JP2002366993A - Data processor - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a data processor capable of preventing data from being leaked and altered and obtaining high security. SOLUTION: A data processing part 20 for transmitting and receiving data to/from a road machine 40 through an RF part 12, performing various applications on the basis of the transmitted and received data and performing ETC(electronic toll collection) processing by using data of an IC card 18 inserted into a card holder 16, consists of a communication controlling part 22, an application processing part 24, a cryptograph processing part 26, an ICCI/F part 28 and a backup memory 30 and is configured as a one-chip integrated circuit(IC). Accordingly, signal paths between respective parts can not be accessed from the outside, and therefore, data made to flow in the signal paths can be surely prevented from being leaked and altered.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a data processing device for operating data stored in an IC card based on encrypted data.

[0002]

2. Description of the Related Art Conventionally, automatic toll collection is automatically performed non-stop by performing wireless communication between a roadside unit installed at a tollgate on a toll road and an onboard unit mounted on a vehicle. BACKGROUND OF THE INVENTION Receiving (ETC) systems are known.

[0003] In this ETC system, important information for toll collection, for example, personal identification data and billing data of a driver is transmitted and received by wireless communication. Therefore, measures are taken to prevent the leakage or tampering of such information. Is essential,
For this purpose, encryption techniques such as encryption of communication messages and mutual authentication for confirming the validity of a communication partner using encryption are used.

FIG. 4 is a block diagram showing an example of a configuration of an ETC vehicle-mounted device used in the ETC system. As shown in the figure, the on-board ETC device 110 includes an RF unit 112 for transmitting and receiving a radio signal, and an IC card 1 for charge settlement.
, An ICCI / F unit 128 for controlling input / output of data to / from an IC card 118 attached to the card holder 116, and an RF unit 11
2 with the road machine 140 via the DSRC standard (AR
IB STD-T55), a communication control unit 122 that realizes wireless communication, an application processing unit 124 that executes various applications based on various data transmitted and received via the communication control unit 122, and an application processing unit 124. A cryptographic processing unit (SAM) that performs a charge settlement process (hereinafter, referred to as an “ETC process”) by operating data stored in the IC card 118 based on encrypted data input and output between 126
And an HMI device 114 including a display device and an audio device for notifying a user of the device of a processing status and a processing result in the application processing unit 124.

[0005] The on-road unit 140 and the on-board ETC unit 11
Since data related to the ETC process is transmitted and received between 0 and 0, the application processing unit 124 of the on-board ETC device 110, when receiving the encrypted data via the communication control unit 122, Cryptographic processing unit 1
26. Then, the encryption processing unit 126 decrypts the encrypted data, performs processing such as operating the stored value of the IC card 118 according to the content of the decrypted data, and encrypts the processing result. To the application processing unit 124. Then, the application processing unit 124 is configured to transmit the encrypted data to the road device 140 via the communication control unit 122.

[0006]

By the way, the communication control unit 122 for handling digital signals and the application processing unit 1
24, the cryptographic processing unit 126, and the ICCI / F unit 128 are individually formed into integrated circuits (ICs) and modules, and these are mutually connected, and the RF unit 112, the HM
The ETC vehicle-mounted device 110 is configured by connecting the I device 114 and the card holder 116.

[0007] However, since the signal path connecting these units is exposed to the outside, an attack (illegal operation) such as taking out or falsifying data flowing through the signal path to the outside is performed. There was a problem that there was a possibility. In particular, in the signal path connecting between the communication control unit 122, the application processing unit 124, and the encryption processing unit 126, and the signal path connecting between the encryption processing unit 126 and the ICCI / F unit, the authentication information and the charging target of the road-vehicle communication are set. Since data indicating vehicle verification information for identification, entrance information used for calculating tolls, and billing information indicating a billing amount, etc., are transmitted, plagiarizing or falsifying such information leads to exit tollgates. There is a possibility that fraud may be possible, such as passing through at a low price or impersonating another person's ETC vehicle.

Further, in such an ETC on-board unit 110, a SAM 126 for ensuring security is required separately from the application processing unit 124, so that it is difficult to reduce the size of the device. The SAM 126 is necessary only for an application that uses encryption, and can be regarded as a part of the application.
And the SAM 126 may be integrated into one chip.

However, in the application processing / SAM unit integrated into one chip as described above, there is a problem that security is reduced due to the presence of an external bus for connecting the communication control unit 122. That is, when the application processing unit 124 and the SAM 126 are integrated, and particularly when both processes are executed by the same CPU, there is an external bus directly connected to the CPU that executes the SAM function. The CPU must be configured to execute various application processes other than the SAM function.
There is a high risk that information about the SAM is leaked via U.

The present invention has been made in order to solve the above problems.
It is an object of the present invention to provide a data processing device which can prevent data leakage and tampering and can obtain high security.

[0011]

According to a first aspect of the present invention, a communication control unit controls wireless communication with a roadside device installed near a road. The application processing unit realizes various applications based on data transmitted / received to / from the roadside device via the communication control unit.

[0012] Further, when the data received via the communication control unit is encrypted,
The encrypted data is transferred to the encryption processing unit. Then, the encryption processing unit performs a specific process of operating data stored in the IC card via the ICCI / F unit that controls input and output of data to and from the IC card.

In particular, according to the present invention, these communication control unit, application processing unit, encryption processing unit, ICCI /
An electronic circuit including the F section is integrated on one chip, and a signal line connecting the respective sections is hidden from the outside. Therefore, according to the data processing device of the present invention, it is possible to reliably prevent data transmitted on these signal lines from being tampered with or leaked to the outside via signal lines between the units. Safety can be improved.

According to the data processing device of the present invention,
The ETC on-vehicle device can be simply and compactly configured simply by combining it with a transceiver, an HMI device, a card holder, and the like. In addition, the cryptographic processing unit is configured as follows.
A cache memory for temporarily storing data necessary for executing the specific processing, wherein the cache data control means collectively reads the data stored in the IC card and stores the data in the cache memory before starting the specific processing; After completion of the specific processing, it is desirable that the data in the cache memory updated by the execution of the specific processing be stored collectively in the IC card.

In this case, during execution of the specific processing, data in the cache memory which can be accessed at high speed is used.
Since the time-consuming access to the IC card is not performed, the processing time of the specific processing can be significantly reduced. By the way, during the execution of a specific process consisting of a series of processes in accordance with the determined procedure, if the communication with the on-road machine is interrupted, usually, the process executed so far is invalidated and the specific process is started from the beginning. Redo has been done.

At this time, the contents of the cache memory must be discarded, necessary information must be read again from the IC card, and the cache memory must be reset.
However, such a resetting of the cache memory requires a long time, and there is a problem that the processing time of the specific processing is greatly increased.

According to a third aspect of the present invention, there is provided a data processing apparatus including a backup memory for storing backup data of data read from an IC card for storing in a cache memory, wherein the encryption processing unit performs When it becomes necessary to reset the stored value of the cache memory, the stored value of the backup memory is transferred to the cache memory.

In the data processing device configured as described above, when the specific processing is interrupted or restarted based on a communication error or the like, the contents of the cache memory can be updated at a high speed without accessing the IC card. , The processing time when such an abnormality occurs can be significantly reduced.

In addition, since the backup memory is also integrated on one chip together with other parts, it is possible to reliably prevent data stored in the backup memory from being falsified or leaked to the outside.

[0020]

Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is a block diagram illustrating a configuration of an on-board ETC device according to an embodiment to which the present invention is applied. The on-board ETC device according to the present embodiment performs wireless communication with a roadside device installed at a tollgate on a toll road to automatically and non-stop toll collection.
C) Used for the system.

As shown in the figure, the ETC on-board unit 1 of the present embodiment
0 denotes an RF unit 12 for transmitting / receiving a radio signal, a card holder 16 on which an IC card 18 for charge settlement is attached, and R
Data is transmitted / received to / from the roadside device 40 via the F unit 12 and various applications are executed based on the transmitted / received data. As one of the applications, data of the IC card 18 mounted on the card holder 16 is transmitted. A data processing unit 20 for performing ETC processing using the data processing unit 20; and an HMI device 14 including a display device and an audio device for notifying a user of the device of a processing status and a processing result in the data processing unit 20. ing.

The data processing unit 20 communicates between the ICCI / F unit 28 for controlling the input and output of data to and from the IC card 18 mounted on the card holder 16 and the road machine 140 via the RF unit 12. DSRC standard (ARIB
Based on various data transmitted / received between the communication control unit 22 and the road device 40 via the communication control unit 22 in accordance with a predetermined procedure, various applications are executed based on STD-T55). The application processing unit 24 to be executed and the I / O based on the encrypted data input / output between the application processing unit 24
An encryption processing unit (SAM) 26 that performs ETC processing by operating data stored in the C card 18
And a backup memory 30 for storing the same data as the data read from the IC card 18 into the encryption processing unit 26 as backup data. Each of the units 22, 24, 26, and 2 constituting the data processing unit 20
8, 30 are configured as one-chip integrated circuits (ICs).

The communication control unit 22 and the ICCI / F unit 28 include connection terminals for the RF unit 12 and the IC card 18,
That is, the application processing unit 24 and the encryption processing unit 26 are provided with a monitoring circuit that monitors the signal level of the interface with the outside of the data processing unit 20, and the signal level of one of the connection terminals is set to a predetermined allowable range. Is configured to prohibit the operation when the monitoring circuit detects that the threshold value has been exceeded.

That is, when the signal level of the connection terminal of the interface part with the outside of the data processing unit 20 changes, it is assumed that an unauthorized device other than the RF unit 12 and the IC card 18 is connected, and the operation is performed. Is stopped to prevent data leakage and tampering from this interface part.

The ICCI / F unit 28 includes a detection circuit for detecting the state of attachment of the IC card 18 to the card holder 16, and is configured to notify the result of the detection to the encryption processing unit 26. . Next, transmission / reception data transferred between the communication control unit 22 and the application processing unit 24 includes communication control data necessary for control by the communication control unit 22 and application processing data used by the application processing unit 24. In particular, ET
The application processing data for the C processing is encrypted.

Then, the application processing unit 24
Application processing data is extracted from the reception data transferred from the communication control unit 22, processing according to the content is executed, and communication control data is added to processing result data representing the processing result to generate transmission data. Then, this is transferred to the communication control unit 22, and the processing status and the processing result are notified to the user via the HMI device 14.

However, if the extracted application processing data is for ETC processing, that is, it has been encrypted, the application processing unit 24 determines whether the encryption processing unit 26 is in a state where it can execute the ETC processing. It is determined whether or not the application processing data for the ETC processing is extracted to the encryption processing unit 26 as it is if it is in an executable state. Thereafter, when the encrypted processing result data is returned from the encryption processing unit 26, the communication control data is added thereto to generate transmission data.

By repeating the processing corresponding to the application processing data one or more times according to a predetermined procedure, various applications are realized. The application processing unit 24
After receiving a cache setting notification described later from the encryption processing unit 26, when a series of ETC processes ends, until a write completion notification described later is received from the encryption processing unit 26,
It is determined that the encryption processing unit 16 is in a state where the ETC process can be executed.

When the application processing unit 24 receives the write completion notification from the encryption processing unit 26, it receives the next ET.
A cache setting request command is output to the cryptographic processing unit 26 to prepare for the C processing, and if communication with the on-road unit 40 is interrupted during the execution of the ETC processing, the ETC processing being executed is invalidated. And outputs a cache setting request command to the cryptographic processing unit 26.

Next, the encryption processing section 26 decrypts the application processing data transferred from the application processing section 24, executes processing in accordance with the content of the decrypted data, and provides processing result data representing the processing result. Is encrypted and transferred to the application processing unit 24.

However, the cryptographic processing unit 26 has a cache memory (not shown) for reading out and holding data necessary for ETC processing (hereinafter referred to as “ICC data”) from the IC card 18. When data needs to be operated, the ICC data stored in the cache memory is operated instead of directly operating the ICC data stored in the IC card 18.

The control of the ICC data is performed by the ICCI / F
This is performed based on a detection signal indicating the IC card insertion state from the unit 28, and a cache setting request command and an ICC write request command from the application processing unit 24. Hereinafter, the contents of the ICC data control will be described with reference to the flowchart shown in FIG. Note that this control
The ICCI / F unit 28 allows the I
The mounting of the C card 18 is detected, and the mounted IC
When the authenticated IC card 18 is confirmed to be valid as a result of the mutual authentication with the card 18, the IC card 18 is activated.
IC from the card holder 16 by the CCI / F unit 28
When the removal of the card 18 is detected, the operation stops.

As shown in FIG. 2, when this control is started,
First, a flag BF set when valid backup data is stored in the backup memory 30
Is reset (BF ← 0) and initialized (S110).
Next, the ICC data is read from the IC card 18 and
It is stored in the cache memory in the encryption processing unit 26 (S12
0), and further transfers the ICC data stored in the cache memory to the backup memory 30 (S130).
When this transfer is completed, the flag BF is set (S14).
0), by outputting a cache setting notification to the application processing unit 24, it is notified that the ETC process can be executed (S150).

Thereafter, it is determined whether or not a cache setting request command has been input from the application processing unit 24 (S160). If a cache setting request command has been input, the flag BF is further set (BF = 1). It is determined whether or not there is (S170).

If the flag BF is not set, it is determined that valid backup data is not stored in the backup memory 30, and the process returns to S120 to read the ICC data from the IC card 18 to the cache memory. Transfer of ICC data from the cache memory to the backup memory 30, setting of the flag BF, and output of a cache setting notification (S120 to S15)
Perform 0).

On the other hand, if it is determined in S170 that the flag BF has been set, the backup memory 3
Assuming that valid backup data is stored in 0, the ICC data is transferred from the backup memory 30 to the cache memory (S180), and a cache setting notification is output to the application processing unit 24 (S190). , And returns to S160.

If it is determined in S160 that no cache setting request command has been input from the application processing unit 24, it is determined whether an ICC write request command has been input from the application processing unit 24. It is determined whether or not there is no input of the ICC write request command (S200), and the process directly returns to S160.

On the other hand, if it is determined that an ICC write request command has been input,
The data is written to the IC card 18 (S210), the flag BF is cleared (S220), and a write completion notification is output to the application processing unit 24, and the process proceeds to S1.
Return to 60.

The ETC according to the present embodiment configured as described above
In the in-vehicle device 10, as shown in FIG.
That the IC card 18 is attached to the ICCI / F unit 2
8, the encryption processing unit 26 performs mutual authentication with the IC card 18, and as a result, when it is confirmed that the IC card 18 is valid, reads out the ICC data from the IC card 18 to the cache memory. And its I
The C data is transferred to the backup memory 30.

When the ICC data is set in both the cache memory and the backup memory 30 in this manner, the encryption processing unit 26 enters a state in which ETC processing can be executed. A flag BF is set to output a setting completion notification and to indicate that valid ICC data is stored in the backup memory 30.

Thereafter, when the application processing unit 24 receives application processing data for ETC processing from a roadside device 40 installed at a tollgate on a highway or a toll road, the application processing unit 24 encrypts the application processing data.
6, the encryption processing unit 26 decrypts the data, executes ETC processing using the ICC data in the cache memory according to the content of the decrypted data, and when ICC data is required, performs processing. The processing result data representing the result is encrypted and output to the application processing unit 24. When the ETC process is completed by repeating this process a plurality of times, an ICC write request command is output to the encryption processing unit 26, and according to the ICC write request command,
The encryption processing unit 26 writes the ICC data in the cache memory to the IC card 18. When the writing is completed,
The encryption processing unit 26 outputs a write completion notification to the application processing unit 24, and clears the flag BF to indicate that valid ICC data is not stored in the backup memory 30.

On the other hand, upon receiving the write completion notification, the application processing unit 24 prepares for the next ETC processing.
A cache setting request is output to the encryption processing unit 26. At this time, the flag BF is cleared, that is, since valid ICC data is not stored in the backup memory 30, the encryption processing unit 26 that has received the cache setting request sends the IC card 18 from the IC card 18 to the cache memory.
The C data is read, and the IC data is transferred to the backup memory 30.

When the ICC data is set in both the cache memory and the backup memory 30 in this manner, the encryption processing unit 26 enters a state in which ETC processing can be executed. A flag BF is set to output a setting completion notification and to indicate that valid ICC data is stored in the backup memory 30.

Thereafter, when the application processing unit 24 receives the application processing data for the ETC processing from the roadside device 40 as described above, the application processing unit 24 transfers the application processing data to the encryption processing unit 26, and
C processing will be performed.

If the communication with the on-road unit 40 is interrupted during the execution of the ETC processing, the application processing unit 24
Outputs a cache setting request to the cryptographic processing unit 26 in order to invalidate the running ETC process and prepare for re-execution of the ETC process. At this time, the flag BF is set, that is, the valid IC
Since the data is stored, the encryption processing unit 26 that has received the cache setting request transfers the ICC data from the backup memory 30 to the cache memory, and outputs a cache setting completion notification to the application processing unit 24.

As described above, the ETC of the present embodiment
In the on-vehicle device 10, the communication control unit 22, the application processing unit 24, the encryption processing unit 26, the ICCI / F unit 28, the backup memory 30
However, if a single chip is used, a signal path connecting each unit is hidden from the outside, and an extra device is connected to the interface with the RF unit 12 or the IC card 18, the application The operations of the processing unit 24 and the encryption processing unit 26 are stopped.

Therefore, according to the ETC on-vehicle device 10 of the present embodiment, data is input / output from / to the data flowing through the signal path between the units constituting the data processing unit 20 and the interface with the RF unit 12 and the IC card 18. Data can be reliably prevented from leaking to the outside or being tampered with, and the safety and reliability of processing executed by the ETC vehicle-mounted device 10 can be improved.

In the ETC vehicle-mounted device 10 of the present embodiment, the ITC necessary for the ETC processing stored in the IC card 18 is performed.
The CC data is collectively transferred to a cache memory in the encryption processing unit 26 before the start of the ETC process, and the ETC process is performed using the ICC data in the cache memory.
After the end of the ETC processing, the ICC data in the cache memory is collectively written to the IC card 18. In addition, in this embodiment, when the ICC data is read from the IC card 18 into the cache memory,
The ICC data having the same contents is also stored in the backup memory 30. When the ETC processing is invalidated during the execution and it becomes necessary to reset the ICC data in the cache memory, the ICC data in the backup memory 30 is stored in the cache memory 30. To be forwarded to.

Therefore, according to the on-board ETC device 10 of the present embodiment, it is not necessary to access the IC card 18 requiring a long access time during the execution of the ETC process. It is possible to greatly reduce the time. In addition, when the ETC processing being executed is invalidated and the ICC data in the cache memory is reset, the IC
Since there is no need to access the card 18, the state of the encryption processing unit 26 can be promptly returned to a state in which ETC processing can be executed.

Further, in this embodiment, the data processing unit 20
Is constituted by one chip, the data processing unit 20 includes the RF unit 12, the HMI device 14, and the card holder 1.
6, the ETC vehicle-mounted device 10 can be configured simply and compactly. Although one embodiment of the present invention has been described above, the present invention is not limited to the above-described embodiment, and is not limited to the scope of the present invention.
It can be implemented in various aspects.

For example, in the above-described embodiment, the dedicated HMI device 14 is connected to notify the user of the processing state and the processing result of the application processing. However, instead of the HMI interface, another HMI interface is used. An interface that communicates with the in-vehicle device may be provided, and a display device, an audio device, or the like provided in another in-vehicle device connected via this interface may be used.

In this embodiment, after the ICC data is read from the IC card 18 into the cache memory, the contents of the cache memory are stored in the backup memory 30.
The ICC data is transferred to the IC card 18
After reading from the backup memory 30, the contents of the backup memory 30 may be transferred to the cache memory, or the ICC data from the IC card 18 may be simultaneously read into the cache memory and the backup memory 30. Is also good.

[Brief description of the drawings]

FIG. 1 is a block diagram illustrating a configuration of an on-board ETC device according to an embodiment.

FIG. 2 is a flowchart showing the contents of ICC data control executed by a cryptographic processing unit.

FIG. 3 is a sequence diagram illustrating an operation of each unit of the on-board ETC device.

FIG. 4 is a block diagram illustrating a configuration of a conventional ETC vehicle-mounted device.

[Explanation of symbols]

10 ETC on-board unit 12 RF unit 14 H
MI device 16 card holder 18 IC card 20 data processing unit 22 communication control unit 24 application processing unit 26 encryption processing unit 28 ICCI / F unit 30 backup memory 40 road machine

──────────────────────────────────────────────────続 き Continued on the front page (51) Int.Cl. ⁷ Identification symbol FI theme coat ゛ (reference) G06K 19/00 G06K 19/00 Q F term (reference) 3E027 EA01 EC08 EC10 5B017 AA03 BA07 CA14 5B035 BB09 BC00 5B058 CA27 KA08 KA35 YA20

Claims (3)

[Claims] 1. A communication control unit for controlling wireless communication with a roadside device installed near a road, and an ICCI for controlling data input / output to / from an IC card.
/ F unit, an application processing unit that implements various applications based on data transmitted and received between the roadside device via the communication control unit, and encryption input / output between the application processing unit And a cryptographic processing unit for performing a specific process for operating data stored in the IC card via the ICCI / F unit based on the obtained data. A data processing device characterized in that lines are hidden from the outside. 2. The cryptographic processing unit includes: a cache memory for temporarily storing data required for executing the specific process; and a data package for storing the data stored in the IC card before the specific process is started. A cache data control unit that reads and stores the data in the cache memory, and after the specific processing is completed, collectively stores data in the cache memory updated by execution of the specific processing in the IC card. 2. The data processing device according to claim 1, wherein: 3. The data processing device according to claim 2, further comprising: a backup memory for storing backup data having the same content as data read from the IC card for storing in the cache memory; A data processing apparatus, wherein when it is necessary to reset the storage value of the cache memory during execution of the specific processing, backup data stored in the backup memory is transferred to the cache memory.