自 2025 年 3 月 27 日起，我們建議您使用 android-latest-release 而非 aosp-main 建構及貢獻 AOSP。詳情請參閱「Android 開放原始碼計畫變更」。
使用車輛繫結檔案加密
透過集合功能整理內容
你可以依據偏好儲存及分類內容。
本頁面說明如何啟用以車輛為基礎的綁定加密種子功能。
總覽
車輛綁定種子功能的主要目標，是透過保護車輛內娛樂資訊系統 (IVI) 系統中的資料，進一步保護使用者的隱私權。這項操作是透過將儲存空間加密金鑰繫結至其他電子控制單元 (ECU) 來完成，這樣一來，如果將 IVI 移除並放置在其他車輛 (或在測試台上執行)，就無法解密 IVI 上的加密使用者資料。
為了將檔案加密金鑰繫結，Vold 會將車輛專屬的種子與金鑰加密金鑰衍生方法混合，以便將金鑰與車輛繫結。種子為位元組陣列，由原始設備製造商 (STORAGE_ENCRYPTION_BINDING_SEED) 公開為新的車輛硬體抽象層 (VHAL) 屬性。這項屬性的權限受到限制，因此只有具備權限的系統守護程序才能查詢。
架構圖
下圖說明車輛綁定整合的架構：
圖 1. 車輛綁定架構。
啟用車輛繫結
必須明確啟用儲存空間加密功能與車輛的繫結，且必須執行恢復原廠設定才能開啟或關閉。也就是說，無線更新 (OTA) 無法在未清除裝置資料的情況下啟用這項功能。如果原始設備製造商 (OEM) 也將裝置恢復原廠設定，則可選擇在升級時啟用這項功能。例如在服務拜訪時。
只要在供應商提供的車輛 HAL 中支援 STORAGE_ENCRYPTION_BINDING_SEED 屬性，即可啟用這項功能。這個屬性會保留長度為 16 位元組的位元組字串，並預期會在 IVI 以外的 ECU 上保留。這個屬性最初是由 Android Automotive OS (AAOS) 設定，並使用加密安全隨機號碼產生器 (CSRNG) 產生。AAOS 會在後續啟動時讀取該屬性。
VHAL 儲存 STORAGE_ENCRYPTION_BINDING_SEED 的值的方式會因供應商而異。我們提供以下一般建議，協助您保護種子：
- (建議) 種子會由車輛中的 ECU 儲存，且受到良好的物理保護。如果沒有，從車輛中取出 IVI 和 ECU 就會很簡單。
- (建議) IVI 和 ECU 應相互驗證，交換種子，以防 ECU 偽造種子要求。
- (建議) 請使用安全管道傳送種子，以防 CAN 匯流排嗅探。
此外，請新增以下內容，確保供應商 init.target.rc 在 late-fs 前 mount_all --late：
# feed vehicle binding seed to vold
exec_start vold_seed_binding
車輛 HAL 應在 early_hal 中啟動，而非 hal now。/data 分區尚未掛載，因此無法在 early-hal 中存取任何 persist.* 系統屬性。
如果 ECU 種子不相符，裝置會重新啟動至復原模式，並提示使用者清除 /data 分區或重試。
您可以在 builtins.cpp 中變更提示和清除資料的行為：
- 將
prompt_and_wipe_data 變更為 wipe_data。裝置會在沒有提示的情況下清除資料，然後重新啟動。 - 提示訊息包含在 recovery.cpp 中。
圖 2. 提示訊息。
測試車輛式繫結
模擬測試
packages/services/Car/cpp/security/vehicle_binding_util/tests 會提供模擬測試。
如要執行這項模擬測試，請按照下列步驟操作：
attest libvehicle_binding_util_test
整合測試
packages/services/Car/cpp/security/vehicle_binding_util/tests 會提供 atest 測試。
如要執行這項整合測試：
atest vehicle_binding_integration_test
這個頁面中的內容和程式碼範例均受《內容授權》中的授權所規範。Java 與 OpenJDK 是 Oracle 和/或其關係企業的商標或註冊商標。
上次更新時間：2025-07-27 (世界標準時間)。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["缺少我需要的資訊","missingTheInformationINeed","thumb-down"],["過於複雜/步驟過多","tooComplicatedTooManySteps","thumb-down"],["過時","outOfDate","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["示例/程式碼問題","samplesCodeIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-07-27 (世界標準時間)。"],[],[],null,["# Use vehicle bound file encryption\n\nThis page describes how to enable vehicle-based binding encryption seed features.\n\nOverview\n--------\n\nThe primary goal of the vehicle binding seed feature is to further protect the user's privacy by\nguarding data on the In-Vehicle Infotainment (IVI) system against removal from the vehicle. This is\ndone by binding storage encryption keys to some other Electronic Control Unit (ECU) such that if the\nIVI is removed and placed in another vehicle (or run on a test bench), encrypted user data on the\nIVI can't be decrypted.\n\nTo bind file encryption keys, Vold mixes in a vehicle-specific *seed* with key encryption\nkey derivation so the keys are unique and bound physically to the vehicle. The seed is a byte array,\nexposed as a new Vehicle Hardware Abstraction Layer (VHAL) property by the OEM,\n`STORAGE_ENCRYPTION_BINDING_SEED`. This property's permissions are restricted such that\nit can only be queried by privileged system daemons.\n\nArchitecture diagram\n--------------------\n\nThis figure illustrates the architecture of vehicle bound integration:\n\n**Figure 1.** Vehicle bound architecture.\n\nEnable vehicle-based binding\n----------------------------\n\nBinding of storage encryption to the vehicle must be explicitly enabled and can't be turned on\nor off without performing a factory reset. This means that an Over-the-Air (OTA) update can't\nenable the feature without also wiping the device. An OEM could choose to enable the feature upon\nupgrade if they also factory reset the device. For example, on a service visit.\n\nThis feature is enabled by supporting the `STORAGE_ENCRYPTION_BINDING_SEED` property\nin the vendor-supplied vehicle HAL. This property holds a byte string 16 bytes in length and is\nexpected to be persisted on an ECU separate from the IVI. The property is initially set by the\nAndroid Automotive OS (AAOS), which generates it using a Cryptographically Secure Random Number\nGenerator (CSRNG). AAOS then reads the property on subsequent boots.\n\nHow the VHAL stores the value of `STORAGE_ENCRYPTION_BINDING_SEED` is vendor-specific.\nWe have general recommendations for protecting the seed:\n\n1. (*Recommended*) Seed is stored by an ECU in the vehicle that is physically well-protected. If not, it's trivial for both the IVI and the ECU to be pulled from the vehicle.\n2. (*Recommended*) IVI and ECU should mutually authenticate to exchange the seed to prevent spoofing requests for the seed from the ECU.\n3. (*Recommended*) Seed should be transmitted using a secure channel to guard against CAN bus sniffing.\n\nIn addition, add the following to ensure vendor `init.target.rc` on\n`late-fs` **before** `mount_all --late`: \n\n```scdoc\n# feed vehicle binding seed to vold\nexec_start vold_seed_binding\n```\n\nThe vehicle HAL should be started in `early_hal` instead of `hal now`.\nAny `persist.*` system property can't be accessed in `early-hal` because the\n`/data` partition isn't yet mounted.\n\nConfigure vehicle-based binding\n-------------------------------\n\nIf the ECU seed doesn't match, the device reboots into recovery and prompts the user to erase\nthe `/data` partition or retry.\n\nPrompt and wipe data behavior can be changed in\n[builtins.cpp](https://cs.android.com/android/platform/superproject/+/android-latest-release:system/core/init/builtins.cpp;l=1213;drc=main?q=prompt_and_wipe_data%20f:builtin):\n\n1. Change `prompt_and_wipe_data` to `wipe_data`. The device wipes and then reboots without a prompt.\n2. The prompt message is contained in [recovery.cpp](https://cs.android.com/android/platform/superproject/+/android-latest-release:bootable/recovery/recovery.cpp;l=185?q=prompt_and_wipe_data).\n\n **Figure 2.** Prompt message.\n\nTest vehicle-based binding\n--------------------------\n\n### Mock testing\n\nA mock test is provided in\n`packages/services/Car/cpp/security/vehicle_binding_util/tests`.\n\nTo run this mock test: \n\n```\nattest libvehicle_binding_util_test\n```\n\n### Integration testing\n\nAn atest test is provided in\n`packages/services/Car/cpp/security/vehicle_binding_util/tests`.\n\nTo run this integration test: \n\n```\natest vehicle_binding_integration_test\n```"]]
