CN114398064A - A method and system for OTA upgrading vehicle controller - Google Patents

Abstract

The invention relates to a method and a system for upgrading a vehicle controller by OTA, wherein the method comprises the following steps: the OTA server side uploads a controller upgrade package organized by a private protocol; the PKI server encrypts the controller upgrading packet by a symmetric algorithm; the PKI server calculates the HASH value of the controller upgrading packet, and encrypts the HASH value through an asymmetric algorithm private key corresponding to the corresponding service certificate ID according to the HASH value to serve as a signature of the upgrading packet; the vehicle end networking equipment collects the relevant version information of the vehicle controller and communicates with the OTA server end through a configuration private network according to an SSL standard link protocol; the vehicle end networking equipment sends the relevant version information of the vehicle controller to the OTA server side; the OTA server side judges whether the version information related to the vehicle controller is the latest version, and if not, the OTA server side informs the vehicle side internet connection equipment to download the controller upgrading package; and the vehicle-end networking equipment checks the integrity of the upgrading packet of the controller. The invention effectively improves the information security performance of the OTA and ensures the security of OTA upgrade of vehicles.

Description

A method and system for OTA upgrading vehicle controller

technical field

The invention relates to the technical field of OTA upgrade of vehicles, in particular to the technology of OTA upgrade of vehicle controllers.

Background technique

The full English name of OTA technology is Over the Air Technology. Over-the-air download technology is to upgrade the system through mobile communication technology. The OTA of the vehicle-end system refers to the upgrade of vehicle-related systems and controllers.

There are more and more controllers on the car, and the functions are more and more complicated. It is inevitable for some controllers to find software defects after leaving the factory with the whole vehicle or during the user's use. Controller upgrades and defect repairs can improve user experience and reduce operating costs for manufacturers. OTA upgrades of vehicle controllers tend to be frequent, and models equipped with OTA for complete vehicles are also emerging. However, OTA-related laws and regulations have not been perfected. In particular, it is necessary to be cautious about security issues, which are directly related to the safety of customers' lives and property. The hidden dangers of information security for OTA upgrades are gradually becoming prominent in the application.

SUMMARY OF THE INVENTION

The purpose of the present invention is to provide a method and system for OTA upgrading of a vehicle controller, which solves the technical problem: there is a potential safety hazard in the related art to upgrade the vehicle controller through OTA.

In order to solve the above-mentioned technical problems, the technical solution adopted in the present invention is as follows: a method for OTA upgrading a vehicle controller, comprising the following steps:

S01: The OTA server uploads the controller upgrade package organized by the private protocol;

S02: the PKI server encrypts the controller upgrade package with a symmetric algorithm;

S03: the PKI server calculates the HASH value of the controller upgrade package, and encrypts the HASH value by the asymmetric algorithm private key corresponding to the corresponding service certificate ID according to the HASH value as the signature of the upgrade package;

S04: The vehicle-end network connection device collects the relevant version information of the vehicle controller, and communicates with the OTA server through the configuration private network according to the SSL standard link protocol;

S05: The in-vehicle network connection device sends the relevant version information of the vehicle controller to the OTA server;

S06: The OTA server determines whether the relevant version information of the vehicle controller is the latest version, and if not, notifies the vehicle-end connected device to download the controller upgrade package;

S07: The on-board networking device verifies the integrity of the controller upgrade package;

S08: The in-vehicle network connection device queries the SubMaster service certificate information corresponding to the controller to be upgraded according to the configuration topology information;

S09: The vehicle-end networking device deploys the controller upgrade package to the corresponding SubMaster device, and the SubMaster device verifies the controller upgrade package using the public key of the asymmetric algorithm of the corresponding service certificate;

S10: The in-vehicle network connection device queries the encrypted ID of the corresponding SubMaster. If the SubMaster device currently does not have the key required for decrypting the controller upgrade package, the in-vehicle network connection device updates the key and the SubMaster to the SubMaster. Corresponding initial value information, the key is verified by the public key of the service certificate of the SubMaster device;

S11: After the controller upgrade package and the key verification pass, the SubMaster device notifies the on-board connected device to prepare for upgrade, and the on-board connected device checks the vehicle upgrade condition, and then notifies the SubMaster device to upgrade;

S12: The SubMaster device decrypts the controller upgrade package, parses the controller upgrade package content according to a private upgrade package organization and analysis protocol, and flashes and upgrades the to-be-upgraded controller.

Preferably,

In the S02, the PKI server encrypts the controller upgrade package with a symmetric algorithm, and records and saves the corresponding key ID.

Preferably,

In the S08, if the SubMaster device currently does not have the service certificate required for the controller upgrade package verification and signature, the vehicle-end connected device updates the service certificate to the SubMaster device, and the service certificate passes through the SubMaster device. Built-in verification of the root certificate public key.

Preferably,

In the S11, the vehicle upgrade conditions include vehicle speed, engine state, vehicle power supply gear, handbrake state, and battery power.

Preferably,

In the S12, the private upgrade package organization and analysis protocol includes version information, flash type, baud rate, diagnostic ID, data block size, receiving, sending and waiting delays of the controller upgrade package.

The present invention also provides a system for OTA upgrading the vehicle controller, comprising:

The upload module is used for the OTA server to upload the controller upgrade package organized by the private protocol;

a first encryption module, used for the PKI server to perform symmetric algorithm encryption on the controller upgrade package;

A calculation module, used for the PKI server to calculate the HASH value of the controller upgrade package;

The second encryption module is used for encrypting the HASH value as the signature of the upgrade package through the asymmetric algorithm private key corresponding to the corresponding service certificate ID according to the HASH value;

The collection module is used for the vehicle-end connected device to collect the relevant version information of the vehicle controller;

a sending module, used for the vehicle-end connected device to send the relevant version information of the vehicle controller to the OTA server;

a first judging module, used for the OTA server to judge whether the relevant version information of the vehicle controller is the latest version, and if not, notify the vehicle-end connected device to download the controller upgrade package;

a verification module, used for the vehicle-end network connection device to verify the integrity of the controller upgrade package;

a first query module, used for the in-vehicle network connection device to query the SubMaster service certificate information corresponding to the controller to be upgraded according to the topology information;

The signature verification module is used for the SubMaster device to verify the signature of the controller upgrade package using the public key of the asymmetric algorithm of the corresponding service certificate;

The second query module is used for the in-vehicle network connection device to query the encrypted ID of the corresponding SubMaster. If the SubMaster device currently does not have the key required for parsing the controller upgrade package, the in-vehicle network connection device sends the SubMaster updates the key and the corresponding initial value information, and the key passes the verification of the service certificate public key of the SubMaster device;

The second judgment module is used for the vehicle-end connected device to check the vehicle upgrade conditions, and then notify the SubMaster device to upgrade;

a decryption module, used for the SubMaster device to decrypt the controller upgrade package;

The parsing module is used for parsing the content of the controller upgrade package according to the private upgrade package organization and parsing protocol.

Preferably,

In the first encryption module, the PKI server encrypts the controller upgrade package with a symmetric algorithm, and records and saves the corresponding key ID.

Preferably,

In the first query module, if the SubMaster device currently does not have the service certificate required for the controller upgrade package verification and signature, the in-vehicle network connection device updates the service certificate to the SubMaster device, and the service certificate is passed through the built-in root certificate public key of the SubMaster. check.

Preferably,

In the second judging module, the vehicle upgrade conditions include vehicle speed, engine state, vehicle power supply gear, handbrake state, and battery power.

Preferably,

In the analysis module, the private upgrade package organization analysis protocol includes version information, flash type, baud rate, diagnostic ID, data block size, receiving, sending and waiting delays of the upgrade package of the controller.

By adopting the above technical solutions, the present invention can achieve beneficial technical effects: in the present invention, the security upgrade of the vehicle end needs the cooperation of the OTA server, and the OTA server provides the following services for the overall solution: generation and update of business certificates; symmetric encryption The generation and update of the key is performed symmetric encryption for the controller upgrade package; the vehicle terminal and the OTA server communicate through the private network under the operator network, and the vehicle terminal and the OTA server are connected using the standard SSL protocol, and the vehicle terminal is connected to the device. , Deploy the security chip in the SubMaster device, and the root public key certificate is built in the security chip, which cannot be changed. The update service certificate is verified and replaced with the root certificate. After uploading the controller upgrade package on the OTA server, the OTA server updates the controller upgrade package for the controller. Symmetric algorithm encryption is adopted, and the symmetric key is stored in the encryption chip of the SubMaster device. The symmetric key can be updated by encrypting and decrypting the asymmetric encryption algorithm of the service certificate that has passed the verification. The initial value of each symmetric encryption and decryption is updated and set. Each upgrade package generates a signature on the OTA server. After the transmission is completed, the SubMaster device uses the service certificate to verify the signature. The content of the uploaded package format is organized by a private protocol on the OTA server, and is parsed and written on the SubMaster device, effectively improving the information security of OTA. performance, to ensure the safety of the OTA upgrade of the vehicle.

Description of drawings

1 is a system security architecture diagram of the present invention;

FIG. 2 is a schematic diagram of the controller safety startup verification of the present invention.

Detailed ways

The present invention will be further described below in conjunction with the accompanying drawings.

As shown in Figure 1, the OTA server/PKI server communicates with the vehicle-side connected device/Master through 4G/WiFi, the vehicle-side connected device/Master has a built-in HSM, and the vehicle-side connected device/Master uses CAN/CANFD/Ethernet connected to each controller.

Specifically, a method for OTA upgrading a vehicle controller provided by the present invention includes the following steps:

In the first step, the OTA server uploads the controller upgrade package organized by the private protocol. The OTA server/PKI server encrypts the controller upgrade package with a symmetric algorithm, records and saves the corresponding key ID and other information; the PKI server calculates the controller The HASH value of the upgrade package is encrypted with the private key of the asymmetric algorithm corresponding to the corresponding service certificate ID according to the HASH value as the signature of the controller upgrade package.

In the second step, the vehicle-end network connection device collects the relevant version information of the vehicle controller, communicates with the OTA server through the configuration private network according to the SSL standard link protocol, and sends the version information of the vehicle-end to the OTA server.

In the third step, the OTA server receives and compares the version information between the background and the vehicle. If the version information is not the latest, it notifies the vehicle-connected device to download the controller upgrade package to be upgraded.

In the fourth step, the vehicle-end networking device downloads the controller upgrade package, and verifies the integrity of the controller upgrade package. If the verification fails, it needs to be downloaded again.

In the fifth step, the vehicle-end network device will query the SubMaster service certificate information corresponding to the controller with the upgrade according to the configuration topology information. SubMaster updates the service certificate. The service certificate must pass the verification of the built-in root certificate public key of SubMater. The vehicle-end connected device deploys the controller upgrade package to the corresponding SubMaster device, and the SubMaster device uses the corresponding service certificate for the controller upgrade package. The public key of the asymmetric algorithm is used for signature verification. If the signature verification fails, the controller upgrade package needs to be redeployed for signature verification.

Step 6: The vehicle-end connected device queries the encrypted ID of the corresponding SubMaster. If the SubMaster device currently does not have the key required for decryption of the upgrade package, the vehicle-end connected device item SubMaster updates the key and the corresponding initial value and other information. The key must pass the verification of the public key of the SubMaster's business certificate.

Step 7: After the controller upgrade package and key verification are passed, the SubMaster device prepares to upgrade through the Master device. The Master device checks the vehicle upgrade conditions. The specific conditions are set according to the vehicle type, including vehicle speed, transmitter status, and vehicle power supply. position, handbrake status, battery power, etc. If the conditions are met, the SubMaster device will be notified to upgrade.

In the eighth step, the SubMaster device decrypts the controller upgrade package and parses the content of the controller upgrade package according to the private upgrade package organization and analysis protocol, and then flashes and upgrades the controller to be upgraded. The private upgrade package organization and analysis protocol includes the controller upgrade package. Version information, flashing type, baud rate, diagnostic ID, data block size, receiving, sending, waiting delay and other information, can be modified according to different backstop configuration files Flexible build version, parse version content, control Flashing rhythm, strong scalability, configurable.

The ninth step, after the controller is started, verify the authenticity and integrity of the Bootloader and the application.

As shown in Figure 2, specifically, the controller verifies the authenticity and integrity of the Booloader through the bootable program, and then verifies the authenticity and integrity of the application program based on the sampling mechanism, and can be started only after the verification is passed.

The present invention also provides a system for OTA upgrading the vehicle controller, comprising:

The upload module is used for the OTA server to upload the controller upgrade package organized by the private protocol;

The first encryption module is used for the PKI server to perform symmetric algorithm encryption on the controller upgrade package;

The calculation module is used for the PKI server to calculate the HASH value of the controller upgrade package;

The second encryption module is used to encrypt the HASH value as the signature of the upgrade package through the private key of the asymmetric algorithm corresponding to the corresponding service certificate ID according to the HASH value;

The collection module is used for the vehicle-end connected device to collect the relevant version information of the vehicle controller;

The sending module is used for the vehicle-end connected device to send the relevant version information of the vehicle controller to the OTA server;

The first judging module is used for the OTA server to judge whether the relevant version information of the vehicle controller is the latest version, and if not, notifying the on-board connected device to download the controller upgrade package;

The verification module is used to verify the integrity of the controller upgrade package for the vehicle-end networking equipment;

The first query module is used for the vehicle-end network connection device to query the SubMaster service certificate information corresponding to the controller to be upgraded according to the topology information;

The signature verification module is used for the SubMaster device to verify the signature of the controller upgrade package using the public key of the asymmetric algorithm of the corresponding service certificate;

The second query module is used for the in-vehicle connected device to query the encrypted ID of the corresponding SubMaster. If the SubMaster device currently does not have the key required for parsing the controller upgrade package, the in-vehicle connected device updates the key and the corresponding initial value to the SubMaster. value information, and the key passes the verification of the service certificate public key of the SubMaster device;

The second judgment module is used for the vehicle-end connected device to check the vehicle upgrade conditions, and then notify the SubMaster device to upgrade;

a decryption module, used for the SubMaster device to decrypt the controller upgrade package;

The parsing module is used for parsing the content of the controller upgrade package according to the private upgrade package organization and parsing protocol.

specifically,

In the first encryption module, the PKI server encrypts the controller upgrade package with a symmetric algorithm, and records and saves the corresponding key ID.

specifically,

In the first query module, if the SubMaster device does not currently have the service certificate required for the controller upgrade package verification and signature, the vehicle-end connected device updates the service certificate to the SubMaster device, and the service certificate passes the verification of the built-in root certificate public key of the SubMaster .

specifically,

In the second judging module, the vehicle upgrade conditions include vehicle speed, engine state, vehicle power supply gear, handbrake state, and battery power.

specifically,

In the parsing module, the private upgrade package organization and parsing protocol includes the version information, flash type, baud rate, diagnostic ID, data block size, receiving, sending and waiting delays of the controller upgrade package.

Claims (10)

1. a method for OTA upgrade vehicle controller, is characterized in that, comprises the following steps: S01: The OTA server uploads the controller upgrade package organized by the private protocol; S02: the PKI server encrypts the controller upgrade package with a symmetric algorithm; S03: the PKI server calculates the HASH value of the controller upgrade package, and encrypts the HASH value by the asymmetric algorithm private key corresponding to the corresponding service certificate ID according to the HASH value as the signature of the upgrade package; S04: The vehicle-end network connection device collects the relevant version information of the vehicle controller, and communicates with the OTA server through the configuration private network according to the SSL standard link protocol; S05: The in-vehicle network connection device sends the relevant version information of the vehicle controller to the OTA server; S06: The OTA server determines whether the relevant version information of the vehicle controller is the latest version, and if not, notifies the vehicle-end connected device to download the controller upgrade package; S07: The on-board networking device verifies the integrity of the controller upgrade package; S08: The in-vehicle network connection device queries the SubMaster service certificate information corresponding to the controller to be upgraded according to the configuration topology information; S09: The vehicle-end networking device deploys the controller upgrade package to the corresponding SubMaster device, and the SubMaster device verifies the controller upgrade package using the public key of the asymmetric algorithm of the corresponding service certificate; S10: The in-vehicle network connection device queries the encrypted ID of the corresponding SubMaster. If the SubMaster device currently does not have the key required for decrypting the controller upgrade package, the in-vehicle network connection device updates the key and the SubMaster to the SubMaster. Corresponding initial value information, the key is verified by the public key of the service certificate of the SubMaster device; S11: After the controller upgrade package and the key verification pass, the SubMaster device notifies the on-board connected device to prepare for upgrade, and the on-board connected device checks the vehicle upgrade condition, and then notifies the SubMaster device to upgrade; S12: The SubMaster device decrypts the controller upgrade package, parses the controller upgrade package content according to a private upgrade package organization and analysis protocol, and flashes and upgrades the controller to be upgraded. 2. The method for OTA upgrading vehicle controller according to claim 1, wherein, In the S02, the PKI server encrypts the controller upgrade package with a symmetric algorithm, and records and saves the corresponding key ID. 3. The method for OTA upgrading vehicle controller according to claim 1, wherein, In the S08, if the SubMaster device currently does not have the service certificate required for the controller upgrade package verification and signature, the in-vehicle network connection device updates the service certificate to the SubMaster device, and the service certificate passes through the SubMaster device. Built-in verification of the root certificate public key. 4. The method for OTA upgrading vehicle controller according to claim 1, wherein, In the S11, the vehicle upgrade conditions include vehicle speed, engine state, vehicle power supply gear, handbrake state, and battery power. 5. The method for OTA upgrading vehicle controller according to claim 1, wherein, In the S12, the private upgrade package organization and analysis protocol includes version information, flash type, baud rate, diagnostic ID, data block size, receiving, sending and waiting delays of the upgrade package of the controller. 6. a system for OTA upgrade vehicle controller, is characterized in that, comprises: The upload module is used for the OTA server to upload the controller upgrade package organized by the private protocol; a first encryption module, used for the PKI server to perform symmetric algorithm encryption on the controller upgrade package; A calculation module, used for the PKI server to calculate the HASH value of the controller upgrade package; The second encryption module is used for encrypting the HASH value as the signature of the upgrade package through the asymmetric algorithm private key corresponding to the corresponding service certificate ID according to the HASH value; The collection module is used for the vehicle-end connected device to collect the relevant version information of the vehicle controller; a sending module, used for the vehicle-end connected device to send the relevant version information of the vehicle controller to the OTA server; a first judging module, used for the OTA server to judge whether the relevant version information of the vehicle controller is the latest version, and if not, notify the vehicle-end connected device to download the controller upgrade package; a verification module, used for the vehicle-end network connection device to verify the integrity of the controller upgrade package; a first query module, used for the in-vehicle network connection device to query the SubMaster service certificate information corresponding to the controller to be upgraded according to the topology information; The signature verification module is used for the SubMaster device to verify the signature of the controller upgrade package using the public key of the asymmetric algorithm of the corresponding service certificate; The second query module is used for the in-vehicle network connection device to query the encrypted ID of the corresponding SubMaster. If the SubMaster device currently does not have the key required for the analysis of the controller upgrade package, the in-vehicle network connection device sends the SubMaster updates the key and the corresponding initial value information, and the key passes the verification of the service certificate public key of the SubMaster device; The second judgment module is used for the vehicle-end connected device to check the vehicle upgrade conditions, and then notify the SubMaster device to upgrade; a decryption module, used for the SubMaster device to decrypt the controller upgrade package; The parsing module is used for parsing the content of the controller upgrade package according to the private upgrade package organization analysis protocol. 7. The system for OTA upgrading vehicle controller according to claim 6, wherein, In the first encryption module, the PKI server encrypts the controller upgrade package with a symmetric algorithm, and records and saves the corresponding key ID. 8. The system for OTA upgrading vehicle controller according to claim 6, wherein, In the first query module, if the SubMaster device currently does not have the service certificate required for the controller upgrade package verification and signature, the in-vehicle network connection device updates the service certificate to the SubMaster device, and the service certificate passes through the built-in root certificate public key of the SubMaster. check. 9. The system for OTA upgrading vehicle controller according to claim 6, wherein, In the second judging module, the vehicle upgrade conditions include vehicle speed, engine state, vehicle power supply gear, handbrake state, and battery power. 10. The system for OTA upgrading vehicle controller according to claim 6, wherein, In the analysis module, the private upgrade package organization analysis protocol includes version information, flash type, baud rate, diagnostic ID, data block size, receiving, sending and waiting delays of the upgrade package of the controller.

Images