CN115421756B - A service-oriented gateway upgrade method - Google Patents

Abstract

The present invention provides a service-type gateway upgrade method, comprising: when the gateway is powered on for the first time, start the memory to run the gateway pre-boot program; the gateway pre-boot program checks the validity of the boot program in the current effective partition; hardware encryption The module checks the validity of the upgrade program and data signature through the public key data of the asymmetric encryption algorithm and the set encryption algorithm; if the verification is passed, the signature value of the boot program, basic software program, and routing table configuration data is stored in the current in the secure memory of the invalid partition. The present invention realizes the background download when the software of the on-board controller is updated, without affecting the function of the gateway, and can reset the gateway controller to complete the upgrade process when the gateway controller is in sleep or meets the reset condition, improving the user experience; signing the downloaded upgrade program and data Verification, effectively prevent programs and data from being tampered with illegally, and ensure the software and data security of the vehicle service network management controller.

Description

A service-oriented gateway upgrade method

technical field

The invention relates to the field of information security, in particular to a method for upgrading a service-type gateway.

Background technique

With the continuous development of automobile automation, intelligence and networking, the software update function of each vehicle controller has gradually become an essential function, especially the over-the-air download technology (OTA, Over-the-Air) can be The 4G or 5G communication of the vehicle realizes the remote upgrade of the vehicle controller software, and the software problem repair and software function update can be completed without going to the vehicle service station. The vehicle-mounted service gateway controller generally uses a microcontroller as the main control chip. For the main control chip with a built-in single program memory, it adopts a non-background download method, that is, the download of the upgrade package needs to jump to the boot program, and only a single Area mode, first erase the current application program, and then download the new application program, the download process cannot provide the gateway function; for the main control chip with two built-in program memories or a built-in program memory plus an external program memory, background download can be used In this way, the function of the gateway is not affected during the download process of the upgrade package, and the new upgrade package is downloaded to another non-valid program memory or an external program memory.

At present, the main control chip used by most vehicle-mounted service gateway controllers does not have a memory mapping unit MMU. Even if there are two built-in program memories, the address mapping cannot be realized. Therefore, the upgrade process using the background download method is generally as follows: After the upgrade program is downloaded, Jump to the bootloader, the bootloader will erase the current application, read the upgrade program and write it to the application storage space. Therefore, the software architecture of the current in-vehicle service gateway controller is shown in Figure 1, including bootstrap programs and application programs. The application programs can be divided into basic software programs, application software programs, and routing table configuration data according to their functions.

In the prior art, the upgrade process of the vehicle-mounted service gateway controller is generally to verify the signature of the upgrade program in the boot program, set the valid flag of the application program after the signature verification is passed, and then execute the software reset, and judge the valid flag of the application program when starting, if If the application program is valid, jump to the application program to run. The upgrade time of the existing in-vehicle service gateway controller is long, and the gateway function cannot be provided during the upgrade process, which affects the normal use of the vehicle, and the user experience is poor. If the application fails to run normally after the upgrade, automatic identification and rollback to the previous version of the software cannot be realized, and the gateway function after the upgrade cannot be guaranteed to still operate normally. In addition, in order to ensure the startup performance of the vehicle service gateway controller, it only judges the valid flag of the application program in the boot program, and cannot effectively identify the tampering of the application program, so the software security of the vehicle service gateway controller cannot be guaranteed.

Contents of the invention

For the problems of the technologies described above, the technical solution adopted in the present invention is:

A service-type gateway upgrade method, applied to a gateway upgrade system, the gateway upgrade system includes a main controller module, a hardware encryption module and a real-time clock module, the hardware encryption module and the real-time clock module are connected to the main controller module, and the hardware encryption module is used for For performing hardware encryption operations, the real-time clock module is used for performing timing operations;

The main controller module does not include a memory mapping unit. The main controller module includes a boot memory, a first built-in memory, a second built-in memory and a data memory. The boot memory is used to store the gateway pre-boot program; the first built-in memory and the second built-in memory One of the built-in memories is marked as a valid partition, and the other is marked as an invalid partition. The first built-in memory and the second built-in memory are used to store boot programs, random sampling data, basic software programs, application software programs, and routing table configuration data. One of the built-in memory and the second built-in memory does not affect the read operation of the other when performing an erase or write operation; the data memory is used to store operating parameters of the gateway;

The hardware encryption module includes an encryption algorithm processor, a program memory, and a security memory. The security memory is used to store the public key data of the asymmetric encryption/decryption algorithm, the key data of the encryption algorithm, the bootloader signature corresponding to the bootloader, and the mac corresponding to the randomly sampled data. value, the basic software program signature corresponding to the basic software program, the routing table configuration data signature corresponding to the routing table configuration data, and the valid partition flag corresponding to the valid partition;

The service-type gateway upgrading method includes the following steps:

S100, when the gateway is in the power-on state for the first time, start the memory to run the gateway pre-boot program;

S200. The gateway pre-boot program verifies the validity of the boot program in the current valid partition, and runs the boot program of the current valid partition;

S300. The boot program verifies the validity of the basic software program, random sampling data and routing table configuration data, and runs the basic software program;

S400. Receive an upgrade request from the gateway, obtain the valid partition flag through the hardware encryption module, determine the storage space of the invalid partition, erase the storage space of the invalid partition through the boot program, and sign the boot program, basic software program signature, and route of the invalid partition. The mac value corresponding to the table configuration data signature and random sampling data is set to the default invalid value;

S500, download the boot program, basic software program, application software program and routing table configuration data to the invalid partition, and download the upgrade program and data signature, and the hardware encryption module upgrades through the public key data of the asymmetric encryption algorithm and the set encryption algorithm The validity of the program and the data signature is verified; if the verification is passed, step S600 is executed;

S600. Store the boot program, the basic software program, and the signature value of the routing table configuration data in the security memory of the current invalid partition of the hardware encryption module;

S700, perform random sampling processing on the application software program, obtain random sampling data and store it in the safety memory of the invalid partition, the hardware encryption module calculates the mac value corresponding to the random sampling data through the encryption algorithm key data and the encryption algorithm, and stores the mac value Stored in the hardware encryption module;

S800. Set the valid partition flag stored in the hardware encryption module as the current invalid partition, and run the program and data before the upgrade; when the gateway reset or dormancy conditions are satisfied, perform a software reset operation, return to step S200, and run the upgraded program and data data.

The present invention has at least the following beneficial effects:

The service-type gateway upgrading method proposed by the present invention can realize background downloading when the software of the vehicle-mounted controller is updated, and the downloading process does not affect the gateway function, and the execution upgrade time after downloading and verification is the same as the software reset time. When the service-type gateway controller is in sleep or meets the reset conditions, it is reset to complete the upgrade process, which does not affect the normal use of the vehicle and improves the user experience. In addition, each part of the software is verified when the vehicle-mounted service gateway is started. In order to ensure the startup performance of the vehicle-mounted service-type gateway controller, random sampling of application software programs with a large amount of data can effectively identify tampered software and protect The software security of the vehicle service gateway controller; signature verification is performed on the downloaded upgrade program and data, effectively preventing the program and data from being illegally tampered with, and ensuring the software and data security of the vehicle service network management controller.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings that need to be used in the description of the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. For those skilled in the art, other drawings can also be obtained based on these drawings without creative effort.

FIG. 1 is a schematic diagram of a software architecture of an existing vehicle-mounted service gateway controller;

Fig. 2 is a schematic diagram of module connection of the gateway upgrade system provided by the embodiment of the present invention;

FIG. 3 is a flowchart of a service-type gateway upgrading method provided by an embodiment of the present invention;

Fig. 4 is a flow chart of the present invention judging that the programs and data in the current effective partition are running abnormally;

FIG. 5 is a flowchart of method steps after step S800 of the present invention.

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some, not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative efforts fall within the protection scope of the present invention.

A service-type gateway upgrade method applied to a gateway upgrade system:

As shown in Figure 2, the gateway upgrade system includes a main controller module, a hardware encryption module and a real-time clock module, the hardware encryption module and the real-time clock module are connected to the main controller module, and the hardware encryption module can be built in the main controller module, It can also be externally connected to the main controller module through I ² C, SPI or UART communication. The hardware encryption module is used to perform hardware encryption operations, realize hardware acceleration of encryption and decryption algorithms, and effectively shorten the verification time of application software programs; the real-time clock The module is connected to the main controller module through I ² C or UART communication, and the real-time clock module provides timing services for calculating the running time of the program; the main controller module is the MCU processor of the gateway, and the real-time clock module uses the RTC real-time clock chip Perform data processing.

The main controller module does not include a memory mapping unit. The main controller module includes a boot memory, a first built-in memory, a second built-in memory and a data memory. The boot memory is used to store the gateway pre-boot program; the first built-in memory and the second built-in memory One of the built-in memories is marked as a valid partition, and the other is marked as an invalid partition. The first built-in memory and the second built-in memory are used to store boot programs, random sampling data, basic software programs, application software programs, and routing table configuration data. One of the built-in memory and the second built-in memory does not affect the read operation of the other when performing an erase or write operation; the data memory is used to store operating parameters of the gateway;

The hardware encryption module includes an encryption algorithm processor, a program memory, and a security memory. The security memory is used to store the public key data of the asymmetric encryption/decryption algorithm, the key data of the encryption algorithm, the bootloader signature corresponding to the bootloader, and the mac corresponding to the randomly sampled data. value, the basic software program signature corresponding to the basic software program, the routing table configuration data signature corresponding to the routing table configuration data, and the valid partition flag corresponding to the valid partition;

The valid partition flag is a flag indicating that the currently valid program is stored in the first built-in memory or the second built-in memory of the main controller module. If the valid partition flag defaults to 0xFFFFFFFF or 0x00000000, it means that there is no valid program, and 0xA555A555 means that the current valid program is stored in the first In the first built-in memory, 0xA5AAA5AA means that the currently valid program is stored in the second built-in memory, and other values mean invalid values.

If the valid partition flag points to the first built-in memory, the current invalid partition is the second built-in memory; if the valid partition mark points to the second built-in memory, then the current invalid partition is the first built-in memory.

As shown in Figure 3, the service-type gateway upgrade method includes the following steps:

S001. Burn the program of the hardware encryption module, the public key data of the asymmetric encryption algorithm, and the key data of the encryption algorithm into the hardware encryption module;

S002, burn the gateway pre-boot program into the boot memory, and set the boot memory protection option to read-only protection mode;

S003. Burn the initial version of the boot program of the gateway, random sampling data, basic software programs, application software programs and routing table configuration data into the first built-in memory and the second built-in memory, and sign the boot programs of the two partitions , the mac value of the randomly sampled data, the signature of the basic software program and the signature of the routing table configuration data are safely stored through the hardware encryption module, and the effective partition flag is set to point to the first built-in memory;

Steps S001-S003 are the initial program burning steps of the vehicle-mounted service gateway. After the initial program is burned into the gateway, the upgrade steps of the vehicle-mounted service gateway are carried out. The safe and silent upgrade steps of the vehicle-mounted service gateway are as follows:

S100, when the gateway is in the power-on state for the first time, start the memory to run the gateway pre-boot program;

S200. The gateway pre-boot program verifies the validity of the boot program in the current valid partition, and runs the boot program of the current valid partition;

S300. The boot program verifies the validity of the basic software program, random sampling data and routing table configuration data, and runs the basic software program;

S400. Receive an upgrade request from the gateway, obtain the valid partition flag through the hardware encryption module, determine the storage space of the invalid partition, erase the storage space of the invalid partition through the boot program, and sign the boot program, basic software program signature, and route of the invalid partition. Table configuration data signature, mac value erasure corresponding to random sampling data, set to default invalid value, such as all set to 0xFFFFFFFF value;

The upgrade request is authenticated by the external diagnostic instrument through the on-board diagnostic system. After the verification is passed, the diagnostic request is sent to enter the programming session, or the on-board remote upgrade terminal (which can be a remote communication terminal TBox) executes the upgrade and sends a diagnostic request to enter the programming session.

S500, download the boot program, basic software program, application software program and routing table configuration data to the invalid partition, and download the upgrade program and data signature, and the hardware encryption module upgrades through the public key data of the asymmetric encryption algorithm and the set encryption algorithm The validity of the program and the data signature is verified; if the verification is passed, step S600 is executed;

Since the main controller module does not have a built-in memory mapping unit MMU, the upgrade file contains programs of two partition spaces, so when receiving the program corresponding to the memory space of the current valid partition, no checksum write is performed, only the program memory of the current invalid partition is received The program in the space is written into the current invalid partition program storage space, and the downloaded bootloader signature value is not written into the invalid partition program storage, which is used to verify the downloaded bootloader.

S600. Store the boot program, the basic software program, and the signature value of the routing table configuration data in the security memory of the current invalid partition of the hardware encryption module;

S700. Perform random sampling processing on the application software program to obtain random sampling data and store them in the safety memory of the invalid partition. The random sampling processing is to randomly extract data of 32kb or other sizes, and the hardware encryption module uses encryption algorithm key data and encryption algorithm Calculate the mac value corresponding to the randomly sampled data, and store the mac value in the hardware encryption module, and the encryption algorithm can be the AES128-CMAC algorithm;

The randomly sampled data and mac value are used for fast verification of the application software program during secure boot, preventing the occurrence of a situation where the verification time is long due to the application software program occupying too much program memory space, resulting in reduced startup performance.

S800. Set the valid partition flag stored in the hardware encryption module as the current invalid partition, and run the program and data before the upgrade; when the gateway reset or dormancy conditions are satisfied, perform a software reset operation, return to step S200, and run the upgraded program and data data;

As shown in Figure 5, after the step S800, it also includes:

S910, when the gateway pre-boot program after the reset is started, the reset type is obtained and the running time after the last start is calculated;

S920. If the reset type is watchdog reset, and the running time is less than the set minimum running time, and it occurs three times in a row, it is determined that the programs and data in the current valid partition are running abnormally, and the valid partition stored in the hardware encryption module is The boot program signature, the mac value corresponding to the randomly sampled data, the basic software program signature, and the routing table configuration data signature are set to default invalid values, such as all set to 0xFF value;

As shown in Figure 4, in the step S920, it is determined that the programs and data in the current effective partition are running abnormally, including:

S921. Obtain the reset type of the main controller module when the gateway pre-boot program starts, and obtain the current time T ₀ of the real-time clock module, and store it in the data memory;

S922. If the reset type is watchdog reset, execute step S923; if the reset type is not watchdog reset, execute step S924;

S923. Determine the running time T=T ₀ -T ₂ of watchdog reset; wherein, T ₂ is the time stored in the corresponding real-time clock module when the main controller module is reset in the time period before T ₀ ;

If T<T _min , execute step S925; wherein, T _min is the preset minimum running time of watchdog reset;

S924. Clear the reset count value C of the main controller module;

S925, adding 1 to the reset count value C of the main control module for storage;

The step S925 includes:

S926. If the reset count value C=C _max of the main control module, it is determined that the programs and data in the current effective partition are running abnormally; wherein, C _max is the maximum reset count value in the preset reset state;

S930, the validity of the program of the hardware encryption module checking the current invalid partition; if the program is valid, the valid partition flag stored in the hardware encryption module is set to the current invalid partition, execute the software reset operation, switch to the current valid partition to run, And return to step S200 to realize automatic software rollback.

The hardware encryption module performs a validity verification step for the upgrade program and the data signature through the public key data of the asymmetric encryption algorithm and the set encryption algorithm, including:

S510. The hardware encryption module processes the downloaded upgrade program and data through a cryptographic hash algorithm to obtain a first hash value;

S520. The hardware encryption module decrypts the downloaded upgrade program and data signature by using the asymmetric encryption algorithm public key data and the set encryption algorithm to obtain a second hash value;

If the first hash value is equal to the second hash value, the validity check is passed; otherwise, the validity check is not passed;

S530. If the first hash value is equal to the second hash value, store the signature of the boot program, the signature of the basic software program, and the signature of the routing table configuration data in the hardware encryption module; otherwise, the downloaded boot program has been tampered with or the file is damaged, stop the upgrade.

In step S510, the downloaded upgrade programs and data include boot programs, basic software programs, application software programs, and routing table configuration data.

The service-type gateway upgrading method proposed by the present invention can realize background downloading when the software of the vehicle-mounted controller is updated, and the downloading process does not affect the gateway function, and the execution upgrade time after downloading and verification is the same as the software reset time. When the service-type gateway controller is in sleep or meets the reset conditions, it is reset to complete the upgrade process, which does not affect the normal use of the vehicle and improves the user experience. In addition, each part of the software is verified when the vehicle-mounted service gateway is started. In order to ensure the startup performance of the vehicle-mounted service-type gateway controller, random sampling of application software programs with a large amount of data can effectively identify tampered software and protect Software security for in-vehicle service gateway controllers.

In addition, although steps of the methods of the present disclosure are depicted in the drawings in a particular order, there is no requirement or implication that the steps must be performed in that particular order, or that all illustrated steps must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step for execution, and/or one step may be decomposed into multiple steps for execution, etc.

Through the description of the above implementations, those skilled in the art can easily understand that the example implementations described here can be implemented by software, or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of the present disclosure can be embodied in the form of software products, and the software products can be stored in a non-volatile storage medium (which can be CD-ROM, U disk, mobile hard disk, etc.) or on the network , including several instructions to make a computing device (which may be a personal computer, a server, a mobile terminal, or a network device, etc.) execute the method according to the embodiments of the present disclosure.

In an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above method is also provided.

Those skilled in the art can understand that various aspects of the present invention can be implemented as systems, methods or program products. Therefore, various aspects of the present invention can be embodied in the following forms, that is: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software implementations, which can be collectively referred to herein as "circuit", "module" or "system".

An electronic device according to this embodiment of the invention. The electronic device is just an example, and should not limit the functions and application scope of the embodiments of the present invention.

Electronic devices take the form of general-purpose computing devices. Components of an electronic device may include, but are not limited to: the above at least one processor, the above at least one storage, and a bus connecting different system components (including the storage and the processor).

Wherein, the memory stores program codes, and the program codes can be executed by the processor, so that the processor executes the various exemplary embodiments according to the present invention described in the above-mentioned "Exemplary Methods" section of this specification. A step of.

The storage may include readable media in the form of volatile storage, such as random access memory (RAM) and/or cache memory, and may further include read only memory (ROM).

The storage may also include programs/utilities having a set (at least one) of program modules including, but not limited to, an operating system, one or more application programs, other program modules, and program data, in which case Each or some combination may include implementations of network environments.

A bus may represent one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor, or a local bus using any of a variety of bus structures .

The electronic device can also communicate with one or more external devices (such as keyboards, pointing devices, Bluetooth devices, etc.), and can also communicate with one or more devices that enable the user to interact with the electronic device, and/or communicate with the electronic A device communicates with any device (eg, router, modem, etc.) that is capable of communicating with one or more other computing devices. Such communication may occur through input/output (I/O) interfaces. Moreover, the electronic device can also communicate with one or more networks (such as a local area network (LAN), a wide area network (WAN) and/or a public network such as the Internet) through a network adapter. As shown, the network adapter communicates with other modules of the electronic device through a bus. It should be understood that although not shown in the figures, other hardware and/or software modules may be used in conjunction with the electronic device, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and Data backup storage system, etc.

Through the description of the above implementations, those skilled in the art can easily understand that the example implementations described here can be implemented by software, or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of the present disclosure can be embodied in the form of software products, and the software products can be stored in a non-volatile storage medium (which can be CD-ROM, U disk, mobile hard disk, etc.) or on the network , including several instructions to make a computing device (which may be a personal computer, a server, a terminal device, or a network device, etc.) execute the method according to the embodiments of the present disclosure.

In an exemplary embodiment of the present disclosure, there is also provided a computer-readable storage medium on which a program product capable of implementing the above-mentioned method in this specification is stored. In some possible implementations, various aspects of the present invention can also be implemented in the form of a program product, which includes program code, and when the program product is run on a terminal device, the program code is used to make the The terminal device executes the steps according to various exemplary embodiments of the present invention described in the "Exemplary Method" section above in this specification.

A computer readable signal medium may include a data signal carrying readable program code in baseband or as part of a carrier wave. Such propagated data signals may take many forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. A readable signal medium may also be any readable medium other than a readable storage medium that can transmit, propagate, or transport a program for use by or in conjunction with an instruction execution system, apparatus, or device.

Program code embodied on a readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

Program code for carrying out the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages—such as Java, C++, etc., as well as conventional procedural programming languages. Programming language - such as "C" or a similar programming language. The program code may execute entirely on the user's computing device, partly on the user's device, as a stand-alone software package, partly on the user's computing device and partly on a remote computing device, or entirely on the remote computing device or server to execute. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (for example, using an Internet service provider). business to connect via the Internet).

In addition, the above-mentioned figures are only schematic illustrations of the processes included in the method according to the exemplary embodiments of the present invention, and are not intended to be limiting. It is easy to understand that the processes shown in the above figures do not imply or limit the chronological order of these processes. In addition, it is also easy to understand that these processes may be executed synchronously or asynchronously in multiple modules, for example.

It should be noted that although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. Actually, according to the embodiment of the present disclosure, the features and functions of two or more modules or units described above may be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided to be embodied by a plurality of modules or units.

The above is only a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Anyone skilled in the art can easily think of changes or substitutions within the technical scope disclosed in the present invention. All should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims (9)

1. A service gateway upgrade method, applied to a gateway upgrade system, characterized in that the gateway upgrade system includes a main controller module and a hardware encryption module; the hardware encryption module is connected to the main controller module; the hardware encryption module includes an encryption algorithm processor, a program memory, and a security memory, and is used to perform hardware encryption operations; the main controller module includes a boot memory, a first built-in memory, a second built-in memory, and a data memory; the boot memory stores a gateway pre-boot program; the data memory is used to store the gateway's operating parameters; The service gateway upgrade method includes the following steps: S100. When the gateway is in the initial power-on state, the startup memory runs the gateway pre-boot program. S200: Mark one of the first built-in memory and the second built-in memory as a valid partition and the other as an invalid partition; the gateway pre-boot program verifies the validity of the boot program in the currently valid partition and runs the boot program of the currently valid partition; S300: The bootloader verifies the validity of the basic software programs, random sampling data, and routing table configuration data within the currently valid partition, and then runs the basic software programs. S400: Receive the upgrade request from the gateway, obtain the valid partition flag through the hardware encryption module, determine the storage space of the invalid partition, erase the storage space of the invalid partition through the bootloader, and set the bootloader signature, basic software program signature, routing table configuration data signature, and MAC value corresponding to the random sampled data of the invalid partition to the default invalid value. S500: Download the upgrade program and data signature. The hardware encryption module verifies the validity of the upgrade program and data signature using the public key data of the asymmetric encryption algorithm and the set encryption algorithm. If the verification passes, proceed to step S600. S600. Store the bootloader signature, basic software program signature, and routing table configuration data signature into the secure memory of the current invalid partition of the hardware encryption module. S700: Random sampling is performed on the application software program in the first built-in memory and the second built-in memory to obtain random sampling data and store it in the secure memory of the invalid partition. The hardware encryption module calculates the MAC value corresponding to the random sampling data through the encryption algorithm key data and the encryption algorithm, and stores the MAC value in the hardware encryption module. S800: Set the valid partition flag stored in the hardware encryption module to the current invalid partition, and run the program and data before the upgrade; when the gateway reset or hibernation conditions are met, perform a software reset operation, return to step S200, and run the upgraded program and data. 2. The method according to claim 1, characterized in that, after step S800, it further includes: S910. When the reset gateway pre-boot program starts up, it obtains the reset type and calculates the running time since the last startup. S920. If the reset type is watchdog reset, and the running time is less than the set minimum running time, and this occurs three times consecutively, then the program and data in the current valid partition are determined to be abnormal, and the boot program signature, MAC value corresponding to the random sampled data, basic software program signature, and routing table configuration data signature of the valid partition stored in the hardware encryption module are set to default invalid values. S930. The hardware encryption module verifies the validity of the program for the current invalid partition. If the program is valid, the valid partition flag stored in the hardware encryption module is set to the current invalid partition, a software reset operation is performed, and the process returns to step S200. 3. The method according to claim 1, characterized in that the hardware encryption module verifies the validity of the upgrade program and data signature using asymmetric encryption algorithm public key data and a set encryption algorithm, including: S510. The hardware encryption module processes the downloaded upgrade program and data using a cryptographic hash algorithm to obtain a first hash value; S520. The hardware encryption module decrypts the downloaded upgrade program and data signature using the public key data of the asymmetric encryption algorithm and the set encryption algorithm to obtain the second hash value. If the first hash value is equal to the second hash value, the validity check passes; otherwise, the validity check fails. 4. The method according to claim 2, wherein the main controller module is connected to a real-time clock module, and the real-time clock module is used to perform timing operations; In step S920, determining that the program and data within the currently valid partition are running abnormally includes: S921. When the gateway pre-boot program starts, it obtains the reset type of the main controller module and the current time _T0 of the real-time clock module, and stores it in the data memory. S922. If the reset type is watchdog reset, proceed to step S923; if the reset type is not watchdog reset, proceed to step S924. S923. Determine the watchdog reset runtime. ;in, In order to be in The time stored in the real-time clock module when the main controller module is reset within the previous time period; like Then proceed to step S925; where, The minimum runtime for the preset watchdog reset; S924. Clear the reset count value C of the main controller module to zero; S925. Increment the reset count value C of the main control module by 1 and store it. 5. The method according to claim 4, wherein step S925 comprises: S926, If the reset count value of the main control module is... If so, it is determined that the programs and data within the currently valid partition are running abnormally; among them, The maximum reset count value for the preset reset state. 6. The method according to claim 4, characterized in that the real-time clock module is... Alternatively, it can be connected to the main controller module via a UART interface. 7. The method according to claim 3, characterized in that, the hardware encryption module verifies the validity of the upgrade program and data signature using asymmetric encryption algorithm public key data and a set encryption algorithm, further comprising: S530. If the first hash value is equal to the second hash value, the bootloader signature, the basic software program signature, and the routing table configuration data signature are stored in the hardware encryption module; otherwise, the upgrade is stopped. 8. The method according to claim 1, wherein the upgrade request is authenticated by an external diagnostic instrument through an on-board diagnostic system, and after successful authentication, a diagnostic request is sent to enter a programming session. 9. The method according to claim 1, wherein the upgrade request is executed by an on-board remote upgrade terminal, and a diagnostic request is sent to enter the programming session.