Firmware update method and apparatus for a MCU of a vehicle

Patent metadata

Field	Value
Publication number	US-12423430-B2
Application number	US-202318237128-A
Country	US
Kind code	B2
Filing date	Aug 23, 2023
Priority date	Aug 24, 2022
Publication date	Sep 23, 2025
Grant date	Sep 23, 2025

Abstract

A firmware update method includes requesting a hardware security module (HSM) to store version information of a current firmware stored in a flash memory and storing, by the HSM, the version information of the current firmware. The firmware update method also includes erasing the flash memory when the version information of the current firmware is stored by the HSM and writing new downloaded firmware to the flash memory; verifying an integrity of the new firmware. The firmware update method further includes requesting the HSM to sense downgrade of the new firmware when the integrity is verified. The firmware update method additionally includes determining, by the HSM, whether the firmware is downgraded by comparing the stored version information and the version information of the new firmware. The firmware update method also includes confirming a reprogramming success when it is determined that the firmware is not downgraded by the HSM.

First claim

What is claimed is:

1. A firmware update method, comprising: requesting a hardware security module (HSM) to store version information of a current firmware stored in a flash memory;
storing, by the HSM, the version information of the current firmware;
erasing the flash memory when the version information of the current firmware is stored by the HSM;
writing new downloaded firmware to the flash memory;
requesting the HSM to sense downgrade of the new firmware when the integrity of the new firmware is verified;
based on comparison, by the HSM, of the stored version information and the version information of the new firmware, terminating the firmware update by the HSM as part of confirming a reprogramming success when the firmware is not downgraded by the HSM, and
based on comparison, by the HSM, of the stored version information and the version information of the new firmware, erasing the flash memory and generating a negative response code (NRC) as part of confirming a reprogramming failure when the firmware is downgraded by the HSM.

2. The firmware update method of claim 1 , further comprising:
erasing the flash memory when the integrity is not verified.

3. The firmware update method of claim 1 , wherein storing the version information of the current firmware by the HSM comprises storing the version information of the current firmware in a secure storage.

4. The firmware update method of claim 1 , further comprising:
prior to storing the version information of the current firmware by the HSM, verifying, by the HSM, validity of the version information of the current firmware.

5. The firmware update method of claim 4 , wherein:
the version information includes a version value, a salt value, a message authentication code (MAC), and a pre-shared key (PSK) index, and
verifying the validity of the version information comprises verifying the validity by using PSKs corresponding to the version value, the salt value, the MAC, and the PSK index.

6. The firmware update method of claim 1 , further comprising:
prior to determining whether the firmware is downgraded by the HSM, verifying, by the HSM, the validity of version information of the new firmware.

7. The firmware update method of claim 6 , wherein:
the version information includes a version value, a salt value, a message authentication code (MAC), and a pre-shared key (PSK) index, and
verifying the validity of the version information comprises verifying the validity by using PSKs corresponding to the version value, the salt value, the MAC, and the PSK index.

8. A firmware update apparatus, comprising:
a host core configured to perform firmware update of a flash memory;
the flash memory and
a hardware security module (HSM),
wherein:
the host core is configured to request the HSM to store version information of current firmware stored in the flash memory when requesting the firmware update,
the HSM is configured to store the version information of the current firmware in response to the request of the host core,
the host core is configured to, when the version information of the current firmware is stored by the HSM, erase the flash memory, write new firmware downloaded to the flash memory, and request the HSM to sense downgrade of the new firmware when the integrity is verified,
based on comparison of the stored version information and the version information of the new firmware, the host core is configured to terminate the firmware update by the HSM as part of confirming a reprogramming success when the firmware is not downgraded by the HSM, and
based on comparison, by the HSM, of the stored version information and the version information of the new firmware, the host core is configured to erase the flash memory and generate a negative response code (NRC) as part of confirming a reprogramming failure when the firmware is downgraded by the HSM.

9. The firmware update apparatus of claim 8 , wherein the host core is configured to, when the integrity is not verified, erase the flash memory.

10. The firmware update apparatus of claim 8 , wherein the HSM is configured to store the version information of the current firmware in a secure storage.

11. The firmware update apparatus of claim 8 , wherein the HSM is configured to, prior to storing the version information of the current firmware, verify validity of the version information of the current firmware.

12. The firmware update apparatus of claim 11 , wherein:
the version information includes a version, a salt value, a message authentication code (MAC), and a pre-shared key (PSK) index, and
the HSM is configured to verify the validity of the version information by using PSKs corresponding to the version, the salt value, the MAC, and the PSK index.

13. The firmware update apparatus of claim 8 , wherein the HSM is configured to, prior to determining whether the firmware is downgraded, verify validity of version information of the new firmware.

14. The firmware update apparatus of claim 13 , wherein:
the version information includes a version, a salt value, a message authentication code (MAC), and a pre-shared key (PSK) index, and
the HSM is configured to verify the validity of the version information by using PSKs corresponding to the version, the salt value, the MAC, and the PSK index.

15. The firmware update apparatus of claim 8 , wherein the host core is configured to eras the flash memory without requesting the HSM to store the version information of the current firmware stored in the flash memory when reprogramming is unsuccessful in previous firmware update when the firmware update is requested.

Assignees

• Hyundai Autoever Corp
• Hyundai Motor Corp

Inventors

• Lim Jaehyun

Classifications

• H04L9/0816

  Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use · CPC title

• H04L9/3242

  involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC · CPC title

• G06F21/57

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title

• G06F8/71

  Version control (security arrangements therefor G06F21/57); Configuration management · CPC title

• H04L9/0643

  Hash functions, e.g. MD5, SHA, HMAC or f9 MAC · CPC title