JP2014050038A - Wireless system and train control system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a wireless system having high security in performing wireless transmission of control information between on the ground and on-train in a railroad, and a train control system including the wireless system.SOLUTION: A wireless system 1 comprises a wireless base station 11 and an on-train wireless station 12. The wireless base station 11 and the on-train wireless station 12 perform wireless transmission of a cipher text obtained by adding a counter value 82 for checking wirelessly transmitted order to control information 81 and encrypting them. In the encryption the number of bits of the counter value 82 is set so that: an initialization vector for changing a key is not wirelessly transmitted; the number of bits of the cipher text is not larger than that in the case of wirelessly transmitting the initialization vector; and the same cipher text is not generated from the same control information 81 in using the wireless system 1. Thereby, high security can be implemented even when transmission speed of wireless transmission is low.

Description

  The present invention relates to a wireless system that wirelessly transmits information between the ground and a vehicle in a railway, and a train control system having the wireless system.

  In a railway, a wireless train control system that communicates control information related to safety between the ground and the vehicle using radio is standardized (see Non-Patent Document 1 and Non-Patent Document 2). In order to wirelessly communicate control information related to the safety of train operation, it is necessary to ensure the security of wireless communication. However, a specific method for ensuring the security of wireless communication in the wireless train control system has not been standardized.

  In a wireless train control system, it has been proposed to wirelessly transmit control information between the ground and the vehicle using a leaky coaxial cable (see, for example, Patent Document 1). The wireless transmission of the leaky coaxial cable method has higher security than the wireless transmission of the spatial wave method because the wireless reach is in the vicinity of the leaky coaxial cable. However, for communication of control information related to safety, it is difficult to say that security is sufficient only by using a leaky coaxial cable. Also, laying a leaky coaxial cable is expensive.

  There is known a communication system for a train control system in which control information is concealed by a common key cryptosystem and wirelessly transmitted between the ground and the vehicle (see, for example, Patent Document 2). In this communication system, the key is generated on the vehicle and is not transmitted wirelessly, but is transmitted between the ground and the vehicle via the transponder together with the authentication information. If a large number of transponders are provided on the track and the key is changed each time the train passes through the transponders, the security of wireless transmission increases. However, such a communication system is difficult to introduce because it requires a large number of transponders to be connected to the terrestrial wireless device in a wired manner and is expensive.

  In a wireless train control system, if the encryption key can be changed using wireless communication, the cost of the system can be reduced and wireless transmission security can be ensured. However, the radio for trains has a narrow radio wave bandwidth and a low data transmission speed, so it is difficult to increase the number of bits for radio transmission to change the key.

Japanese Examined Patent Publication No. 7-29606 JP 2009-29298 A

JIS E3801-1: 2009 JIS E 3801-2: 2010

  The present invention solves the above-described problem, and provides a highly secure wireless system that wirelessly transmits control information used for train control between the ground and the vehicle in a railway, and a train control system having the wireless system. The purpose is to provide.

  A radio system of the present invention includes a radio base station installed on the ground and an on-board radio station mounted on a train, and is used for control of a train between the radio base station and the on-board radio station. For wirelessly transmitting information, the wireless base station and the on-board wireless station wirelessly transmit a ciphertext encrypted by adding a counter value to the control information for checking the order of wireless transmission In the encryption, the initialization vector for changing the key is not transmitted wirelessly, the number of bits of the ciphertext transmitted wirelessly is increased compared to the case where the initialization vector is wirelessly transmitted, and The number of bits of the counter value is set so that the same ciphertext is not generated from the same control information when the wireless system is used.

  In this wireless system, an initialization vector is generated using a confidential message including a counter value and control information, and the confidential message is encrypted in a ciphertext block chain mode using the initialization vector. It is preferable that

  In this wireless system, it is preferable that an authentication tag for verifying the integrity of information is added to the control information.

  In this wireless system, it is preferable that the wireless base station and the on-board wireless station wirelessly transmit a message for authenticating a counterpart of wireless transmission, and after authenticating the counterpart, wirelessly transmit the control information.

  In this wireless system, a mutual authentication key for generating the message for authenticating the other party of wireless transmission, an authentication communication key for generating the authentication tag, and a secret communication key used for encrypting the control information are: Preferably, it is generated from one temporary key and shared between the radio base station and the on-board radio station.

  In this wireless system, the temporary key is a random number generated by each of the wireless base station and the on-board wireless station and transmitted to the other party, and a pre-shared key shared in advance between the wireless base station and the on-board wireless station. And a predetermined key derivation function.

  In this radio system, a plurality of the radio base stations are installed along the track on which the train is operated, and radio transmission with the on-board radio station is performed from one radio base station to another as the train moves. When handed over to a radio base station, the authentication communication key and the secret communication key are preferably delivered from the one radio base station to another radio base station.

  In this radio system, when radio transmission is handed over, the radio base station and the on-board radio station preferably change the authentication communication key and the secret communication key using a hash function.

  In this radio system, when radio transmission is handed over, the counter value may be taken over from one radio base station to another radio base station.

  In this wireless system, the wireless base station and the on-board wireless station wirelessly transmit data in a time-division manner into a plurality of time slots, and the time slots of data wirelessly transmitted by the wireless base station are wireless to individual trains. An individual slot for accommodating the control information to be transmitted and a broadcast slot for accommodating control information to be transmitted to a plurality of trains all at once, and the control information in the broadcast slot is a counter value for the broadcast slot. And the key for the broadcast slot is the same in the plurality of on-board radio stations, and the counter value for the broadcast slot is synchronized with the plurality of on-board radio stations. Preferably it is.

  In this radio system, it is preferable that the key for the broadcast slot is transmitted from the radio base station to the on-board radio station using the individual slot.

  The train control system of the present invention comprises a ground device installed on the ground and an on-board control device mounted on the train, and control information is transmitted between the ground device and the on-board control device. The radio system for transmitting and receiving and a train position detection device mounted on a train are further provided, and the on-board control device transmits the position information of the own train detected by the train position detection device via the radio system. Based on the received position information of the train, the ground device transmits stop limit position information to the following train, and the on-board control device of the subsequent train is detected by the train position detection device. Based on the position of the train and the position information of the stop limit, a speed check pattern for stopping the train to the stop limit is generated, and the speed of the own train exceeds the speed check pattern. When , Characterized in that the braking its own train.

  According to the radio system and the train control system of the present invention, since the bit number of the counter value is set so that the same ciphertext is not generated from the same control information, the security of radio transmission between the ground and the vehicle is improved. high. Further, since the number of bits of ciphertext transmitted wirelessly is not increased compared to the case where the initialization vector is wirelessly transmitted, the security can be increased even if the transmission speed of wireless transmission is low.

The block block diagram of the train control system which has a radio | wireless system which concerns on one Embodiment of this invention. The figure which shows the time slot of the data which the radio | wireless base station in the same radio system carries out radio transmission. The figure which shows the time slot of the data which the on-board radio station in the radio system carries out radio transmission. The figure which shows the code format of the data in the same time slot. The figure which shows the encryption algorithm in the said radio | wireless system. FIG. 3 is a sequence diagram of mutual authentication between a radio base station and an on-vehicle radio station in the radio system. FIG. 3 is a sequence diagram of key generation in the same wireless system. The figure explaining the handover of radio transmission in the radio system. The block block diagram of the vehicle-mounted apparatus in the said train control system. The block block diagram containing the subsequent train of the train control system. The figure which shows the speed check pattern in the train control system.

  A radio system according to an embodiment of the present invention and a train control system having the radio system will be described with reference to FIGS. As shown in FIG. 1, the wireless system 1 is used for a train control system 2 in a railway. The train control system 2 conforms to the Japanese Industrial Standard “Wireless Train Control System” (JIS E3801-1: 2009), and in addition to the wireless system 1, the ground device 3 installed on the ground, the command The station apparatus 4 and the on-board controller 51 mounted on the train 5 are provided. The radio system 1 includes a radio base station 11 installed on the ground and an on-board radio station 12 mounted on the train 5. The radio base station 11 is connected to the ground device 3 via the network 6. The on-board radio station 12 is connected to the on-board controller 51 on the vehicle. The radio system 1 wirelessly transmits control information used for controlling the train 5 between the radio base station 11 and the on-board radio station 12, thereby controlling information between the ground device 3 and the on-board control device 51. Send and receive. The ground device 3 includes a plurality of site devices 31 and a plurality of field devices 32. The field device 32 is connected to the base device 31. The base devices 31 and the base device 31 and the command center device 4 are connected via the network 7.

  The base device 31 is a device that is installed at each interlocking station, has a built-in interlocking function, or is connected to the interlocking device. The interlocking device receives a command to set the course of the train, checks the status of the switch and traffic light at that time, determines that no derailment or collision occurs, and turns the switch or signal on. It is a device to be operated. The field device 32 is a device that connects the base device 31 and various facilities along the line. The various facilities along the line are traffic lights, turning devices, railroad crossing security devices, and the like. The command station device 4 is a device installed at the command station, and centrally monitors and manages train operations in the railway network or line section.

  The radio base station 11 and the on-board radio station 12 wirelessly transmit digital data. The bandwidth of radio waves used for wireless transmission is limited and the data transmission speed is, for example, about 9.6 kbps. As shown in FIG. 2, the radio base station 11 transmits data at a predetermined communication cycle T. Data transmitted by the radio base station 11 in the communication cycle T is time-divided into a plurality of time slots 8.

  As shown in FIG. 3, the on-board wireless station 12 transmits data at the communication cycle T. Data transmitted by the on-board radio station 12 in the communication cycle T is time-divided into a plurality of time slots 8.

  As shown in FIG. 4, control information 81 wirelessly transmitted by the radio base station 11 and the on-board radio station 12 is accommodated in each time slot 8. The wireless base station 11 and the on-board wireless station 12 wirelessly transmit a ciphertext encrypted by adding a counter value 82 for checking the order of wireless transmission to the control information 81. In this encryption, the initialization vector for changing the key is not transmitted wirelessly, the number of bits of ciphertext transmitted wirelessly is increased compared to the case where the initialization vector is wirelessly transmitted, and the wireless system 1 The number of bits of the counter value 82 is set so that the same ciphertext is not generated from the same control information 81 in use.

The counter value 82 is also referred to as a serial number because it is a serial number for checking the temporal order of wireless transmission. In addition to the control information 81 and the counter value 82, the message in the time slot 8 includes wireless control information 83, device ID 84, footer information 85, and an authentication tag 86. The radio control information 83 is information for control between radio units in the radio base station 11 and the on-board radio station 12, such as a slot number and a radio base station ID. The device ID 84 is used to identify the on-board radio station. The footer information 85 includes a cyclic redundancy check (CRC) code and the like. An authentication tag 86 is added to verify the integrity of the information. A message 87 to be concealed by encryption is a part to be concealed in the wireless control information 83, a device ID 84, a counter value 82, control information 81, footer information 85, and an authentication tag 86. The target telegram 88 of the authentication tag 86 is wireless control information 83, device ID 84, counter value 82, control information 81, and footer information 85. The authentication tag calculation algorithm is, for example, NIST Special Publication 800-38B Recommendation for Block Cipher
Modes of Operation: The CMAC Mode for Authentication is used.

  In the wireless system 1 configured as described above, the control information 81 transmitted wirelessly is concealed in the ciphertext by encryption. Simply encrypting the control information 81 does not provide sufficient security. For example, when the on-board wireless station 12 transmits the position information of its own train as the control information 81, if the train is running, the position information changes, so the transmitted ciphertext also changes. If the train is stopped, the position information does not change. At this time, if the same ciphertext is transmitted, a replay attack (Replay Attack) may be performed on the wireless system 1. A replay attack is an attack in which a ciphertext is wiretapped and the ciphertext is reused. For this reason, the same ciphertext is prevented from being generated from the same plaintext by combining a random number called the initialization vector (IV) with the base key and changing the encryption key. Since an initialization vector is required when decrypting the ciphertext, it is necessary to send the initialization vector separately from the ciphertext according to conventional common sense. However, in wireless transmission between the wireless base station 11 and the on-board wireless station 12, it is difficult to wirelessly transmit an initialization vector having a sufficient number of bits due to transmission speed limitations. May be generated.

  On the other hand, in the wireless system 1 of the present embodiment, the initialization vector is not transmitted wirelessly, and the margin of the number of bits generated by not transmitting the initialization vector wirelessly is used to transmit the ciphertext to be transmitted wirelessly. The bit number (size) of the counter value 82 is increased without increasing the bit number (size). By increasing the number of bits of the counter value 82, the cycle in which the counter value makes a round is extended. The same ciphertext is not generated from the same control information 81 within a cycle in which the counter value 82 changes without making a round. The number of bits of the counter value 82 is set so that the same ciphertext is not generated from the same control information 81 when the wireless system 1 is used.

  For example, when a 10-bit initialization vector is used due to transmission speed restrictions, the counter value is 8 bits. When the counter value is incremented by 500 ms, the 8-bit counter value overflows in 2 minutes and 8 seconds and makes a round. In this embodiment, the counter value 82 is set to 18 bits by not wirelessly transmitting the initialization vector. When the counter value 82 is incremented by 500 ms, the 18-bit counter value 82 has a cycle of 36 hours and 24 minutes, exceeds one day, and is sufficiently long for use of the wireless system 1.

  In the wireless system 1, the initialization vector is not transmitted wirelessly, but the initialization vector is generated from the message including the counter value 82 in the above encryption. As shown in FIG. 5, a ciphertext block chaining (CBC) mode is used as an encryption algorithm. The initialization vector CBC-IV is generated using the confidential message 87 including the counter value 82 and the control information 81. The message 87 to be concealed is encrypted using this initialization vector CBC-IV. In the present embodiment, it is assumed that the message 87 to be concealed is x = (M1 || M2 || M3 ... | MN). Here, M1 to MN are, for example, 128-bit messages. The initialization vector CBC-IV is, for example, the lower 128 bits of Hash (M2 || M3 |... | MN || kc3). SHA-256 is used as Hash. kc3 is a key. Using this initialization vector CBC-IV, M1 to MN are encrypted into ciphertexts C1 to CN by the ciphertext block chain mode. Decryption from the ciphertexts C1 to CN to M1 to MN is naturally reversible. By such encryption, the control information 81 and the like are concealed in the ciphertexts C1 to CN. As the counter value 82 changes, the initialization vector CBC-IV changes, and different ciphertexts are generated from the same control information 81. Further, since the message 87 to be concealed is encrypted in the ciphertext block chain mode, the message 87 to be concealed is greatly scrambled by changing the counter value 82, and a small change in the counter value 82 is applied to the entire ciphertext. It reaches.

  The wireless base station 11 and the on-board wireless station 12 wirelessly transmit a telegram for authenticating the counterpart of the wireless transmission, and after authenticating the counterpart, wirelessly transmit the control information 81 as described above. This mutual authentication will be described with reference to FIG. The radio base station 11 has a ground ID (radio base station ID) for identification. The onboard radio station 12 has an onboard ID for identification. Radio transmission is performed between the radio base station 11 having a specific ground ID and the on-board radio station 12 having a specific on-vehicle ID. The on-board radio station 12 generates a random number a having a predetermined number of bits (S101), and transmits the random number a to the radio base station 11 (S102). The radio base station 11 generates a random number b (S103). The radio base station 11 uses the mutual authentication key kc1 and the algorithm E from the plaintext sequence a | b | onboard ID consisting of a random number a, random number b, and onboard ID to encrypt an encrypted message c = E ( kc1, a | b | on-vehicle ID) is generated (S104), and the message c is transmitted to the on-board wireless station 12 (S105). The on-board radio station 12 uses the mutual authentication key kc1 and the algorithm E from the plaintext sequence b | a | terrestrial ID consisting of the random number b, the random number a, and the ground ID to encrypt the encrypted message d = E (kc1 , B | a | ground ID) (S106), and the message d is transmitted to the on-board radio station 12 (S107). The radio base station 11 decrypts the message d, and authenticates the on-board radio station 12 as the other party by matching the ground ID in the decrypted message with the ground ID of the local station (S108). The on-board radio station 12 decrypts the message c, and authenticates the counterpart radio base station 11 by matching the on-board ID in the decrypted message with the on-board ID of the local station (S109). Such mutual authentication by the radio base station 11 and the on-board radio station 12 is performed, for example, when the radio of the on-board radio station 12 is activated.

  The mutual authentication key kc1 is used to generate the messages c and d for authenticating the counterpart of wireless transmission. For the generation of the authentication tag 86, the authentication communication key kc2 is used. The encryption of the control information 81 uses the secret communication key kc3. These mutual authentication key kc 1, authentication communication key kc 2, and secret communication key kc 3 are generated from one temporary key Kc and shared by the radio base station 11 and the on-board radio station 12. For example, the temporary key Kc is designated as the mutual authentication key kc1, the authentication communication key kc2, and the secret communication key kc3 for each predetermined number of bits from the most significant bit (MSB), and the remaining bits are discarded. Generation of the mutual authentication key kc1, the authentication communication key kc2, and the secret communication key kc3 from the temporary key Kc is not limited to this.

  The temporary key Kc is a random number db or dm generated by the radio base station 11 and the on-board radio station 12 and transmitted to the other party, and a pre-shared key shared in advance between the radio base station 11 and the on-board radio station 12. K and a predetermined key derivation function KDF. Generation of the temporary key Kc and the like will be described with reference to FIG. The on-board wireless station 12 generates a random number dm having a predetermined number of bits (S201), and transmits the random number dm to the wireless base station 11 (S202). The radio base station 11 generates a random number db (S203), and transmits the random number db to the on-board radio station 12 (S204). The radio base station 11 generates a temporary key Kc = E (K, dm | db) from the plaintext sequence dm | db made up of the random number dm and the random number db using the pre-shared key K and the key derivation function KDF (S206). ). The radio base station 11 generates a mutual authentication key kc1, an authentication communication key kc2, and a secret communication key kc3 from the temporary key Kc (S206). The on-board radio station 12 generates a temporary key Kc = KDF (K, dm | db) in the same manner as the radio base station 11 (S207). The on-board radio station 12 generates a mutual authentication key kc1, an authentication communication key kc2, and a secret communication key kc3 from the temporary key Kc, similarly to the radio base station 11 (S208).

  The pre-shared key K is shared between the radio base station 11 and the on-board radio station 12 by a predetermined method before the operation of the train 5 starts. The key derivation function KDF is, for example, an algorithm standardized by ISO / IEC18033-2.

  As shown in FIG. 8, a plurality of radio base stations 11a, 11b, and 11c are installed along the track on which the train is operated. The area 111a in which the radio base station 11a performs radio transmission, the area 111b in which the radio base station 11b performs radio transmission, and the area 111c in which the radio base station 11c performs radio transmission are adjacent to each other in this order. When the train 5 moves from the area 111a to the area 111b, a wireless transmission handover is performed. When the radio transmission with the on-board radio station 12 is handed over from one radio base station 11a to another radio base station 11b as the train 5 moves, the authentication communication key kc2 and the secret communication key kc3 are The wireless base station 11a is delivered to the wireless base station 11b. Delivery of the authentication communication key kc2 and the secret communication key kc3 is performed via the ground side network 6 (see FIG. 1). Here, another radio base station 11b is a radio base station 11b adjacent to the radio base station 11a when the handover is normally performed (see FIG. 8). The same applies to the handover from the radio base station 11b to the radio base station 11c.

  In addition, when the handover from the radio base station 11a to the adjacent radio base station 11b fails, the areas 111a and 111c are extended, and the handover from the radio base station 11a to the non-adjacent radio base station 11c may be performed. is there. When the radio transmission with the on-board radio station 12 is handed over from the radio base station 11a to the radio base station 11c, the authentication communication key kc2 and the secret communication key kc3 are transferred from the radio base station 11a to the radio base station 11c. Delivered.

  When the radio transmission is handed over, the on-board radio station 12 does not check the counter value 82 because the counter value 82 transmitted from the radio base stations 11a and 11b to the on-board radio station 12 becomes discontinuous. Exception handling is required. In order to prevent a decrease in security due to the counter value 82 not being checked, when the radio transmission is handed over, the radio base station 11 and the on-board radio station 12 obtain the authentication communication key kc2 and the secret communication key kc3. Change using a hash function. The change of the authentication communication key kc2 and the secret communication key kc3 in the radio base station 11 is performed by the radio base station 11a immediately before the handover or by the radio base station 11b immediately after the handover. In this embodiment, the hash function is SHA-256 developed by the National Security Agency (NSA). SHA-256 is applied to the authentication communication key kc2 and the secret communication key kc3, and is truncated to the bit lengths of the authentication communication key kc2 and the secret communication key kc3. Note that the hash function used is not limited to SHA-256. Since the wireless base station 11 and the on-board wireless station 12 use the same predetermined hash function, the changed authentication communication key kc2 and the secret communication key kc3 are shared between the wireless base station 11 and the on-board wireless station 12. Is done.

  When the radio transmission is handed over, the counter value 82 may be taken over from one radio base station 11a to another radio base station 11b. That is, the radio base station 11a passes the counter value 82 immediately before the handover to the radio base station 11b via the ground network. In this case, the counter value 82 transmitted by the radio base stations 11a and 11b is continuous. For this reason, the on-board radio station 12 can check the counter value 82. That is, the exception process of not checking the counter value 82 at the time of handover is unnecessary. Further, when the wireless transmission is handed over, it is not necessary to change the authentication communication key kc2 and the secret communication key kc3.

  When the radio transmission is handed over, the counter value 82 is transferred from one radio base station 11a to another radio base station 11b, and the hash key is used for the authentication communication key kc2 and the secret communication key kc3. May be changed. This increases the frequency of changing the authentication communication key kc2 and the secret communication key kc3.

  In some cases, the same control information 81 should be quickly transmitted to a plurality of trains 5 in a railway network or line section, such as stopping all trains at the same time in the event of an earthquake. In such a case, if the control information is wirelessly transmitted from the wireless base station 11 to the individual trains 5, it is not quick. In the wireless system 1, the time slot 8 for data wirelessly transmitted by the wireless base station 11 includes an individual slot for storing control information 81 for wireless transmission to individual trains 5 and control information 81 for simultaneous transmission to a plurality of trains. And a broadcast slot for receiving. In FIG. 2, the broadcast slot is indicated by hatching. The control information 81 in the broadcast slot is encrypted by adding a counter value 82 for the broadcast slot. The key for the broadcast slot is the same in the plurality of on-board radio stations 12. The counter value 82 for the broadcast slot is synchronized in the plurality of on-board radio stations 12.

  The key for the broadcast slot is transmitted from the radio base station 11 to the on-board radio station 12 using an individual slot. For example, a broadcast slot key Kb independent of the pre-shared key K and the temporary key Kc is wirelessly transmitted from the radio base station 11 to the on-board radio station 12 using the individual slots. The on-board wireless station 12 generates an authentication communication key kb_c2 and a secret communication key kb_c3 for the broadcast slot using the key derivation function KDF from the broadcast slot key Kb (kb_c2 | kb_c3 = KDF (Kb, 0 | 0)).

  As a representative example of train control in the train control system 2, train interval control will be described with reference to FIGS. In addition to the on-board radio station 12 and the on-board control device 51, the train 5 includes a brake device 52, a speed detector 53, and a train position detection device 54. The brake device 52 brakes the train 5. The speed detector 53 includes, for example, a speed generator that detects the rotational speed of the wheel, and detects the speed of the own train 5. The train position detection device, for example, integrates the speed detected by the speed detector 53 over time, and detects the position of the own train 5.

  The on-vehicle control device 51 transmits the position information of the own train 5 detected by the train position detection device 54 to the ground device 3 via the wireless system 1. The ground device 3 transmits the stop limit position information to the subsequent train 5 ′ based on the received position information of the train 5. The on-board control device 51 of the following train 5 ′ stops the train 5 ′ by the stop limit based on the position of the own train 5 ′ detected by the train position detection device 54 and the stop limit position information. When the speed of the own train 5 ′ exceeds the speed check pattern P, the brake device 52 brakes the own train 5 ′. The following train 5 'is braked so as not to exceed the stop limit. In this way, the train interval is controlled by the train itself without using the track circuit.

  As described above, according to the wireless system 1 according to the present embodiment, since the number of bits of the counter value 82 is set so that the same ciphertext is not generated from the same control information 81, wireless transmission between the ground and the vehicle is performed. Security is high. Further, since the number of bits of ciphertext transmitted wirelessly is not increased compared to the case where the initialization vector is wirelessly transmitted, the security can be increased even if the transmission speed of wireless transmission is low.

  An initialization vector is generated using the confidential message 87 including the counter value 82 and the control information 81. Since the confidential message 87 is encrypted using the initialization vector, the counter value 82 is encrypted. Changes, the initialization vector changes, and different ciphertexts are generated from the same control information 81. In addition, since the message 87 to be concealed is encrypted in the ciphertext block chain mode, a small change in the counter value 82 extends to the entire ciphertext and the security of wireless transmission is increased.

  Since the authentication tag 86 for verifying the integrity of the information is added to the control information 81, the wireless system 1 can verify the integrity of the control information 81 transmitted wirelessly.

  Since the wireless base station 11 and the on-board wireless station 12 authenticate the other party and wirelessly transmit the control information 81, the security of wireless transmission is high.

  Since the mutual authentication key kc1, the authentication communication key kc2, and the secret communication key kc3 are generated from one temporary key Kc, the generation process is efficient.

  The temporary key Kc is generated by the random numbers dm and db generated by the radio base station 11 and the on-board radio station 12 and transmitted to the other party, so that the same temporary key Kc is not generated every time.

  When the radio transmission is handed over, the authentication communication key kc2 and the secret communication key kc3 are delivered from one radio base station 11 to another radio base station 11, so that the authentication communication key kc2 and the secret communication key kc3 are used. There is no need to generate the key kc3 at every handover, and the processing in the wireless system 1 is made efficient.

  When the radio transmission is handed over, the authentication communication key kc2 and the secret communication key kc3 are changed, thereby increasing the security of the radio transmission.

  When the radio transmission is handed over, the counter value 82 is continued by transferring the counter value 82 from one radio base station 11 to another radio base station 11. The exception process of not checking is unnecessary, and the process in the on-board radio station 12 is made efficient.

  Since the data time slot 8 wirelessly transmitted by the radio base station has a broadcast slot, the same control information can be transmitted to a plurality of trains 5 at the same time.

  Since the key for the broadcast slot is transmitted from the radio base station 11 to the onboard radio station 12 using the individual slot, the key for the broadcast slot is concealed.

  According to the train control system 2 having the wireless system 1 as described above, the train-based train control can be performed using the train position detection device 54 on the vehicle without using the ground track circuit, The cost of ground equipment is reduced. Moreover, since the security of wireless transmission by the wireless system 1 is high, the safety of train operation is ensured.

  In addition, this invention is not restricted to the structure of said embodiment, A various deformation | transformation is possible in the range which does not change the summary of invention. For example, the train control system 2 is also used for level crossing control, temporary speed limitation, and the like.

DESCRIPTION OF SYMBOLS 1 Radio system 11, 11a, 11b, 11c Radio base station 12 On-board radio station 2 Train control system 3 Ground device 5, 5 'Train 51 On-board controller 54 Train position detector 8 Time slot 81 Control information 82 Counter value 86 Authentication tag 87 Concealed message db Random number dm Random number K Pre-shared key Kc Temporary key kc1 Mutual authentication key kc2 Authentication communication key kc3 Confidential communication key KDF Key derivation function P Speed check pattern

Claims (12)

A radio base station installed on the ground and an on-board radio station mounted on a train, for wirelessly transmitting control information used for train control between the radio base station and the on-board radio station A wireless system,
The wireless base station and the on-board wireless station wirelessly transmit ciphertext encrypted by adding a counter value to the control information for checking the order of wireless transmission,
In the encryption, the initialization vector for changing the key is not transmitted wirelessly, the number of bits of the ciphertext transmitted wirelessly is increased compared with the case where the initialization vector is wirelessly transmitted, and the wireless A wireless system, wherein the number of bits of the counter value is set so that the same ciphertext is not generated from the same control information during use of the system.   In the encryption, an initialization vector is generated using a message to be concealed including the counter value and control information, and the message to be concealed is encrypted by a ciphertext block chain mode using the initialization vector. The wireless system according to claim 1, wherein the wireless system is encrypted.   The wireless system according to claim 1 or 2, wherein an authentication tag for verifying the integrity of the information is added to the control information.   The wireless base station and the on-board wireless station wirelessly transmit a message for authenticating a counterpart of wireless transmission, and after authenticating the counterpart, wirelessly transmit the control information. Wireless system.   The mutual authentication key for generating the message for authenticating the other party of wireless transmission, the authentication communication key for generating the authentication tag, and the secret communication key used for encrypting the control information are one temporary key. The wireless system according to claim 4, wherein the wireless system is shared between the wireless base station and the on-board wireless station.   The temporary key includes a random number generated by the radio base station and the on-board radio station and transmitted to the other party, a pre-shared key shared in advance between the radio base station and the on-board radio station, and a predetermined key. The wireless system according to claim 5, wherein the wireless system is generated from a derived function. A plurality of the radio base stations are installed along the track on which the train is operated,
When the radio transmission with the on-board radio station is handed over from one radio base station to another radio base station as the train moves, the authentication communication key and the secret communication key are the one radio The radio system according to claim 5 or 6, wherein the radio system is delivered from a base station to another radio base station.   The wireless base station according to claim 7, wherein when the wireless transmission is handed over, the wireless base station and the on-board wireless station change the authentication communication key and the secret communication key using a hash function. system.   The radio system according to claim 7 or 8, wherein when the radio transmission is handed over, the counter value is taken over from one radio base station to another radio base station. The radio base station and the on-board radio station wirelessly transmit data in a time-division manner into a plurality of time slots,
The time slot for data wirelessly transmitted by the wireless base station has an individual slot for accommodating the control information wirelessly transmitted to individual trains and a broadcast slot for accommodating control information simultaneously transmitted to a plurality of trains. And
The control information in the broadcast slot is encrypted by adding a counter value for the broadcast slot,
The key for the broadcast slot is the same in the plurality of on-board radio stations,
The radio system according to claim 4, wherein the counter value for the broadcast slot is synchronized in the plurality of on-board radio stations.   The radio system according to claim 10, wherein the key for the broadcast slot is transmitted from the radio base station to the on-board radio station using the individual slot. A train control system comprising a ground device installed on the ground and an on-board control device mounted on a train,
The wireless system according to any one of claims 1 to 11 that transmits and receives control information between the ground device and the on-board control device, and a train position detection device mounted on a train,
The on-board control device transmits the position information of the own train detected by the train position detection device to the ground device via the wireless system,
The ground device transmits the stop limit position information to the following train based on the received train position information,
The on-board control device of the subsequent train generates a speed check pattern for stopping the train by the stop limit based on the position of the own train detected by the train position detection device and the stop limit position information. In addition, when the speed of the own train exceeds the speed check pattern, the train is braked.

Images