A vehicle-mounted device upgrade method, applied to an in-vehicle system, wherein the in-vehicle system comprises an intelligent vehicle and a smartphone, the intelligent vehicle comprises a vehicle-mounted control device, and the method comprises: receiving, by the vehicle-mounted control device, a first partial key sent by the smartphone; restoring, by the vehicle-mounted control device, a first key by using the first partial key and a second partial key that is stored on the vehicle-mounted control device; and performing, by the vehicle-mounted control device, secure processing on a first upgrade file by using the first key, to obtain the securely processed first upgrade file, wherein the secure processing comprises generating first message authentication code, MAC, and the securely processed first upgrade file comprises the first upgrade file and the first MAC, wherein the intelligent vehicle further comprises a first to-be-upgraded vehicle-mounted device, the first upgrade file is used to update the first to-be-upgraded vehicle-mounted device, and the method further comprises: after the first to-be-upgraded vehicle-mounted device is successfully upgraded, indicating, by the vehicle-mounted control device, the smartphone to update a rollback file of the first upgrade file; or after the first to-be-upgraded vehicle-mounted device fails to be upgraded, obtaining, by the vehicle-mounted control device, a rollback file of the first upgrade file from the smartphone, and sending the rollback file to the first to-be-upgraded vehicle-mounted device for a rollback operation. receiving, by the vehicle-mounted control device, a first partial key sent by the smartphone; restoring, by the vehicle-mounted control device, a first key by using the first partial key and a second partial key that is stored on the vehicle-mounted control device; and performing, by the vehicle-mounted control device, secure processing on a first upgrade file by using the first key, to obtain the securely processed first upgrade file, wherein the secure processing comprises generating first message authentication code, MAC, and the securely processed first upgrade file comprises the first upgrade file and the first MAC, wherein the intelligent vehicle further comprises a first to-be-upgraded vehicle-mounted device, the first upgrade file is used to update the first to-be-upgraded vehicle-mounted device, and the method further comprises: after the first to-be-upgraded vehicle-mounted device is successfully upgraded, indicating, by the vehicle-mounted control device, the smartphone to update a rollback file of the first upgrade file; or after the first to-be-upgraded vehicle-mounted device fails to be upgraded, obtaining, by the vehicle-mounted control device, a rollback file of the first upgrade file from the smartphone, and sending the rollback file to the first to-be-upgraded vehicle-mounted device for a rollback operation. after the first to-be-upgraded vehicle-mounted device is successfully upgraded, indicating, by the vehicle-mounted control device, the smartphone to update a rollback file of the first upgrade file; or after the first to-be-upgraded vehicle-mounted device fails to be upgraded, obtaining, by the vehicle-mounted control device, a rollback file of the first upgrade file from the smartphone, and sending the rollback file to the first to-be-upgraded vehicle-mounted device for a rollback operation.