preset algorithm;

Obtain the second area verification key stored by the hardware encryption management module;

If the real key is consistent with the second area verification key, it is determined that the key verification result is that the verification is passed.
The method according to claim 5, wherein controlling the upgrade of the application function according to the new application function, the second area verification key and the signature of the application function to be upgraded includes:

Process the new application function and the second area verification key according to the predetermined fourth preset algorithm to determine the upgrade function signature to be verified;

If the signature of the upgrade function to be verified is consistent with the signature of the application function to be upgraded, the application function is replaced with the new application function to implement the upgrade of the application function.
A controller security management device is applied to a controller. The memory of the controller includes a first partition and a second partition. The first partition stores a secure startup function, a first area verification key and a second area verification key. verification key, the second partition stores application functions and application function signatures, and the first partition is set as a one-time programmable area, including:

A key storage module, configured to call the secure startup function to store the first area verification key and the second area verification key to the hardware encryption management module when it is detected that the controller is powered on for the first time. ;

A signature storage module, configured to determine the startup function signature according to the secure startup function and the first area verification key, and store it in the hardware encryption management module;

A startup module, configured to control the startup of the application function according to the secure startup function in combination with the second area verification key and the application function signature to implement secure startup of the controller.
A vehicle includes: a control system, the control system includes a controller and a hardware encryption management module;

The memory is used to store one or more programs;

When the one or more programs are executed by the controller, the controller is caused to implement the controller security management method as described in any one of claims 1-7.
A computer-readable storage medium stores computer instructions, and the computer instructions are used to implement the controller security management method described in any one of claims 1-7 when executed by a processor.