JP2019220814A - Password generation device and program - Google Patents

Abstract

To improve the security of a vehicle connected to an external apparatus via radio communication.SOLUTION: A password generating device extracts one or more events occurring at an irregular timing in a vehicle while the vehicle is operating (S410 and S430). The password generating device generates a password by using one or more object signals which are signals irregularly varying and detected in the vehicle every time an event is detected, encrypts the generated password with a public key of an RSA encryption method, and transmits it to a preset sharing object (S440).SELECTED DRAWING: Figure 5

Description

  The present disclosure relates to a security technology of a vehicle connected to an external device via wireless communication.

  In Patent Document 1 below, an ID code transmitted by wireless communication from an electronic key carried by a user of a vehicle is collated by a vehicle side unit, and according to the collation result, the vehicle side unit locks and unlocks a door. A smart entry system for switching control of a state such as a lock is described.

Japanese Patent No. 5257129

  However, as a result of a detailed study by the inventor, in the related art described in Patent Document 1, since the ID code to be used is a fixed value, a malicious person forges the ID code and the door is unlocked. There was a problem that there is a possibility that

  One aspect of the present disclosure is to improve the security of a vehicle connected to an external device via wireless communication.

  One embodiment of the present disclosure is a password generation device, which includes an extraction unit (37: S430), a generation unit (37: S540), an encryption unit (37: S560), a sharing unit (37: S570), Is provided. The extraction unit extracts one or more events that occur at irregular timings in the vehicle during operation of the vehicle. The generation unit generates a password each time an event is extracted by the extraction unit. The encryption unit encrypts the password generated by the generation unit using a public key of the RSA encryption method. The sharing unit transmits the encrypted password encrypted by the encryption unit to a preset sharing target.

  According to such a configuration, a new password is generated at irregular timing, so it is difficult to forge the password. Even if the forgery succeeds, the old password becomes invalid when the next event occurs. Therefore, the security of the protection target using the password can be improved.

  It should be noted that reference numerals in parentheses described in this column and in the claims indicate a correspondence relationship with specific means described in an embodiment described below as one aspect, and the technical scope of the present disclosure will be described. There is no limitation.

FIG. 2 is a block diagram illustrating a configuration of a smart entry system. It is a flowchart of a key side process. It is a flowchart of a locking process. It is a flowchart of an unlocking process. It is a flowchart of a password generation process. It is a flowchart of a generation sharing process. FIG. 9 is an explanatory diagram illustrating an example of a password generation method.

Hereinafter, embodiments of the present disclosure will be described with reference to the drawings.
[1. Constitution]
The smart entry system 1 shown in FIG. 1 includes an electronic key 2 carried by a driver of a vehicle, and an in-vehicle unit 3 mounted on the vehicle. In the smart entry system 1, the in-vehicle unit 3 performs control such as locking and unlocking of the vehicle door and permission of starting the engine by communicating with the electronic key 2.

  In communication between the electronic key 2 and the in-vehicle unit 3, transmission and reception of a password and an encryption key are performed. As the encryption method, an RSA encryption method that performs encryption and decryption using two encryption keys, a public key and a secret key, is used. Hereinafter, the public key is referred to as a first authentication code, and the secret key is referred to as a second authentication code.

  The electronic key 2 stores a first authentication code and an encrypted password obtained by encrypting a password with the first authentication code, and the in-vehicle unit 3 does not encrypt the first authentication code and the second authentication code. A plaintext password, which is a password, is stored.

  When the vehicle door is locked, a first authentication code is transmitted from the electronic key 2 to the in-vehicle unit 3 together with a locking request, and the in-vehicle unit 3 performs simple authentication using the first authentication code. When the vehicle door is unlocked, the first authentication code and the encryption password are transmitted from the electronic key 2 to the on-vehicle unit 3 together with the unlock request, and the on-vehicle unit 3 performs authentication using the encryption password. The in-vehicle unit 3 updates the password as appropriate, and shares the updated password with the electronic key 2.

Hereinafter, the details will be described.
[1-1. Electronic key]
The electronic key 2 includes an input unit 21, a communication unit 22, a memory 23, and a control unit 24.

The input unit 21 includes a lock switch operated when locking the vehicle door, and an unlock switch operated when unlocking the vehicle door.
The communication unit 22 performs short-range wireless communication with the in-vehicle unit 3 via the antenna. Specifically, for example, a communication method having a communication standard based on Bluetooth (registered trademark) may be used. The transmission power of the communication unit 22 is set such that the communication unit 22 can wirelessly communicate with the vehicle-mounted unit 3 within a range of several meters to 100 m in radius.

  The memory 23 stores a first authentication code and an encryption password. However, the first authentication code is stored in a non-rewritable memory such as a ROM, and the encrypted password is stored in a rewritable memory such as a nonvolatile RAM or an EEPROM. Further, at the time of shipment, an encrypted initial password that is encrypted with a first authentication code is stored as an initial value.

  The control unit 24 performs a key-side process. This key-side processing is realized by hardware including a logic circuit and the like. However, part or all of the processing may be realized as processing executed by the microcomputer.

The key-side processing will be described with reference to the flowchart shown in FIG.
The control unit 24 repeatedly executes the key-side processing.
First, in S110, control unit 24 determines whether or not an update request has been received from in-vehicle unit 3 via communication unit 22. When determining that an update request has been received, control unit 24 shifts the processing to S120, and when determined that an update request has not been received, shifts the processing to S130.

In step S120, the control unit 24 updates the encryption password stored in the memory 23 with the encryption password received together with the update request, and ends the process once.
In S130, the control unit 24 determines whether or not the lock switch has been operated on the input unit 21. If the control unit 24 determines that the lock switch has been operated, the process proceeds to S140, and if it determines that the lock switch has not been operated, the process proceeds to S150.

In S140, the control unit 24 transmits a locking request attached with the first authentication code stored in the memory 23 to the in-vehicle unit 3 via the communication unit 22, and temporarily ends the processing.
In S150, the control unit 24 determines whether or not the unlock switch has been operated on the input unit 21. When the control unit 24 determines that the unlock switch has been operated, the process proceeds to S160, and when it determines that the unlock switch has not been operated, the process is temporarily ended.

  In step S160, the control unit 24 transmits an unlock request to which the first authentication code and the encrypted password stored in the memory 23 are attached to the in-vehicle unit 3 via the communication unit 22, and temporarily ends the processing.

[1-2. In-vehicle unit]
As shown in FIG. 1, the on-vehicle unit 3 includes a communication unit 31, an occupant measurement unit 32, a peripheral measurement unit 33, a vehicle measurement unit 34, a door lock drive unit 35, an external connection unit 36, a verification ECU 37 And ECU is an abbreviation of Electronic Control Unit and means an electronic control unit.

The communication unit 31 is configured similarly to the communication unit 22 of the electronic key 2 and performs short-range wireless communication with the electronic key 2 via an antenna.
The occupant measurement unit 32 monitors the state of the driver of the vehicle and acquires a biological signal as a result of the monitoring. Specifically, a signal representing a pulse wave and a change in blood pressure may be acquired as a biological signal using a wearable sensor attached to the driver. Further, image data obtained from an image sensor may be acquired as a biological signal using a camera that images a driver. In this case, the imaging target may use a driver's face, iris, fingerprint, or the like that exhibits characteristics unique to a living body. Further, a signal representing a pupil change, a line-of-sight change, a change in arousal level, or the like obtained by analyzing image data may be acquired as a biological signal. Further, a voice signal representing a driver's voice collected by using a microphone, or a voiceprint obtained by analyzing the voice signal may be acquired as a biological signal.

  The peripheral measuring unit 33 acquires a video signal obtained from a camera mounted on the vehicle and a detection result by the radar sensor as peripheral information. The camera may be installed so as to image a scene outside the vehicle, or may be installed so as to image the inside of the vehicle.

  The vehicle measuring unit 34 acquires a detection signal as a detection result from various sensors provided for detecting the behavior of the vehicle and the driving operation by the driver. The detection signal may include a behavior signal indicating speed, acceleration, yaw rate, engine speed, temperature of cooling water, and the like. Further, the detection signal may include a signal indicating an operation state of the steering, the brake pedal, the accelerator pedal, the direction indicator, the shift lever, and the like. Further, the detection signal may include a signal transmitted and received between ECUs, a signal from a GPS receiver, and the like.

The door lock drive unit 35 drives an actuator that locks or unlocks the door according to an instruction from the verification ECU 37.
The external connection unit 36 communicates with a server on the Internet via an external wireless communication network using a communication method different from that of the communication unit 31. The server provides a service set in advance to the vehicle or the occupant of the vehicle when the communication partner is an authorized user registered in advance.

  The verification ECU 37 includes a microcomputer having a CPU 371 and a semiconductor memory (hereinafter, memory 372) such as a RAM or a ROM. Each function of the verification ECU 37 is realized by the CPU 371 executing a program stored in a non-transitional substantial recording medium. In this example, the memory 372 corresponds to a non-transitional substantial recording medium storing a program. When this program is executed, a method corresponding to the program is executed. Note that the verification ECU 37 may include one microcomputer, or may include a plurality of microcomputers.

  The verification ECU 37 performs at least a password generation process, a locking process, and an unlocking process. The technique for implementing these processes is not limited to software, and some or all of the processes may be implemented using one or more pieces of hardware. For example, when the above processing is implemented by an electronic circuit that is hardware, the electronic circuit may be implemented by a digital circuit, an analog circuit, or a combination thereof. Note that the verification ECU 37 that executes the password generation processing corresponds to a password generation device.

  The memory 372 stores a first authentication code, a second authentication code, and a plaintext password, in addition to a program for realizing the above processing. The first authentication code and the second authentication code are stored in a ROM, and the plaintext password is stored in a rewritable memory such as a nonvolatile RAM or an EEPROM. As the plaintext password, a predetermined initial value is used at the time of shipment. The initial value of the encrypted password stored in the electronic key at the time of shipment is generated based on the initial value of the plaintext password.

[2. processing]
The processing executed by the verification ECU 37 will be described.
[2-1. Locking process]
The locking process executed by the verification ECU 37 will be described with reference to the flowchart shown in FIG. The locking process is repeatedly executed while the vehicle is stopped.

  First, in S210, the verification ECU 37 determines whether a lock request has been received from the electronic key 2 via the communication unit 31. If the verification ECU 37 determines that the lock request has been received, the process proceeds to S220, and if it determines that the lock request has not been received, the process ends once.

In S220, the collation ECU 37 collates the first authentication code received with the lock request with the first authentication code stored in the memory 372.
In S230, the verification ECU 37 determines whether or not the verification has been successful. Specifically, if the received first authentication code and the stored first authentication code match, it is determined to be successful, and if they do not match, it is determined to have failed. If the verification ECU 37 determines that the verification has been successful, the process proceeds to S240. If the verification ECU 37 determines that the verification has failed, the process is temporarily terminated.

In step S240, the verification ECU 37 issues an instruction to lock the door to the door lock driving unit 35, thereby executing the locking of the door and once terminating the process.
[2-2. Unlocking process]
The unlocking process executed by the verification ECU 37 will be described with reference to the flowchart shown in FIG. The unlocking process is repeatedly executed while the vehicle is stopped.

  First, in S310, the verification ECU 37 determines whether or not an unlock request has been received from the electronic key 2 via the communication unit 31. If the verification ECU 37 determines that the unlock request has been received, the process proceeds to S320, and if it determines that the unlock request has not been received, the process ends once.

In S320, the verification ECU 37 collates the first authentication code received with the unlock request with the first authentication code stored in the memory 372.
In S330, the verification ECU 37 determines whether the verification of the first authentication code has been successful. More specifically, if the received first authentication code and the stored first authentication code match, it is determined to be successful, and if they do not match, it is determined to have failed. If the verification ECU 37 determines that the verification is successful, the process proceeds to S340. If the verification ECU 37 determines that the verification is unsuccessful, the process is temporarily terminated.

  In S340, the verification ECU 37 restores the plaintext password by decrypting the encrypted password received together with the unlock request using the second authentication code stored in the memory 372.

In S350, the verification ECU 37 collates the restored plaintext password with the plaintext password stored in the memory 372.
In S360, the verification ECU 37 determines whether or not the verification of the plaintext password has been successful. Specifically, if the restored plaintext password matches the stored plaintext password, it is determined to be successful, and if they do not match, it is determined to be unsuccessful. If the verification ECU 37 determines that the verification is successful, the process proceeds to S370. If the verification ECU 37 determines that the verification is unsuccessful, the process is temporarily terminated.

In step S370, the verification ECU 37 outputs an instruction to unlock the door to the door lock drive unit 35, thereby unlocking the door, and once terminating the process.
[2-3. Password generation process]
The password generation processing executed by the verification ECU 37 will be described with reference to the flowchart of FIG. The verification ECU 37 repeatedly executes the password generation process.

  In S410, the verification ECU 37 determines whether the operating condition is satisfied. The operating condition is to determine whether the vehicle is operating. Specifically, for example, it may be determined that the operating condition is satisfied when the engine speed is equal to or higher than a preset speed threshold. Here, the operation of the vehicle may include a period from when the driver gets on the vehicle to start driving to when the driver gets off to end driving.

If the verification ECU 37 determines that the operating condition is satisfied, the process proceeds to S420, and if it determines that the operating condition is not satisfied, the process is temporarily terminated.
In S420, the verification ECU 37 determines whether the position condition is satisfied. The position condition is to determine whether or not the vehicle is moving. Specifically, for example, every time a password is generated in S440 described below, the base point of the distance is reset to the current position, and it is determined that the moving condition is satisfied when the current position is separated by a predetermined lower limit distance or more. You may. Alternatively, it may be determined that the position condition is satisfied when the vehicle speed is equal to or higher than a preset speed threshold.

If the verification ECU 37 determines that the position condition is satisfied, the process proceeds to S430, and if it determines that the position condition is not satisfied, the process is temporarily terminated.
In S430, the verification ECU 37 determines whether the event condition is satisfied, that is, whether the event has occurred. The event condition is a condition set to extract a random timing that is difficult to predict based on a vehicle-specific event that occurs in the vehicle. Specifically, for example, it may be determined that the event condition is satisfied each time a specific operation by the driver is detected a specific number of times. As the specific operation, an operation of a winker, a shift lever, an accelerator pedal, a brake pedal, steering, or the like can be used. In addition, the mode of operation and the amount of operation may be included in the determination instead of simply determining whether or not the operation has been performed. Further, each time the event condition is satisfied, the specific operation and the specific number of times to be determined may be switched irregularly.

If the verification ECU 37 determines that the event condition is satisfied, the process proceeds to S440, and if it determines that the event condition is not satisfied, the process is temporarily terminated.
In S440, the verification ECU 37 executes a generation and sharing process for generating and sharing a password, and ends the process once.

[2-4. Generation sharing processing]
The generation sharing process executed by the verification ECU 37 in S440 will be described with reference to the flowchart in FIG.

  In S510, the verification ECU 37 obtains the encrypted password from the electronic key 2 present in the vehicle, and decrypts the encrypted password using the second authentication code stored in the memory 372, thereby restoring the plaintext password.

The collation ECU 37 collates the restored plaintext password with the plaintext password stored in the memory 372 in S520.
In S530, the verification ECU 37 determines whether or not the verification of the plaintext password has been successful, similarly to the processing in S360. If the verification ECU 37 determines that the verification has been successful, the process proceeds to S540, and if it determines that the verification has failed, the process ends.

  In S540, the verification ECU 37 generates a new password by digitizing the biological signal acquired from the occupant measurement unit 32. Specifically, for example, when the biological signal is a pulse wave, as shown in FIG. 7, a partial waveform of the pulse wave is cut out, and the signal intensity is converted into a digital value at a predetermined sampling interval. The password is generated by cutting the data string to the length required for the password.

  As a password generation source, numerical image data obtained from the peripheral measurement unit 33 may be used instead of the biological signal obtained from the occupant measurement unit 32. In this case, the method of cutting the length required for the password may be appropriately switched every time the password is generated. Further, a password may be generated by combining a plurality of types of biosignals and data cut out from image data. Furthermore, every time a password is generated, the biological signal and the image data serving as the generation source may be switched at random or randomly combined.

In subsequent S550, the verification ECU 37 updates the plaintext password stored in the memory 372 with the password generated in S540.
In S560, the verification ECU 37 generates an encrypted password by encrypting the updated plaintext password by the RSA encryption method using the first authentication code.

In subsequent S570, the verification ECU 37 transmits the encrypted password to the electronic key 2 via the communication unit 31, and ends the processing.
[3. effect]
According to the first embodiment described in detail above, the following effects can be obtained.

  (3a) The in-vehicle unit 3 generates a new password at an update timing at which it is difficult to predict that all of the operating condition, the position condition, and the event condition are satisfied, using a biosignal which is difficult to predict and forge, as a generation source, This is shared with the electronic key 2. For this reason, it is possible to improve the security of the vehicle to be protected by the authentication using the password.

  (3b) In the on-vehicle unit 3, the location where the password is generated and shared is spatially separated from the boarding and dismounting locations where the password is used by including the position condition when extracting the update timing. Moreover, the authentication at the time of locking is simply performed using only the first authentication code, and the encrypted password is used only at the time of authentication at the time of unlocking. For this reason, even if the communication between the electronic key 2 and the vehicle-mounted unit 3 performed at the time of locking and unlocking is intercepted, the communication does not include the encryption password, and the password may be analyzed by eavesdropping. Properties can be suppressed.

  (3c) In the in-vehicle unit 3, the password is repeatedly updated and the password is disposable one after another. Therefore, even if the password is decrypted, the decrypted password is immediately invalidated. Thereby, the security of the vehicle can be further improved. In addition, since the eavesdropping is difficult and the range of the effect even if decrypted is small, the number of digits of the first authentication code and the second authentication code can be reduced, and the processing load required for encryption and decryption can be reduced. Can be reduced.

  (3d) In the smart entry system 1, since the in-vehicle unit 3 generates and verifies the password, there is no need to separately provide an external server for generating and verifying the password. Therefore, there is no need to communicate with the external server, and the electronic key 2 can be verified even in a place where communication with the external server is not possible.

[4. Other Embodiments]
Although the embodiments of the present disclosure have been described above, the present disclosure is not limited to the above embodiments, and can be implemented with various modifications.

  (4a) In the above embodiment, the electronic key 2 is used for locking and unlocking the vehicle door, but the present disclosure is not limited to this. For example, the light may be turned on when the verification is successful. When the distance between the electronic key 2 and the vehicle can be detected, the door may be locked without receiving a lock request from the electronic key 2.

  (4b) In the above embodiment, the case where the password is shared with the electronic key 2 has been described, but the present disclosure is not limited to this. For example, the password may be shared with a server on the Internet connected via the external connection unit 36. In this case, a so-called cloud service provided by the server can be used safely using an authentication function using a password.

  (4c) A plurality of functions of one component in the above embodiment may be realized by a plurality of components, or one function of one component may be realized by a plurality of components. . Also, a plurality of functions of a plurality of components may be realized by one component, or one function realized by a plurality of components may be realized by one component. Further, a part of the configuration of the above embodiment may be omitted. Further, at least a part of the configuration of the above-described embodiment may be added to or replaced with the configuration of another above-described embodiment. It should be noted that all aspects included in the technical idea specified by the language described in the claims are embodiments of the present disclosure.

  (4d) In addition to the password generation device realized by the above-described verification ECU 37, a system including the password generation device as a component, a program for causing a computer to function as the password generation device, a semiconductor memory storing the program, and the like. The present disclosure can be realized in various forms such as a non-transitional substance recording medium and a password generation method.

  DESCRIPTION OF SYMBOLS 1 ... Smart entry system, 2 ... Electronic key, 3 ... In-vehicle unit, 21 ... Input part, 22,31 ... Communication part, 23,372 ... Memory, 24 ... Control part, 32 ... Crew member measurement part, 33 ... Peripheral measurement part , 34: vehicle measurement unit, 35: door lock drive unit, 36: external connection unit, 37: verification ECU, 371: CPU.

Claims (10)

An extracting unit (37: S430) configured to extract one or more events that occur at irregular timings in the vehicle during operation of the vehicle;
A generation unit (37: S540) configured to generate a password each time the event is extracted by the extraction unit;
An encryption unit (37: S560) configured to encrypt the password generated by the generation unit using a public key of an RSA encryption method;
A sharing unit (37: S570) configured to transmit the encrypted password encrypted by the encryption unit to a preset sharing target;
A password generation device comprising: The password generation device according to claim 1, wherein
A movement determining unit (37: S420) configured to determine whether the vehicle is moving;
The password generation device, wherein the extraction unit is configured to extract the event when the movement determination unit determines that the vehicle is moving. The password generation device according to claim 2, wherein
The password generation device, wherein the extraction unit sets one of the events that a driving operation performed by the occupant satisfies a preset event condition. The password generation device according to any one of claims 1 to 3, wherein
The password generation device, wherein the generation unit is configured to generate a password using one or more target signals that are irregularly changing signals detected in the vehicle. The password generation device according to claim 4, wherein
The password generation device, wherein the generation unit uses, as one of the target signals, a biological signal obtained from a sensor that monitors a state of the occupant. The password generation device according to claim 4 or 5, wherein:
The password generation device, wherein the generation unit uses, as one of the target signals, a behavior signal acquired from a sensor that detects a behavior of the vehicle. The password generation device according to any one of claims 4 to 6, wherein
The password generation device, wherein the generation unit uses a video signal obtained from a camera mounted on the vehicle as one of the target signals. The password generation device according to any one of claims 1 to 7, wherein
The password generation device is an electronic key of the smart entry system. The password generation device according to any one of claims 1 to 7, wherein
The password generation device is a server that provides a service to the vehicle or an occupant of the vehicle via a wireless communication network. A first step (S430) of extracting one or more events that occur at irregular timings in the vehicle during operation of the vehicle;
A second step (S540) of generating a password using one or more target signals, which are irregularly changing signals detected in the vehicle, each time the event is extracted in the first step (S540). When,
A third step (S560) of encrypting the password generated in the second step using a public key of an RSA encryption method;
A fourth step (S570) of transmitting the encrypted password encrypted in the third step to a preset sharing target;
A program for causing a computer to execute.

Images