CN110460573B - ECU security upgrade management system and method applied to automobile - Google Patents

Abstract

The invention provides a security upgrade management system and method applied to an automobile ECU, including a security management module, an intrusion detection module, a central gateway, a protection ECU, a vulnerability ECU, and the intrusion detection module monitors the in-vehicle network in real time. When the upgrade is attacked, the attack information can be fed back to the security management module in time. The security management module will issue control commands to the protection ECU, and the protection ECU will send the resistance strategy to the ECU that may be attacked or has been attacked to resist the attack and upgrade the upgrade. The upgrade file in the process introduces a smaller make-up package. By introducing the make-up package to replace the patch package of different historical versions, the size of the data package required for the upgrade can be greatly reduced, and the transmission time of the ECU upgrade patch package can also be saved.

Description

A system and method for safety upgrade management of automotive ECU

technical field

The invention relates to the field of automobile ECUs, in particular to a safety upgrade management system and a method thereof applied to the automobile ECUs.

Background technique

With the popularization of automobiles, more and more automobiles enter thousands of households, but this also brings about the safety problems of automobiles. Recently, many car manufacturers and research organizations are promoting smart cars, making cars more intelligent and humanized. In the automotive industry, the development of driverless cars and advanced driver assistance systems (ADAS), ABS (anti-lock braking system), etc. has become the direction of future technology development. As these functions are installed in vehicles, the number of Electronic Control Units (ECUs) in automobiles is increasing, and more than 100 ECUs (Electronic Control Units) are required to control vehicle systems, which increases software size and logic complexity. In addition, the software installed in vehicles is becoming larger and more complex. Due to the existence of bugs, if they are not fixed in time, there will be great danger. The number of recalls caused by software is increasing, it is very important to fix bugs quickly as soon as they are detected, fixes and new features are added causing updates and upgrades of applications to become very frequent as a result. Currently, vehicle ECUs are connected through the vehicle network, which is used to update the ECU software. In the future, as connected vehicles become more commonplace, new functions will be added to the vehicles to provide various services, such as smartphone app downloads. However, by connecting the vehicle to the internet, it could be the target of a cyberattack. In fact, the vehicle can be operated remotely by exploiting its vulnerabilities by exploiting the wireless interface, and there has been a situation where this has developed into a mass recall.

The frequency and importance of ECU software updates will increase as new functions are added, defects are corrected and security risks are addressed. Traditional ECU software bug fixes are performed by the user taking the vehicle to the dealership, where engineers perform the fix over a wired connection using dedicated diagnostic equipment. However, the traditional method has two disadvantages. First, in the conventional method, the user has to take the car to the dealership to install the new software, and this may be a burden on the user if the frequency of software updates increases in the future. Second, the number of vehicles that can be updated at one time is limited because software updates require specialized equipment and a place to park the vehicle. Such restrictions become obstacles immediately after an update is released or on the production line. As a result, the time required to perform the update increases significantly. Over-the-air (OTA) methods have been developed for updating in-vehicle software. If wireless communication is available (mobile network, Wi-Fi, etc.), the update can be done via OTA. Therefore, the burden caused by the software update can be reduced because the user can update without going to the dealer. In addition, by using wireless communication, multiple vehicle times can be updated simultaneously. Therefore, the update can be performed without being limited by the number of devices or the number of parked vehicles. During the ECU software update, if the transmission speed is too slow and the data packet is too large, the time taken for the ECU software update will increase. At this time, the user cannot use the vehicle. It is dangerous for the user to use the vehicle. Therefore, the ECU software update is performed while the vehicle is parked. The user cannot use the car during the software update, so it is necessary to shorten the software update time.

In the prior art, even if there is only a slight difference between the new package and the old package, a complete new installation package is still downloaded for replacement and installation for each version upgrade. This full update method not only wastes a lot of client network traffic, but also. It also increases the time taken by the upgrade process. The user cannot use the vehicle during this period of ECU repair, which will inevitably bring inconvenience to the user in using the vehicle. Therefore, compressing the time for ECU repair is a technical problem that needs to be urgently solved at present. At the same time, it is also necessary to inform the repair time of the vehicle ECU software, so that users can choose a suitable time period to upgrade according to their own schedule, and the challenge of compressing the upgrade time comes from reducing the size of the upgrade package as much as possible. On the other hand, try to avoid the system from being attacked by hackers as much as possible. When it is found that the in-vehicle network is attacked by hackers, it can be discovered as soon as possible and take measures to minimize the damage to the attack.

SUMMARY OF THE INVENTION

Based on the defects in the prior art, in order to achieve the above purpose, the present invention provides a method applied to an automobile ECU upgrade file, which can solve the technical problem that the current upgrade data package is large and is easily attacked by hackers during the upgrade process. :

A method for safety upgrade management applied to an automotive ECU, at least including:

The central gateway in the car receives the upgrade file from the server, and the upgrade file is transmitted to the ECU that needs to be upgraded through the central gateway for upgrade;

The intrusion detection module monitors the in-vehicle network in real time. When it finds a data packet containing attack code in the upgrade file or the car network is attacked, the intrusion detection module feeds back the detected attack information to the security management module;

When the security management module receives the attack information fed back from the intrusion detection module, the security management module issues a control command to the protection module to prevent the target ECU from being intruded;

The protection module is configured to correspond to the security module, and can adopt a corresponding anti-attack strategy according to the control instruction issued by the security module and send it to the target ECU;

The ECU includes a resistance module, and the resistance module is configured to have a function matching the attack resistance strategy. When the target ECU is attacked, the resistance module in the ECU can call the matching application to resist the intrusion according to the attack resistance strategy issued by the protection module. ;

The attack resistance strategy includes the target ECU security reset strategy, the security reset strategy of the target node gateway, and the discarding data packet strategy containing the attack code;

The data packet of the attack code at least includes data conforming to the CAN message format;

The protection module is configured as a protection ECU, and the strategy of discarding data packets containing attack codes specifically includes: the security management module sends data containing attack codes to the protection ECU installed in a specific domain, and the protection ECU sends the attack code containing the CAN message identifier. The information of the packet is broadcast to all ECUs in the same domain, and the ECU calls the application through the resistance module to discard the packet containing the corresponding CAN message identifier.

A method for safety upgrade management applied to an automotive ECU, further, the target ECU safety reset strategy includes the following steps:

When the target ECU receives the safe reset policy, the target ECU automatically restarts and enters a safe mode, where the safe mode at least includes:

Configured to allow basic driving operations to keep the vehicle safe, to only allow processing of security-validated CAN messages, or to require integrity checking and data encryption of received data.

A safety upgrade management method applied to an automotive ECU, further,

When the attack is over, the protection ECU again broadcasts a packet containing the normal corresponding CAN message identifier.

A security upgrade management method applied to an automobile ECU, further, when the in-vehicle network adopts the in-vehicle Ethernet for transmission and a node gateway is set to connect with various domains, when an attack occurs, the security management module sends a message to the attacked target node gateway The control instruction is used to instruct the target node gateway to adopt the attack resistance strategy to resist;

The attack resistance strategy includes a security reset strategy of the target node gateway, the security reset strategy of the node gateway includes entering a safe mode after the node gateway automatically restarts, and the security mode of the node gateway at least includes: being configured to allow basic driving operations to The vehicle is secured and only allows processing of security-validated CAN messages, or is configured to require integrity checking of received data and data encryption.

A method for safety upgrade management applied to an automobile ECU, further, the CAN message format includes at least a CAN message address and a remote request bit;

The remote request bit is used to distinguish the fields of the remote frame and the data frame. The data frame is used for data transmission on the CAN bus. For the data frame, it must be dominant, and the remote request bit is represented by 0;

The remote frame is used to send a request and does not contain payload data information. It must be a recessive 1 for the remote request frame, and the remote request bit is represented by 1.

A method for security upgrade management applied to an automobile ECU, further, the discarding of the data containing the attack code comprises the following steps:

The security management module sends an instruction to discard the data packet to the protection ECU, and the protection ECU changes the remote request bit in the data packet that conforms to the CAN message format and contains the attack code of the CAN message address from a dominant 0 to a recessive 1, and then Send the changed data packet to all ECUs in the form of broadcast;

The ECU only responds when the received CAN message address is the CAN message address associated with it, and directly discards the data packet when there is no association;

The conversion between the dominant and recessive is realized by changing the value of the remote request bit by controlling the CAN_H high voltage and CAN_L low voltage on the CAN bus.

A security upgrade management method applied to an automobile ECU. Further, when an intrusion detection module detects an in-vehicle network, it also includes detection of a vulnerability ECU, and the vulnerability ECU makes a data packet containing an attack code easy to be detected by the intrusion detection module.

A method for safety upgrade management applied to an automobile ECU, further, the upgrade file includes at least a patch package, and the patch package is synthesized by synthesizing a benchmark patch package and a make-up package matching the ECU to be upgraded;

The method for forming the benchmark patch package and the make-up package includes:

Step 1: Analyze the difference between the new file and the old file respectively, find out the difference between the new file and the old file, obtain the difference data package between the new file and the old file, extract and package the difference data package to form a patch package; repeat the steps 1, until the patch packages corresponding to the new files and all the old files of different historical versions are obtained;

Step 2: Select one of the multiple patch packages as the baseline patch package;

Step 3: Compare the difference between the selected benchmark patch package and the patch package, find out the difference between the benchmark patch package and the patch package, obtain the difference data package between the benchmark patch package and the patch package, and extract, pack and compress the difference data package to form a compensation package. package; Step 3 is repeated until the base patch package and all the old files of different historical versions corresponding to the make-up packages are obtained.

A method for safety upgrade management applied to an automobile ECU, further, the obtaining of the difference data package between the new file and the old file includes the following steps:

Step S200: using the suffix array method to sort the old file and the new file to form a string group;

Step S201: then compare the new file with the old file according to the formed string group;

Step S202: use the dichotomy method to query the same part between the old file and the new file;

Step S203: find out the maximum common subsequence of the new file and the old file and determine the difference;

Step S204: Find out the extra parts of the new file and the old file;

Step S205: compress the difference part, the extra part and the control word;

Step S206: forming a patch package.

The addresses for data storage in the new file and the old file use 4 bytes, and the operation code stores fixed 8 bytes under each address.

A method for security upgrade management applied to an automobile ECU, further, the acquisition of the compensation package includes the following steps:

Step S300: Decompress the benchmark patch package and the files of the patch package to obtain the decompressed files of the benchmark patch package and the patch package, respectively, and the decompressed files include three parts respectively: a control word file, a difference file, and an extra file, that is, the benchmark patch package and the patch package. The patch package includes: control word file, difference file, extra file;

Step S301: remove the control word file of the benchmark patch package, retain the control word file of the patch package, and utilize the BSDIFF algorithm to perform differential analysis on the difference file in the benchmark patch package, the extra file, and the difference file and extra file in the patch package;

Step S302: form corresponding sub-difference files, sub-additional files, and sub-control word files through the BSDIFF algorithm;

Step S303: Compress the formed sub-difference file, sub-additional file, sub-control word file and the reserved control word file of the patch package to form a supplementary package.

A method for security upgrade management applied to an automotive ECU, further, synthesizing a patch package through a benchmark patch package and a make-up package includes the following steps:

Step S400: Decompress the compensation package and the benchmark patch package respectively and obtain the decompressed files respectively. The decompressed files of the compensation package include: a sub-difference file, a sub-extra file, a sub-control word file and the reserved control word of the patch package Files, the files obtained after decompressing the benchmark patch package include: difference files, extra files, and control word files;

Step S401: Remove the control word file of the benchmark patch package, keep the control word file of the patch package and add and insert the sub-difference file and the sub-extra file into the difference in the benchmark patch according to the guide information in the sub-control word file. The files and extra files are restored to form the difference files and extra files in the patch package;

Step S402: Packing the difference files, additional files in the formed patch package, and control word files in the reserved patch package to form a patch package.

The present invention also provides a security upgrade management system applied to an automobile ECU, which is characterized by comprising a central gateway, an intrusion detection module, a security management module, and a plurality of ECUs, wherein the security management module and the intrusion detection module are electrically connected to the central gateway respectively;

A central gateway, at least for communication or data processing between the interior and exterior of the vehicle or for network management in the vehicle;

The intrusion detection module, which is configured as a monitoring module or monitoring device, is used for real-time monitoring of the in-vehicle network security. When it is detected that the in-vehicle network is attacked, the attack information can be fed back to the security management module; the security management module, a control A device or control module capable of mitigating the damage caused by a cyber attack when an intrusion detection module detects an automotive cyber attack;

The security management module, which is configured as a control device or a control module, can issue control instructions when the intrusion detection module detects that the in-vehicle network is attacked and make the target adopt a strategy to resist the attack;

The protection module is configured to be able to adopt an attack resistance strategy according to the control instructions issued by the security management module and send it to the ECU, and the protection module is electrically connected to the central gateway through the CAN bus;

The ECU includes a resistance module, and the resistance module is configured to have a function matching the attack resistance strategy. When the target ECU is attacked, the resistance module in the ECU can call the matching application to resist the intrusion according to the attack resistance strategy issued by the protection module. ;

The security management module and the intrusion detection module can exist as independent hardware or be integrated into the central gateway in the form of software modules;

When there is no node gateway, each ECU is electrically connected to the central gateway through the CAN bus.

The invention also provides a security upgrade management system applied to an automobile ECU. Further, the protection module is configured as a protection ECU, and the protection ECU and other ECUs are connected to a CAN network through a CAN bus.

The invention also provides a security upgrade management system applied to an automobile ECU, further comprising: a node gateway, the node gateway is electrically connected to the central gateway through the vehicle Ethernet bus, and each ECU is connected to the node gateway through the CAN network data bus electrical connection.

The present invention also provides a security upgrade management system applied to an automobile ECU, and further includes a vulnerability ECU. The vulnerability ECU is configured as an ECU with more security vulnerabilities, so that data packets containing attack codes can be easily Detected by the intrusion detection module;

It also includes a server and a communication module. The server is electrically connected to the central gateway through the communication module, wherein the server is used to store the upgrade files required for the upgrade. The communication module is arranged in the vehicle and is electrically connected to the central gateway through the vehicle Ethernet. The servers are electrically connected in a wired or wireless manner.

The present invention also provides a safety upgrade management system applied to an automobile ECU, further including the above-mentioned method applied to the safety upgrade management and upgrade of an automobile ECU.

Beneficial effects of the present invention:

1. The use of the security management module and the intrusion detection module, and the ECU contains the resistance module and the introduction of the protection ECU. When the in-vehicle network is attacked by hackers, the intrusion detection module can timely feedback the attack information to the security management module. The management module can issue control commands to the protection ECU, and the protection ECU can adopt a resistance strategy in time to make the ECU that may be invaded resist, reducing the risk of damage to the ECU due to attack. Ensure that each ECU is not attacked during the upgrade process, and monitor the security of the system in time to make countermeasures.

2. The introduction of the vulnerability ECU makes the vulnerable ECU easy to be attacked first when hackers attack. When it is attacked, the intrusion detection module can more easily detect that the system is attacked and timely feedback messages to the security management module.

3. Compared with the prior art, by citing the benchmark patch package and the make-up package, the present invention can simultaneously satisfy ECU upgrades of different versions, and minimize the size of the ECU upgrade package.

4. Compared with the prior art, after the introduction of the benchmark patch package and the make-up package, the benchmark patch package and the multiple make-up packages are compared with patch packages of multiple different versions. The storage space occupied is much smaller than the storage space occupied by multiple patch packages. Therefore, the present invention can directly download the benchmark patch package and make-up package required for the upgrade to the central gateway or the vehicle-mounted host, without increasing the system It also saves the transmission time of the ECU upgrade patch package without having to download it from the server every time.

5. Compared with the prior art, when the difference analysis is performed between the new file and the old file, 4 bytes are used to represent the storage address, and a fixed 8 bytes are used to store the operation code under each storage address. Combined with the 8, 16, 32-bit CPU in the ECU using the ARM platform, it can not only reduce the size of the patch package, but also improve the operating efficiency.

Description of drawings

The following drawings merely illustrate and explain the present invention schematically, and do not limit the scope of the present invention.

1 is a schematic diagram of a security upgrade management system in an embodiment of the present invention;

2 includes a schematic diagram of a node gateway-security upgrade management system in an embodiment of the present invention;

Fig. 3 in the CAN message format of the present invention, the message format schematic diagram of data frame and remote frame;

4a to 4c are schematic diagrams of the formation and synthesis process of the patch package, the make-up package and the new file in the embodiment of the present invention, FIG. 4a is the synthesis of the patch package, FIG. Schematic diagram of file synthesis new file;

Fig. 5 is the flow chart of obtaining the difference data packet of new file and old file in the embodiment of the present invention;

6 is a schematic diagram of a patch package formation process in an embodiment of the present invention;

7 is a schematic diagram of an existing non-fixed number of operation codes in an embodiment of the present invention;

8 is a schematic diagram of an operation code of a fixed number of digits in an embodiment of the present invention;

9 is a flowchart of a method for obtaining a difference data packet between a reference patch package and a patch package in an embodiment of the present invention;

Figure 10 is an example of the formation process of the compensation package in the embodiment of the present invention;

Fig. 11 synthesizing method of patch package in the embodiment of the present invention;

12 is an example of a process for synthesizing a patch package from a benchmark patch package and a make-up package in an embodiment of the present invention;

FIG. 13 is an example of a server storing a patch package, a reference patch package, and a make-up package in an embodiment of the present invention.

Detailed ways

In order to have a clearer understanding of the technical features, objects and effects of the present invention, specific embodiments of the present invention will now be described with reference to the accompanying drawings, in which the same reference numerals denote the same parts. In order to make the drawings concise, only the relevant parts of the present invention are schematically shown in each drawing, and do not represent the actual structure of the product. In addition, in order to make the drawings concise and easy to understand, in some drawings, only one of the components having the same structure or function is schematically shown, or only one of them is marked.

As for the control system, it is well known to those skilled in the art that it can take any appropriate form, either hardware or software, or a plurality of discretely arranged functional modules, or a plurality of functional modules integrated into one hardware. functional unit. In the simplest form, the control system may be a controller, such as a combinational logic controller, a microprogram controller, etc., as long as the operations described in this application can be implemented. Of course, the control system can also be integrated into a physical device as different modules, which do not deviate from the basic principles and protection scope of the present invention.

Example 1:

This embodiment provides a safety management method applied to an automobile, which specifically includes:

The central gateway in the car receives the upgrade file from the server, and the upgrade file is transmitted to the ECU that needs to be upgraded through the central gateway for upgrade;

The intrusion detection module monitors the in-vehicle network in real time. When it finds a data packet containing attack code in the upgrade file or the car network is attacked, the intrusion detection module feeds back the detected attack information to the security management module;

When the security management module receives the attack information fed back from the intrusion detection module, the security management module issues a control command to the protection module to prevent the target ECU from being intruded;

The protection module is configured to correspond to the security module, and can adopt a corresponding anti-attack strategy according to the control instructions issued by the security module and send it to the target ECU;

The ECU includes a resistance module, and the resistance module is configured to have a function matching the attack resistance strategy. When the target ECU is attacked, the resistance module in the ECU can call the matching application to resist the intrusion according to the attack resistance strategy issued by the protection module;

Anti-attack strategies include the security reset strategy of the target ECU, the security reset strategy of the target node gateway, and the strategy of discarding data packets containing attack codes;

The data packet of the attack code includes at least data that conforms to the CAN message format, and can also include virus type, attack method, etc.

Specifically, when the target ECU receives the safety reset policy, the target ECU automatically restarts and then enters a safety mode, where the safety mode at least includes: being configured to allow basic driving operations to ensure the safety of the vehicle, and only allowing processing of safety-verified CAN message, or is configured to require integrity checking and data encryption of received data.

Specifically, the protection module can be configured as a protection ECU, and one of the ECUs can be arbitrarily selected as the protection ECU. However, for the sake of safety, ECUs that are not closely related to safety responsibilities are generally selected, such as brake and engine-related ECUs. It is also possible to set up an ECU, which has no direct relationship with the body control, and is simply used as a protection ECU. At this time, the strategy of discarding the data packet containing the attack code specifically includes: the security management module sends the data containing the attack code to the protection ECU installed in a specific domain, and the protection ECU sends the attack data containing the CAN message identifier (CAN ID). The information of the packet is broadcast to all ECUs in the same domain, and the ECU calls the application through the resistance module to discard the data packet containing the corresponding CAN message identifier;

When the attack is over, the protection ECU again broadcasts a packet containing the normal corresponding CAN message identifier.

Specifically, it should be noted that the present invention can classify numerous ECUs of automobiles, such as power control section, body section, safety section, entertainment section, etc. Each section is provided with a protection ECU and a vulnerability ECU.

In another way in this embodiment, the vehicle Ethernet has a structure of forming domains according to the functions of the vehicle. The vehicle network adopts the vehicle Ethernet for transmission and sets up node gateways to connect with various domains. When an attack occurs, the security management module Send a control instruction to the attacked target node gateway to instruct the target node gateway to adopt an attack resistance strategy to resist. In the presence of node gateways, the ECUs directly connected to the node gateways and the node gateways form specific domains, such as power control domain, body domain, safety domain, and entertainment domain. Each domain is provided with protection ECUs and vulnerability ECUs. Each protection ECU and vulnerability ECU corresponds to a domain.

The attack resistance strategy includes the security reset strategy of the target node gateway. The security reset strategy of the node gateway includes entering a safe mode after the node gateway automatically restarts. The security mode of the node gateway includes at least: being configured to allow basic driving operations to ensure the safety of the vehicle , which only allows processing of security-authenticated CAN messages, or is configured to require integrity checking of received data and data encryption.

Specifically, it should be noted that when the intrusion detection module detects the in-vehicle network, it also includes detection of vulnerable ECUs. The vulnerable ECUs are configured as ECUs with more security vulnerabilities, and the vulnerable ECUs make data packets containing attack codes easy to be invaded. Detection module detected. The vulnerability ECU is considered to be set, and it does not participate in the control of the general situation in the car. Its purpose is to deliberately leave more bugs and backdoors when setting the ECU, so that it will be attacked first. The intrusion detection module can more easily detect the existence of malicious code, so that the security module can respond in time.

Example 2:

This embodiment provides a method for causing an ECU to lose a data packet containing malicious code, which specifically includes: refer to FIG. 3 . Figure 3a is the format of the data frame in the CAN message, Figure 3b is the format of the remote frame in the CAN message,

In Figure 3a, the format of the data frame in the CAN message is a standard frame, and the start of the frame is represented by 1 bit;

The arbitration segment contains an 11-bit ID (CAN message identifier) and a remote request bit (Remote TransmissionRequest, RTR). The ID is distributed from ID28 to ID18, and the prohibition of high 7 bits is all recessive; RTR: remote request bit, dominant (0) means Data frame, recessive (1) means remote frame.

Control segment: consists of 6 bits, indicating the number of data bytes to be transmitted, including reserved bits IDE/r1, r0 (1bit), DLC (4bit).

IDE: Identifier Extension Bit, the identifier extension bit, it is located in the control field in the standard frame and is always dominant. Arbitration field in extended frame, always dominant. r0, r1: The reserved bits must be transmitted at the dominant level, however, the receiving side can receive the level of any combination of dominant and recessive sets. DLC: The number of bytes of data must be 0-8 bytes, but the receiver does not regard DLC=9-15 as an error.

Data segment: It consists of 0 to 8 bytes and is used to load the transmitted data.

Cyclic Redundancy Check (CRC, Cyclic Redundancy Check, CRC): composed of 15bit CRCSequence and 1bit CRC Delimiter, used to check whether the frame has transmission errors. CRC Sequence: CRC sequence, the calculation range is SOF, arbitration field, control field and data field. CRC Delimiter: The CRC delimiter is a normal recessive bit.

ACK field (ACK): ACK (ACK field) length is 2 bits. Including ACK Slot and ACK Delimiter. ACKSlot: acknowledgment gap. When the sending node sends data, it will set all ACK Slot and ACK Delimiter to recessive. After the receiving node calculates the CRC Sequence correctly, it will send a dominant bit to the sender during the ACK Slot to indicate the response. ACK Delimiter: The ACK delimiter is a normal recessive bit.

If there are more than 2 receiving nodes on the bus, as long as any one of them receives the message normally, an ACK will be returned. If no node on the bus can receive the message normally, NO ACK will be returned. In addition, the sending node does not send ACK;

End of frame: Indicates the end of the frame, consisting of 7 recessive bits.

In Figure 3b, the format of the remote frame in the CAN message is different from the message format of the data frame in that the remote frame does not include the data segment, and the rest of the segment is there, which is used to distinguish the data frame and the remote frame. The ID depends on the remote request bit (RTR) is used to identify, when RTR is displayed as 0, it identifies the data frame frame, which is dominant at this time. When the RTR is displayed as 1, it is a remote frame, and it is recessive at this time.

In this embodiment, there is no requirement for the other message formats, and only the CAN message format is required to include at least a CAN message identifier (CAN ID) and a remote request bit (RTR);

The remote request bit is used to distinguish the fields of the remote frame and the data frame. The data frame is used for data transmission on the CAN bus. For the data frame, it must be dominant, and the remote request bit is represented by 0;

The remote frame is used to send a request and does not contain payload data information. It must be a recessive 1 for the remote request frame, and the remote request bit is represented by 1.

The security management module sends an instruction to discard the data packet to the protection ECU, and the protection ECU changes the remote request bit in the data packet conforming to the CAN message format and containing the attack code of the CAN message identifier from a dominant 0 to a recessive 1, and then Then send the changed data packet to all ECUs in the form of broadcast;

Specifically, when the protection ECU receives a data packet containing a CAN message identifier, it will judge whether the CAN message identifier in the data packet is the same as the CAN message identifier containing the attack code according to the instruction issued to it by the security module. The same, if the confirmation is the same, the protection ECU will modify the message format of the data packet receiving the CAN message identifier containing the attack code, and it will change the RTR from 0 to 1, so that the data frame will be changed to a remote frame. After being sent as a remote frame, the ECU only responds when it receives that the CAN message identifier is the CAN message identifier associated with it, and directly discards the data packet when it is not associated. Although the data packet containing the attack has data at this time, since its RTR is displayed as 1 to indicate a remote frame, the associated ECU will not accept the data after receiving the remote frame, but only sends a request-based response to avoid these ECU was attacked. The unrelated ECU will not receive the data, but will directly lose the data.

The conversion between dominant and recessive is achieved by changing the value of the remote request bit by controlling the CAN_H (3.5V) high voltage and CAN_L (1.5V) low voltage on the CAN bus.

Example 3:

Referring to FIG. 4a to FIG. 4c, it is described that the method for obtaining the upgrade package of Example 1 provided in Example 1 is provided in this embodiment. The upgrade file includes at least a patch package, and the patch package is obtained by combining the benchmark patch package with the ECU to be upgraded. The matching make-up packets are synthesized,

The formation method of the baseline patch package and the make-up package includes:

Step 1: Analyze the difference between the new file and the old file respectively, find out the difference between the new file and the old file, obtain the difference data package between the new file and the old file, extract and package the difference data package to form a patch package; repeat the steps 1, until the patch packages corresponding to the new files and all the old files of different historical versions are obtained;

Specifically, in the process of fixing ECU bugs, it is impossible to fix them once and for all. The bug fixes are constantly improved. Therefore, in the hands of different users, there may be multiple versions of the upgraded old files, such as the original ECU of the car factory. The old files of the car are gradually updated from the V0 version to the V6 version, but there are many choices for car owners, and they may not all be updated to the latest version V6. At this time, there may be some car owners using the old files of the V2 version, and some using the old files of the V3 version, etc. Assuming that a new version of V7 new files has been developed recently, these car owners need to be upgraded at this time, so the old files contain multiple versions, and the version differences between different old files and new files need to be considered during this upgrade. Therefore, there are multiple old files, and there are multiple corresponding patch packages. One of the differences analysis methods is, for example, assuming that there are old files from V0 to V6 and a new file of V7, 7 patch packages B0 to B6 are formed. B0 represents the patch package formed by V7 and V0, and so on, B6 represents the patch package formed by V7 and V6.

Step 2: Select one of the multiple patch packages as the baseline patch package,

Step 3: Find out the difference between the new file and the old file through the difference analysis method between the selected benchmark patch package and multiple patch packages, and form multiple make-up packages;

Specifically, since there are multiple versions of the old file, the formed patch package also has multiple versions, and one of the multiple versions is selected as the benchmark patch package, and the benchmark patch package is any patch package. However, considering that most users will upgrade to the latest and old file versions according to the car manufacturer's prompts (that is, the latest version before the upgrade, for example: the V0 version to the V6 version originally existed, and the latest version of V7 needs to be upgraded at this time. Define V6 as the latest old file and V7 as the new file). Under normal circumstances, the patch package after the difference analysis between the new file and the latest and old files is selected as the benchmark patch package, that is, the patch package formed by V7 and V6 is used as the benchmark patch package B6. Then, the differences between the benchmark patch package and the patch package are analyzed to form multiple make-up packages. For example: B6 and B0 to B5 form supplementary packets, denoted as M0 to M5.

Specifically, the patch package and the make-up package in the new file and the old file are all completed on the server side. The server referred to in the present invention is a broad concept, which can be only a cloud server, or a local PC or computer. A local server, or a device that can perform operations on patch packages and make-up packages.

The synthesis method of the patch package for the ECU upgrade includes:

Synthesize the base patch package and the corresponding make-up package to form a patch package corresponding to the ECU to be upgraded;

Specifically, if the benchmark patch package and a plurality of supplementary packages are stored, such as the benchmark patch package B6, the multiple supplementary packages are M0, M1, M2, M3, M4, and M5. If the current ECU that needs to be upgraded is the latest and old file version V6, and the benchmark patch package is B6, since B6 just corresponds to the latest version of the patch package, at this time, there is no need to synthesize, and the benchmark patch package can be used directly to upgrade. If the current ECU version to be upgraded is not the latest old file, find out the corresponding version of the make-up package according to the current version of the latest and old files, and then synthesize the baseline patch package with the make-up package to generate a patch corresponding to the latest and old files Bag. For example, if the latest old file version of the current ECU is V4, the corresponding patch package is M4, and the data of M4 and the benchmark patch package B6 are synthesized into patch package M4.

The patch package corresponding to the ECU to be upgraded is combined with the old file in the ECU to form a new file that needs to be upgraded.

Specifically, the patch package formed is combined with the old files in the current ECU into the latest upgrade file package, such as the file package of the V7 version, and then the ECU is upgraded by starting the upgrade program.

The generation of the make-up package and the patch package and the restoration of the patch package and the new file may be in different devices. In this case, the data package can be transferred between the transit stations through wired or wireless communication.

Transmit the formed multiple patch packages and benchmark patch packages to the local transit station through the network;

Specifically, after the server completes the compensation package and the reference patch package, it is transmitted to the transfer station through a wireless network or a limited network. The transfer station referred to in the present invention is defined as a device that can transmit data packets to the ECU, which can be a vehicle-mounted host. , it can also be a gateway with data processing and other equipment.

Example 4:

Get the difference data package between the new file and the old file. Use as much of the existing content in the old file as possible, and add as little new content as possible to build the new file. For example: do substring matching on old files and new files or use hash technology, extract common parts, and package the remaining parts of the new files into patch packages or make-up packages. In the synthesis stage, the old files and patch packages can be synthesized into new files with the two basic operations of addition (ADD) and insertion (insertion).

The specific steps to obtain the difference data package between the new file and the old file include:

Step S200: using the suffix array method to sort the old file and the new file to form a string group;

Specifically, the first is the generation of the string index, and the Faster Suffix Sorting (faster suffix sorting) algorithm based on the idea of dichotomy is used to generate the index. The suffix array is a one-dimensional array, which saves a certain arrangement I of i(1...n), and ensures that suffix(I)<suffix(I[i+1]), that is, the n suffixes of S are sorted from small to large. After that, put the beginning positions of the ordered suffixes into I in sequence.

Step S201: then compare the new file with the old file according to the formed string group;

Step S202: use the dichotomy method to query the same part between the old file and the new file;

Step S203: find out the largest common subsequence between the largest new file and the old file and determine the difference;

Step S204: Find the extra part;

Step S205: compress the difference part, the extra part and the control word;

Step S206: forming a patch package

Specifically, see Figure 6:

For example: Suppose the new file is: abedefsdfaoiutkllklll

The old file is: abcdefsdfaoiuker

By comparing the new file and the old file, "abcdefsdfaoiu" in the new file is different from "abrdefsdfaoiu" in the old file only in the third position, so the difference part [00200000000], because the difference part contains a lot of 0, it can be efficiently compression. The extra part is: tjkllklll. Since the subsequent data packet synthesis process is performed by copying and inserting operations, the inserting operations will cause a large number of pointer changes and modifications, and these values must be recorded to relocate the modified area in the Patch phase. Therefore, when forming the difference part and the extra part, the value of the pointer control word needs to be recorded. By introducing the concept of difference files, BSDiff greatly reduces the number of pointer control words to be recorded, thus making the patch package smaller.

In the difference analysis stage and the data storage stage, the following processing is performed on the data packet. In the prior art, referring to FIG. 7 , in the storage of the data file, its address is represented by 8 digits, and each address is used to store the data. , which uses a non-fixed-size storage method. As shown in Figure 7, the address is 80484b4, the stored code is 8b 45f0, the stored code is 6 bits, the address is 80484ba, and the stored code is e8 a1 ff ff ff. The stored code is 10 bytes (byte). However, the ECU is integrated based on the ARM CPU. Under this architecture, it has 8-bit, 16-bit, and 32-bit processors. For example, the maximum binary number that a 32-bit processor can process at a time is 32. Bit (bit) operation code. In order to better reduce the size of the data packet, the current car ECU upgrade package has a very small data packet size compared to the PC system. Therefore, the address is changed to 4 bytes, and the original code is changed to be able to store 8 bytes. Fixed-length code. Referring to Figure 8, if one of the addresses of the old file is: 8400, the code stored at this address is: ebffffba, the next address is: 8404, and the code stored at this address is: e3a03000. In the new file, one of them is address 8418, the code stored at this address: ebffffb4, and the other is address 841c, and the code stored at this address: e51b200c. By adopting a fixed length of code storage, the number of bits used to represent the address is reduced, and the fixed length is 8 bytes, which on the one hand can save space and reduce the size of the data packet. On the other hand, since the fixed length of the stored code is 8 bytes, it is a multiple of the largest binary file recognized by the CPU. Makes the processing efficiency high.

On the other hand, there are many discrepancies in the memory address part, which are caused by sliding reference addresses. Initially, Bsdiff classifies similar parts of new and old files by storage address, and new codes by percentage of different codes. Also, if consecutively distinct opcodes are longer than 8 bytes, the section is defined as dissimilar.

For fixed code, change this percentage for optimization. In many cases, the 32-bit fixed opcode changes only 8 bits. So the threshold should be 75%, not 50%.

Example 5:

The patch package formed by Embodiment 3 and Embodiment 4 is composed of at least three parts: the first is a control word file containing add (ADD) and insert (INSERT) instructions, and the add instructions specify the offset in the old file and length, read the appropriate number of bytes from the old file and add it to the same number of bytes in the difference file, the insert instruction just specifies a length, the specified number of bytes are read from the extra file; The second is a diff file that contains the content of the different bytes in the probabilistic match; the third is an extra file that contains content that is not part of the probabilistic match. Each ADD instruction specifies an offset and length in the old file, reads the corresponding number of bytes from the old file and adds the same bytes from the difference file. The INSERT instruction only specifies a length for reading the specified number of bytes from the extra file.

In step 2 in the embodiment, the method for forming the compensation package is shown in FIGS. 9 to 10. The specific process includes acquiring the difference data package between the reference patch package and the patch package, and the acquisition of the difference data package includes the following steps:

Step S300: decompressing the benchmark patch package and the files of the patch package to obtain the decompressed files of the benchmark patch package and the patch package, respectively, and the decompressed files respectively include three parts: a control word file, a difference file, and an extra file;

Both the benchmark patch package and the patch package respectively include: control word file, difference file, and extra file, among which the benchmark patch package is marked as control word file 1, difference file 1, extra file 1, patch package: control word file 2, difference file 2 , Extra file 2.

Step S301: remove the control word file 1 of the benchmark patch package, retain the control word file 2 of the patch package, and use the BSDIFF algorithm to carry out the difference file 1, the extra file 1 and the difference file 2 and the extra file 2 in the patch package in the benchmark patch package. Differentiation analysis;

Specifically, when the ECU version that needs to be upgraded corresponds to the benchmark patch package, the benchmark patch package can be used to upgrade directly. When the ECU version to be upgraded does not correspond to the baseline patch package, you need to find the corresponding patch package to upgrade. Therefore, if the ECU version to be upgraded does not correspond to the benchmark, the control word file of the benchmark version is a useless file. In order to save space, in step S301, the control word file 1 of the benchmark patch package is removed and completely retained and upgraded. Control word file 2 in the patch package corresponding to the ECU version.

Step S302: form corresponding sub-difference files, sub-additional files, and sub-control word files through the BSDIFF algorithm;

Step S303: Compress the formed sub-difference file, sub-extra file, sub-control word file and the reserved control word file 2 of the patch package to form a supplementary package.

There are multiple versions of the make-up package, and steps S300 to S303 need to be repeated for each corresponding version of the make-up package.

The method for synthesizing the corresponding patch package required for the current ECU upgrade by using the reference patch package and the corresponding make-up package at least includes the following steps: refer to FIG. 11 to FIG. 12 .

Step S400: Decompress the compensation package and the benchmark patch package respectively and obtain the decompressed files respectively. The decompressed files of the compensation package are: sub-difference file, sub-extra file, sub-control word file and the reserved control word of the patch package File 2, the files obtained after decompressing the benchmark patch package include: difference file 1, extra file 1, control word file 1;

Specifically, the make-up package needs to select the make-up package corresponding to the corresponding upgrade of the current ECU version. In this embodiment, although the compensation package and the reference patch package are decompressed, in fact, if the compensation package and the reference patch package are not decompressed during transmission, the data package file can be obtained directly without decompression during this process. So decompression is not a necessary step.

Step S401: remove the control word file 1 of the benchmark patch package, keep the control word file 2 of the patch package and put the sub-difference file and the sub-extra file into the benchmark patch by adding and inserting the sub-difference file and the sub-extra file according to the records in the sub-control word file. The difference file 1 and extra file 1 are restored to form the difference file 2 and extra file 2 in the patch package;

Step S402: Packing the difference file 2 in the formed patch package and the control word file 2 in the patch package reserved by the additional file 2 to synthesize a patch package.

After the patch package corresponding to the upgrade of the current ECU version is formed, the current patch package and the old files of the current version need to be packaged into corresponding new files.

Specifically, through the control word file 2 of the patch package and according to the record position in the control word file, the difference file 2 and the extra file 2 are added and inserted into the current old file to form a corresponding new upgrade file.

Example 6:

This embodiment provides a vehicle-mounted ECU security upgrade system, see FIG. 1 to FIG. 2 .

Specifically, it includes: a central gateway, an intrusion detection module, a security management module, and a plurality of ECUs, wherein the security management module and the intrusion detection module are electrically connected to the central gateway respectively;

A central gateway, at least for communication or data processing between the interior and exterior of the vehicle or for network management in the vehicle;

The intrusion detection module, which is configured as a monitoring module or monitoring device, is used for real-time monitoring of the in-vehicle network security. When it is detected that the in-vehicle network is attacked, the attack information can be fed back to the security management module; the security management module, a control A device or control module capable of mitigating the damage caused by a cyber attack when an intrusion detection module detects an automotive cyber attack;

The security management module, which is configured as a control device or a control module, can issue control instructions when the intrusion detection module detects that the in-vehicle network is attacked and make the target adopt a strategy to resist the attack;

The protection module is configured to be able to adopt an attack resistance strategy according to the control instructions issued by the security management module and send it to the ECU, and the protection module is electrically connected to the central gateway through the CAN bus;

The ECU includes a resistance module, and the resistance module is configured to have a function matching the attack resistance strategy. When the target ECU is attacked, the resistance module in the ECU can call the matching application to resist the intrusion according to the attack resistance strategy issued by the protection module;

The security management module and the intrusion detection module can exist as independent hardware or be integrated into the central gateway in the form of software modules;

When there is no node gateway, each ECU is electrically connected to the central gateway through the CAN bus.

The protection module is configured as a protection ECU, and the protection ECU and other ECUs are connected to the CAN network through the CAN bus. Specifically, the protection module can be configured as a protection ECU, and one of the ECUs can be arbitrarily selected as the protection ECU. However, for the sake of safety, ECUs that are not closely related to safety responsibilities are generally selected, such as brake and engine-related ECUs. It is also possible to set up an ECU, which has no direct relationship with the body control, and is simply used as a protection ECU. At this time, the strategy of discarding the data packet containing the attack code specifically includes: the security management module sends the data containing the attack code to the protection ECU installed in a specific domain, and the protection ECU sends the attack data containing the CAN message identifier (CAN ID). The information of the packet is broadcast to all ECUs in the same domain, and the ECU calls the application through the resistance module to discard the data packet containing the corresponding CAN message identifier;

In this implementation, another structural mode is included, the in-vehicle network includes a node gateway, the node gateway is electrically connected to the central gateway through the vehicle Ethernet bus, and each ECU is electrically connected to the node gateway through the CAN network data bus.

Specifically, the vulnerability ECU is also included, and the vulnerable ECU is configured as an ECU with many security vulnerabilities, so that the data packets containing the attack code are easily detected by the intrusion detection module; specifically, it should be noted that the intrusion detection module detects the in-vehicle network It also includes the detection of vulnerable ECUs. The vulnerable ECUs are configured as ECUs with more security vulnerabilities. The vulnerable ECUs make data packets containing attack code easy to be detected by the intrusion detection module. The vulnerability ECU is considered to be set, and it does not participate in the control of the general situation in the car. Its purpose is to deliberately leave more bugs and backdoors when setting the ECU, so that it will be attacked first. The intrusion detection module can more easily detect the existence of malicious code, so that the security module can respond in time.

Specifically, it also includes a server and a communication module, the server is electrically connected to the central gateway through the communication module, wherein the server is used to store the upgrade files required for the upgrade, the communication module is arranged in the vehicle, and is electrically connected to the central gateway through the vehicle-mounted Ethernet, The communication module is electrically connected with the server in a wired or wireless manner.

The communication module can be a T-box smart antenna.

Specifically, it should be noted that the present invention can classify numerous ECUs of automobiles, such as power control section, body section, safety section, entertainment section, etc. Each section is provided with a protection ECU and a vulnerability ECU.

Specifically, the vehicle-mounted host is also included, and the vehicle-mounted host is electrically connected to the central gateway through the vehicle-mounted Ethernet bus.

In another way in this embodiment, the vehicle Ethernet has a structure of forming domains according to the functions of the vehicle. The vehicle network adopts the vehicle Ethernet for transmission and sets up node gateways to connect with various domains. When an attack occurs, the security management module Send a control instruction to the attacked target node gateway to instruct the target node gateway to adopt an attack resistance strategy to resist. In the presence of node gateways, the ECUs directly connected to the node gateways and the node gateways form specific domains, such as power control domain, body domain, safety domain, and entertainment domain. Each domain is provided with protection ECUs and vulnerability ECUs. Each protection ECU and vulnerability ECU corresponds to a domain.

If the upgrade patch package required by the ECU is not stored in the service, the server invokes the application to synthesize the corresponding patch package and the baseline patch package into a patch package that matches the current ECU upgrade, or the corresponding patch package and baseline patch through the communication module The package is downloaded to the central gateway or in-vehicle host to synthesize the patch package that matches the current ECU upgrade.

Or the formation of the patch package and the make-up package in Embodiment 3 can be processed in the server, or can be processed by the local PC computer and then transmitted to the service, or can be processed by wired or wireless after the PC computer is completed. In this way, the data is transmitted to the ECU, sensors, cameras, etc. for upgrade. At this time, the PC is also equivalent to a server. The transmission bandwidth of the in-vehicle Ethernet is 100 Mbps/s, and the transmission capacity of the payload is 46 to 1518 bytes. The transmission bandwidth of the CAN bus is 1Mbps/s, and the transmission rate of the payload is 0-8byte. Therefore, the rate of the CAN network is much lower than that of the vehicle Ethernet, and the CAN network is the biggest limiting factor restricting the ECU upgrade time. When the protocol transmission rate based on the CAN network is used, for the reliability of the data, it cannot transmit data at the same time, and the data is transmitted one by one. In the upgrade stage of the ECU, it takes the longest time.

Specifically, see an example of the server storing the patch package, the reference patch package, and the make-up package in the embodiment of FIG. 13 .

Fig. 13a shows that when only the patch package exists, the server stores the patch package files in all historical versions, and Fig. 13b shows that there are make-up packages corresponding to the reference patch package and all the historical versions. For the benchmark patch package, you can choose any one of the patch packages of all historical versions as the benchmark patch package. Usually, the patch package corresponding to the latest version of the ECU before the upgrade is selected as the benchmark patch package. Updates are all changes made on the historical version, and the changes are not large. Therefore, compared with the storage space occupied by the patch package required for ECU upgrade and its corresponding version of the make-up package, the storage space occupied by the patch package is much larger than that of the make-up package. Therefore, by adopting the method for making up the package of the present invention, all the ECU upgrade packages required for the upgrade of the historical version are the reference patch package and a plurality of make-up packages, and the data packages thereof are relatively small. The larger storage load of the memory is reduced, which is more conducive to the transmission of data, especially in the environment with small storage space in the central gateway and the on-board host, the smaller data packet size can be directly transmitted to the on-board host or the central gateway , by synthesizing the patch package on the vehicle host or the central gateway, the transmission time and the resources consumed by the system are further reduced.

Claims (11)

1. A safety upgrading management method applied to an automobile ECU is characterized by at least comprising the following steps:

a central gateway in the vehicle receives an upgrade file from a server, and the upgrade file is transmitted to an ECU (electronic control unit) to be upgraded through the central gateway;

the intrusion detection module monitors the in-vehicle network in real time, and when finding a data packet containing an attack code in the upgrade file or when the in-vehicle network is attacked, the intrusion detection module feeds back the detected attack information to the security management module;

when the intrusion detection module detects the in-vehicle network, the detection of the vulnerability ECU is also included, and the detection of the vulnerability ECU enables the data packet containing the attack code to be easily detected by the intrusion detection module;

when the security management module receives attack information fed back by the intrusion detection module, the security management module sends a control instruction to the protection module to prevent the target ECU from being intruded;

the protection module is configured to correspond to the security module, and can adopt a corresponding attack resisting strategy according to a control instruction sent by the security module and send the strategy to the target ECU;

the target ECU comprises a resisting module, wherein the resisting module is configured to have a function matched with an attack resisting strategy, and when the target ECU is attacked, the resisting module in the target ECU can call a matched application program to resist invasion according to the attack resisting strategy sent by the protecting module;

the attack resisting strategy comprises a target ECU security resetting strategy, a security resetting strategy of a target node gateway and a data packet strategy containing attack codes;

when the target ECU receives the safety reset strategy, the target ECU enters a safety mode after being automatically restarted, and the safety mode at least comprises the following steps:

is configured to allow basic driving operations to secure the safety of the vehicle, only allows the processing of a safety-verified CAN message, or is configured to require integrity checking and data encryption of received data;

the data packet of the attack code at least comprises data conforming to a CAN message format;

the CAN message format at least comprises a CAN message identifier and a remote request bit;

the remote request bit is used for distinguishing a remote frame and a field of a data frame, the data frame is used for data transmission on the CAN bus, the data frame must be dominant, and the remote request bit is represented by 0;

the remote frame is used for sending requests and does not contain payload data information, the remote request frame must be an implicit 1, and a remote request bit is represented by 1;

the explicit and implicit conversion is realized by changing the value of a remote request bit through the voltage control CAN _ H high voltage and the CAN _ L low voltage on the CAN bus;

the protection module is configured to protect the ECU, and the strategy of discarding the data packet containing the attack code specifically includes: the security management module sends data containing the attack code to a protection ECU installed in a specific domain, the protection ECU broadcasts information of an attack data packet containing a CAN message identifier to all target ECUs in the same domain, and the target ECUs call an application program through a resisting module to discard the data packet containing the corresponding CAN message identifier;

the safety management module issues a data packet discarding instruction to the protection ECU, the protection ECU changes a remote request bit in a data packet which accords with a CAN message format and contains an attack code of a CAN message identifier from explicit 0 to implicit 1, and then sends the changed data packet to all target ECUs in a broadcasting mode;

the target ECU only responds when the CAN message identifier is the CAN message identifier associated with the target ECU, and the target ECU directly discards the data packet when the CAN message identifier is not associated with the target ECU.

2. The ECU security upgrade management method applied to the automobile according to claim 1,

when the attack is over, the protection ECU broadcasts again a data packet containing the normal corresponding CAN message identifier.

3. The automobile ECU security upgrade management method according to claim 1, wherein when an in-vehicle network transmits by using a vehicle-mounted Ethernet and a node gateway is set to connect with various domains, and an attack occurs, the security management module sends a control instruction to the attacked target node gateway to instruct the target node gateway to adopt the security reset strategy resistance of the target node gateway;

the security reset strategy of the node gateway comprises that the node gateway enters a security mode after being automatically restarted, and the security mode of the node gateway at least comprises the following steps: is configured to allow basic driving operations to secure the vehicle, only allows the processing of a safety-verified CAN message, or is configured to require integrity checking of received data and data encryption.

4. The automobile ECU security upgrading management method according to claim 1, wherein the upgrading file at least comprises a patch package, and the patch package is synthesized by matching a reference patch package with a compensation package of the ECU to be upgraded;

the method for forming the reference patch package and the compensation package comprises the following steps:

step 1: respectively carrying out difference analysis on the new file and the old file, respectively finding out the difference between the new file and the old file, obtaining a difference data packet of the new file and the old file, and extracting and packaging the difference data packet to form a patch packet; repeating the step 1 until patch packages corresponding to the new files and all old files with different historical versions are obtained;

step 2: selecting one of the plurality of patch packages as a reference patch package;

and step 3: comparing the difference of the selected reference patch package with the difference of the selected patch package, finding out the difference of the reference patch package and the patch package, obtaining the difference data package of the reference patch package and the patch package, extracting, packaging and compressing the difference data package to form a compensation package; and repeating the step 3 until a compensation package of the reference patch package corresponding to all the old files with different historical versions is obtained.

5. The automobile ECU security upgrade management method according to claim 4, wherein the obtaining of the difference data packet of the new file and the old file comprises the following steps:

step S200: sequencing the old file and the new file by using a suffix array method to form a character string group;

step S201: then, comparing the new file with the old file according to the formed character string group;

step S202: querying the same part between the old file and the new file by utilizing a dichotomy;

step S203: finding out the maximum public subsequence of the new file and the old file and determining a difference part;

step S204: finding out additional parts of the new file and the old file;

step S205, compressing the difference part, the extra part and the control word;

step S206: forming a patch package;

the addresses of data storage in the new file and the old file are 4 bytes, and the operation code stores fixed 8 bytes under each address.

6. The automobile ECU security upgrade management method according to claim 4, wherein the patch package acquisition comprises the following steps:

step S300: decompressing the files of the reference patch package and the patch package to obtain decompressed files of the reference patch package and the patch package respectively, wherein the decompressed files respectively comprise three parts: the control word file, the difference file and the additional file, namely the reference patch package and the patch package respectively comprise: control word files, difference files, extra files;

step S301: removing the control word file of the reference patch package, reserving the control word file of the patch package, and performing differential analysis on the difference file and the extra file in the reference patch package and the difference file and the extra file in the patch package by using a BSDIFF algorithm;

step S302: forming corresponding sub difference files, sub extra files and sub control word files by a BSDIFF algorithm;

step S303: and packaging the formed sub difference file, the sub additional file, the sub control word file and the control word file of the reserved patch package, and then compressing to form the patch package.

7. The automobile ECU security upgrading management method according to claim 6, wherein the step of forming the patch pack by the reference patch pack and the compensation pack comprises the following steps:

step S400: respectively decompressing the compensation package and the reference patch package to respectively obtain decompressed files, wherein the decompressed files of the compensation package comprise: the sub difference file, the sub extra file, the sub control word file and the reserved control word file of the patch package, wherein the file obtained after the standard patch package is decompressed comprises: difference files, extra files, control word files;

step S401: removing the control word file of the standard patch package, reserving the control word file of the patch package, and restoring the sub difference file and the sub extra file into the difference file and the extra file in the standard patch package by adding and inserting the difference file and the extra file into the standard patch according to the guide information in the sub control word file to form the difference file and the extra file in the patch package;

step S402: and packaging the difference file, the additional file and the control word file in the reserved patch package to form the patch package.

8. A safety upgrading management system applied to automobile ECUs is characterized by comprising a central gateway, an intrusion detection module, a safety management module and a plurality of ECUs, wherein the safety management module is electrically connected with the intrusion detection module through the central gateway respectively;

the central gateway is at least used for communication or data processing or in-vehicle network management between the interior and the exterior of the vehicle;

the intrusion detection module is configured as a monitoring module or monitoring equipment and used for monitoring the safety of the in-vehicle network in real time, and when the in-vehicle network is detected to be attacked, the attack information can be fed back to the safety management module; the security management module is control equipment or a control module, and can reduce damage caused by network attack when the intrusion detection module detects the automobile network attack;

the safety management module is configured as a control device or a control module and can issue a control instruction and enable a target to adopt an attack resisting strategy for resisting when the intrusion detection module detects that the network in the vehicle is attacked;

the protection module is configured to adopt an attack resisting strategy according to a control instruction issued by the safety management module and send the strategy to the target ECU, and the protection module is electrically connected with the central gateway through the CAN bus;

the target ECU comprises a resisting module, wherein the resisting module is configured to have a function matched with an attack resisting strategy, and when the target ECU is attacked, the resisting module in the target ECU can call a matched application program to resist invasion according to the attack resisting strategy sent by the protecting module;

the security management module and the intrusion detection module can exist as independent hardware or are integrated into a central gateway in a software module mode;

when the node gateway does not exist, each ECU is electrically connected with the central gateway through the CAN bus;

the safety upgrading management system is applied to the automobile ECU safety upgrading management upgrading method according to any one of claims 1 to 7.

9. The system as claimed in claim 8, wherein the protection module is configured to protect the ECU, and the protection ECU is connected to the CAN network together with other ECUs through the CAN bus.

10. The ECU security upgrade management system for vehicles according to claim 8, further comprising: and the node gateways are electrically connected with the central gateway through a vehicle-mounted Ethernet bus, and each ECU is electrically connected with the node gateways through a CAN network data bus.

11. The system for managing the security upgrade of the automobile ECU according to claim 8, further comprising a vulnerability ECU, wherein the vulnerability ECU is configured as an ECU with more security vulnerabilities, so that a data packet containing an attack code is easy to be detected by the intrusion detection module;

the system comprises a vehicle-mounted Ethernet, a central gateway and a server, and is characterized by further comprising the server and a communication module, wherein the server is electrically connected with the central gateway through the communication module, the server is used for storing upgrade files required by upgrade, the communication module is arranged in the vehicle and is electrically connected with the central gateway through the vehicle-mounted Ethernet, and the communication module is electrically connected with the server in a wired or wireless mode.

Images