自 2025 年 3 月 27 日起，我们建议您使用 android-latest-release 而非 aosp-main 构建 AOSP 并为其做出贡献。如需了解详情，请参阅 AOSP 的变更。
使用车辆绑定文件加密功能
使用集合让一切井井有条
根据您的偏好保存内容并对其进行分类。
本页将介绍如何启用基于车辆的绑定加密种子功能。
概览
车辆绑定种子功能的主要目标是，通过防止车载信息娱乐系统 (IVI) 中的数据从车辆中移除来进一步保护用户的隐私。具体方法是将存储加密密钥绑定到其他电子控制单元 (ECU)，这样，如果 IVI 被移除并放置在另一车辆上（或在测试台上运行），IVI 中经过加密的用户数据便无法解密。
为了绑定文件加密密钥，Vold 会在车辆专用种子中混合使用密钥加密密钥派生函数，以使这些密钥独一无二并实际绑定到车辆。种子是一个字节数组，由原始设备制造商 (OEM) 公开为新的车载硬件抽象层 (VHAL) 属性 STORAGE_ENCRYPTION_BINDING_SEED。该属性的权限受到限制，以使其只能由特权系统守护程序查询。
架构示意图
下图说明了车辆绑定集成的架构：
图 1. 车辆绑定架构。
启用基于车辆的绑定
必须显式启用存储加密与车辆的绑定，并且不能在未恢复出厂设置的情况下开启或关闭此功能。这意味着无线下载 (OTA) 更新在不擦除设备的情况下无法启用此功能。如果 OEM 也将设备恢复出厂设置，则可以选择在升级时启用此功能。例如，在上门服务时。
通过支持供应商提供的车载 HAL 中的 STORAGE_ENCRYPTION_BINDING_SEED 属性，可启用此功能。该属性会保存一个长度为 16 个字节的字节字符串，并且应保留在与 IVI 分开的 ECU 上。该属性最初是由 Android Automotive OS (AAOS) 设置的，后者使用加密安全的随机数字生成器 (CSRNG) 生成该属性。然后，AAOS 会在后续启动时读取该属性。
VHAL 如何存储 STORAGE_ENCRYPTION_BINDING_SEED 的值因供应商而异。我们提供了保护种子的一般性建议：
- （推荐）种子由 ECU 存储在物理上受到良好安全保护的车辆中。如若不然，从车辆中提取 IVI 和 ECU 就变得微不足道了。
- （推荐）IVI 和 ECU 应相互进行身份验证以交换种子，从而防止从 ECU 发出针对种子的仿冒请求。
- （推荐）应使用安全通道传输种子，以防范 CAN 总线嗅探。
此外，请添加以下代码以确保 late-fs 上的供应商 init.target.rc 在 mount_all --late 之前：
# feed vehicle binding seed to vold
exec_start vold_seed_binding
车载 HAL 应该在 early_hal（而非 hal now）中开始。无法在 early-hal 中访问任何 persist.* 系统属性，因为尚未装载 /data 分区。
如果 ECU 种子不匹配，设备会重新启动进入恢复模式，并提示用户清除 /data 分区或重试。
您可在 builtins.cpp 中更改提示和擦除数据行为：
- 将
prompt_and_wipe_data 更改为 wipe_data。系统会擦除设备，然后在不给出提示的情况下重新启动设备。 - 提示消息包含在 recovery.cpp 中。
图 2. 提示消息。
测试基于车辆的绑定
模拟测试
packages/services/Car/cpp/security/vehicle_binding_util/tests 中提供了模拟测试。
如需运行此模拟测试，请使用以下命令：
attest libvehicle_binding_util_test
集成测试
packages/services/Car/cpp/security/vehicle_binding_util/tests 中提供了 Atest 测试。
如需运行此集成测试，请使用以下命令：
atest vehicle_binding_integration_test
本页面上的内容和代码示例受内容许可部分所述许可的限制。Java 和 OpenJDK 是 Oracle 和/或其关联公司的注册商标。
最后更新时间 (UTC)：2025-07-27。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["没有我需要的信息","missingTheInformationINeed","thumb-down"],["太复杂/步骤太多","tooComplicatedTooManySteps","thumb-down"],["内容需要更新","outOfDate","thumb-down"],["翻译问题","translationIssue","thumb-down"],["示例/代码问题","samplesCodeIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-07-27。"],[],[],null,["# Use vehicle bound file encryption\n\nThis page describes how to enable vehicle-based binding encryption seed features.\n\nOverview\n--------\n\nThe primary goal of the vehicle binding seed feature is to further protect the user's privacy by\nguarding data on the In-Vehicle Infotainment (IVI) system against removal from the vehicle. This is\ndone by binding storage encryption keys to some other Electronic Control Unit (ECU) such that if the\nIVI is removed and placed in another vehicle (or run on a test bench), encrypted user data on the\nIVI can't be decrypted.\n\nTo bind file encryption keys, Vold mixes in a vehicle-specific *seed* with key encryption\nkey derivation so the keys are unique and bound physically to the vehicle. The seed is a byte array,\nexposed as a new Vehicle Hardware Abstraction Layer (VHAL) property by the OEM,\n`STORAGE_ENCRYPTION_BINDING_SEED`. This property's permissions are restricted such that\nit can only be queried by privileged system daemons.\n\nArchitecture diagram\n--------------------\n\nThis figure illustrates the architecture of vehicle bound integration:\n\n**Figure 1.** Vehicle bound architecture.\n\nEnable vehicle-based binding\n----------------------------\n\nBinding of storage encryption to the vehicle must be explicitly enabled and can't be turned on\nor off without performing a factory reset. This means that an Over-the-Air (OTA) update can't\nenable the feature without also wiping the device. An OEM could choose to enable the feature upon\nupgrade if they also factory reset the device. For example, on a service visit.\n\nThis feature is enabled by supporting the `STORAGE_ENCRYPTION_BINDING_SEED` property\nin the vendor-supplied vehicle HAL. This property holds a byte string 16 bytes in length and is\nexpected to be persisted on an ECU separate from the IVI. The property is initially set by the\nAndroid Automotive OS (AAOS), which generates it using a Cryptographically Secure Random Number\nGenerator (CSRNG). AAOS then reads the property on subsequent boots.\n\nHow the VHAL stores the value of `STORAGE_ENCRYPTION_BINDING_SEED` is vendor-specific.\nWe have general recommendations for protecting the seed:\n\n1. (*Recommended*) Seed is stored by an ECU in the vehicle that is physically well-protected. If not, it's trivial for both the IVI and the ECU to be pulled from the vehicle.\n2. (*Recommended*) IVI and ECU should mutually authenticate to exchange the seed to prevent spoofing requests for the seed from the ECU.\n3. (*Recommended*) Seed should be transmitted using a secure channel to guard against CAN bus sniffing.\n\nIn addition, add the following to ensure vendor `init.target.rc` on\n`late-fs` **before** `mount_all --late`: \n\n```scdoc\n# feed vehicle binding seed to vold\nexec_start vold_seed_binding\n```\n\nThe vehicle HAL should be started in `early_hal` instead of `hal now`.\nAny `persist.*` system property can't be accessed in `early-hal` because the\n`/data` partition isn't yet mounted.\n\nConfigure vehicle-based binding\n-------------------------------\n\nIf the ECU seed doesn't match, the device reboots into recovery and prompts the user to erase\nthe `/data` partition or retry.\n\nPrompt and wipe data behavior can be changed in\n[builtins.cpp](https://cs.android.com/android/platform/superproject/+/android-latest-release:system/core/init/builtins.cpp;l=1213;drc=main?q=prompt_and_wipe_data%20f:builtin):\n\n1. Change `prompt_and_wipe_data` to `wipe_data`. The device wipes and then reboots without a prompt.\n2. The prompt message is contained in [recovery.cpp](https://cs.android.com/android/platform/superproject/+/android-latest-release:bootable/recovery/recovery.cpp;l=185?q=prompt_and_wipe_data).\n\n **Figure 2.** Prompt message.\n\nTest vehicle-based binding\n--------------------------\n\n### Mock testing\n\nA mock test is provided in\n`packages/services/Car/cpp/security/vehicle_binding_util/tests`.\n\nTo run this mock test: \n\n```\nattest libvehicle_binding_util_test\n```\n\n### Integration testing\n\nAn atest test is provided in\n`packages/services/Car/cpp/security/vehicle_binding_util/tests`.\n\nTo run this integration test: \n\n```\natest vehicle_binding_integration_test\n```"]]
