JP4850520B2 - In-vehicle device, revocation management device, and revocation management system - Google Patents

Description

  The present invention relates to an apparatus and system for preventing illegal use of copyright-protected content.

  A car navigation system (hereinafter, referred to as a car navigation system) processes map data recorded in a car navigation system and presents traffic information to a driver. As means for recording the map data, products adopting a hard disk drive (hereinafter referred to as HDD) are becoming mainstream. In such an HDD-mounted car navigation system, it is important to prevent illegal copying of content by a user in order to protect the copyright of content such as map data.

  For example, when exchanging the model of a car navigation system, it is desirable for the user to be able to move the content used in the old model to the new model when purchasing a new model of the car navigation system. As a technique for preventing illegal duplication at this time, there is a technique described in Patent Document 1. In these technologies, when the copyright holder prohibits copying of content, the content recorded in the recording area of the old model is deleted after copying the content to the new model.

  In addition to such model exchange, it is desirable that the purchased content can be restored when the device is lost. According to Non-Patent Document 1, the number of vehicle property damage accidents in Japan is millions of cases per year, and the car navigation system is a device that moves at high speed on the road while accessing the HDD, so there is always a risk of damage. When such damage occurs, it is desirable for the user to make the lost content available to other devices based on the backup data. Therefore, Patent Document 2 discloses a technology that enables the use of content in a new model by making it difficult to use content in a lost old model.

  The above technique is based on the premise that each device surely executes a function that restricts copying of content, and is not effective when there is a device that does not follow this premise. Therefore, a technique is used in which a trusted certification authority issues a digital certificate to each device, and when an unauthorized device is found, the certificate issued to the device is invalidated. The revoked certificate is distributed to each device as a message called CRL (CRL: Certificate Revocation List) via the network. It is believed that this would allow unauthorized devices to be removed from the system and reduce illegal duplication.

  However, in general, not all car navigation systems are connected to a network (such as the Internet), and human work is required to distribute information corresponding to CRLs to car navigation systems. For example, manual operations such as inserting a CD on which a CRL is recorded into a car navigation system or downloading a CRL by connecting a mobile phone with a packet communication function are required. In this way, when human work is involved, there is a problem that an unauthorized user who intends illegal copying does not intentionally update the CRL.

  As an improvement measure, a method may be considered in which an expiration date is given to the CRL, and the content cannot be used unless the CRL is regularly updated. However, inconvenience arises when this method is used in a car navigation system that is not connected to a network. For example, if you send a CD with a CRL with an expiration date of December 2005 to the dealer and update the CRL in the car navigation system using this CD, the dealer updated the CRL in November 2005 The user needs to go to the dealer only after about a month to update the CRL.

  As another improvement measure, Patent Document 3 discloses a technique in which both content and CRL are recorded on a recording medium, and the CRL is forcibly read and updated when the recording medium is inserted into a device in order to use the content. Has been. However, this method has a problem that only the CRL at the time of pressing (printing / mass production) the content can be distributed, and the latest invalidation information cannot be distributed.

JP 2003-272285 A JP 2003-234728 A JP 2005-45641 A Japan General Insurance Association: “Actual conditions of traffic accidents as seen in automobile insurance data, April 2003 to March 2004”, pp. 141-148, (2005)

  The problem to be solved is to update a CRL-equivalent information in a device not connected to the network without deteriorating the convenience of the user while maintaining a certain level of up-to-date information.

  In the present invention, in order to periodically update information for invalidating or validating a device (hereinafter referred to as revocation control information), a travel distance, a travel time, etc. calculated from the time when the revocation control information is updated by a CD or the like. The most important feature is that the operation history is treated as an effective condition, and if the effective condition is not satisfied, the content is rejected.

  In order to perform this processing, the in-vehicle device of the present invention includes a revocation control information recording unit that records revocation control information, a driving history recording unit that records the driving history of the vehicle, and an effectiveness for determining the validity of revocation control information. A sex determination unit is provided.

  Here, the revocation control information includes information indicating a list of in-vehicle devices that are invalidated or validated. This means, for example, a list of invalid digital certificates of devices such as the aforementioned CRL. Alternatively, in the key bundle information in which all the encryption keys essential for the operation of the in-vehicle device are collected for all vehicles, the encryption key for a specific in-vehicle device may be invalidated. Further, the expiration date of the information is written in the revocation control information, and the old revocation control information cannot be used continuously. This revocation control information also describes valid conditions for judging the validity of the information, which means relative deadline information calculated from a specific time, such as the travel distance and travel time of the vehicle, for example. To do.

  By using the in-vehicle device of the present invention, it is possible to force the user to update the revocation control information even in a device that is not connected to the network.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

  In the first embodiment, revocation control information is updated when a dealer periodically performs a vehicle inspection or the like. As a result, in-vehicle devices that perform unauthorized operations can be excluded from the system.

  FIG. 1 illustrates a configuration diagram of an in-vehicle device 100 according to the first embodiment. The in-vehicle device 100 includes a vehicle information acquisition unit 101 that acquires vehicle information such as travel time, a revocation control information reception unit 110 that receives revocation control information 210 via a CD, a mobile phone, a dealer maintenance terminal, and the like, and an application A control unit 102 that executes a program, an effectiveness determination unit 120 that determines the effectiveness of an in-vehicle device, a content management unit 130 that performs input / output processing for the in-vehicle HDD, and a driving that records driving history such as travel time The history recording unit 140, the revocation control information recording unit 104 that records revocation control information, the content recording unit 105 that stores content, the terminal ID recording unit 106 that records its own terminal ID, and a CMOS clock or the like A built-in clock (timer) 103 is provided. The vehicle information acquisition unit 101 is connected to a vehicle information source (not shown).

  The hardware of the in-vehicle device 100 is configured as a computer including a CPU, a memory, a storage device, a timer 103, and the like. The revocation control information recording unit 104, the content recording unit 105, and the terminal ID recording unit 106 store each data on a storage device. The vehicle information acquisition unit 101, the control unit 102, the revocation control information reception unit 110, the validity determination unit 120, and the content management unit 130 are realized as programs that are stored in a memory and executed by the CPU.

  FIG. 2 shows the data structure of the revocation control information 210 that is input to the revocation control information receiving unit 110 of the in-vehicle device 100. The revocation control information 210 includes an invalid device list 211 that indicates a list of identifiers that specify invalid in-vehicle devices, an expiration date 212 that indicates the expiration date of the revocation control information 210, and a validity condition 213. In this example, “period” indicates that six months from when the in-vehicle device 100 receives the revocation control information 210 is a valid period. The invalid device list 211 may be a set of digital certificates allocated to invalid in-vehicle devices.

  FIG. 3 shows the data configuration of the operation history recording unit 140 of the in-vehicle device 100. The driving history recording unit 140 records, for each item shown in the item 141, an initial value 142 that is a value at the start of recording, a current value 143 that is a current value, and a difference 144 between the current value 143 and the initial value 142. ing. Note that the current value 143 and the difference 144 are described for convenience of explanation, and these information may not be recorded in actual operation.

  Hereinafter, a description will be given along the flow of processing for updating the revocation control information.

  FIG. 4 is a flowchart showing processing of the revocation control information receiving unit 110 when the revocation control information 210 is received. The revocation control information receiving unit 110 first compares the value of the expiration date 212 described in the revocation control information 210 with the current date and time acquired from the timer 103, and the received revocation control information is within the expiration date. It is determined whether or not there is (step S111). If the expiration date has passed, the process ends. If it is within the expiration date, item names such as “period”, “travel distance”, and “travel time” described in the effective condition 213 are set in the item 141 of the driving history recording unit 140, and the initial value 142 of each row is set. Is initialized with the current value acquired from the vehicle information acquisition unit 101 (step S112). However, the initial value 142 of “period” is the current date and time of this process. Finally, the revocation control information is recorded in the revocation control information recording unit 104 (step S113).

  The above is the processing when revocation control information is received. A process for determining the validity of the in-vehicle device after receiving the revocation control information in this way will be described. The vehicle information acquisition unit 101 periodically acquires the latest vehicle information from the vehicle information source, and updates the current value 143 of the driving history recording unit 140.

  FIG. 5 is a flowchart illustrating the operation of the validity determination unit 120 that is periodically executed in the in-vehicle device 100. The validity determination unit 120 compares the effective condition 213 described in the revocation control information recording unit 104 with the driving history information described in the driving history recording unit 140, and the driving history satisfies the effective condition. It is determined whether or not there is (step S121). If the valid condition is satisfied, the process ends without doing anything. If the validity condition is not satisfied in step S121, the information recorded in the revocation control information recording unit 104 is deleted (step S122). The recording may be changed so as to invalidate the recording of the revocation control information including the deletion.

  The above is the operation of the validity determination unit 120 that is periodically executed. After determining the effectiveness of the in-vehicle device as described above, the content use restriction process will be described next.

  FIG. 6 is a flowchart showing the operation of the content management unit 130 when the application program executed by the control unit 102 accesses the content recorded in the content recording unit 105. When receiving a content access request from the control unit 102, the content management unit 130 first determines whether or not the revocation control information is recorded as a valid record in the revocation control information recording unit 104 (step S131). When the revocation control information is recorded, it is determined whether or not the terminal ID recorded in the terminal ID recording unit 106 is included in the invalid device list 211 in the revocation control information (step S132). If the terminal ID is not included in the invalid device list, the content recorded in the content recording unit 105 is input to the control unit 102 in accordance with an access request from the control unit 102, and the process ends (step S133). In step S131 and step S132, if revocation control information is not recorded, or if the terminal ID is included in the invalid device list, an input / output error is generated in response to the access request from the control unit 102. The process ends (step S134).

  When the revocation control information receiving unit 110 or the validity determining unit 120 performs the determination of S132 and the own device is invalidated, the revocation control information is not recorded in the revocation control information recording unit 104, or the record is deleted or deleted. It may be invalidated.

  The above is the operation of the content management unit 130 in response to a content access request from the control unit 102.

  With the above processing, the revocation control information with an expiration date expires after a certain mileage and travel time, so that the revocation control information Updates can be made.

  In the second embodiment, when the user changes the model of the car navigation system, content use on the old model is restricted and content use on the new model is permitted.

  FIG. 7 is an overall configuration diagram of the revocation management system according to the second embodiment. This system includes a business terminal 500 that transmits a revocation control request 320 such as model change registration, a revocation management device 400 that generates revocation control information 310 based on the revocation control request 320, and the in-vehicle device 100.

  FIG. 8 is a data example of the revocation control request 320 transmitted from the business terminal 500. The revocation control request 320 includes a terminal ID of a model before change (hereinafter referred to as an old model ID) 322 and a terminal ID of a model after change (hereinafter referred to as a new model ID) 321.

  FIG. 9 shows a configuration diagram of the revocation management apparatus 400 that receives the revocation control request 320. The revocation management apparatus 400 includes a revocation control request receiving unit 401 that receives a revocation control request 320, a unique encryption key bundle recording unit 403 that records a unique encryption key bundle to be described later, and a unique encryption key bundle that updates a unique encryption key bundle in accordance with the revocation control request 320. Encryption key bundle update unit 410, disk key recording unit 404 that records a disk key for decrypting recorded data in the in-vehicle HDD, and information obtained by encrypting this disk key with a unique encryption key bundle (hereinafter referred to as a decryption key bundle) And a revocation control information distribution unit 405 that distributes revocation control information 310 including the decryption key bundle to the in-vehicle device 100. The unique encryption key ring means key ring information in which different encryption keys for each in-vehicle device are described for all in-vehicle devices.

  The hardware of the revocation management device 400 is configured as a computer including a CPU, a memory, a storage device, and the like. The unique encryption key ring recording unit 403 and the disc key recording unit 404 store each data on the storage device. The revocation control request receiving unit 401, the revocation control information distribution unit 405, the unique encryption key bundle update unit 410, and the decryption key bundle creation unit 420 are realized as programs that are stored in a memory and executed by the CPU.

  FIG. 10 shows an example of data described in the revocation control information 310 and describes a decryption key bundle 311, an expiration date 312, and a validity condition 313. The decryption key ring 311 may be a list of digital certificates allocated to valid on-vehicle devices. The decryption key bundle 311 will be described at the end of the description of the second embodiment. The expiration date 312 and the validity condition 313 are the same as those in the first embodiment of the present invention.

  FIG. 11 shows a configuration diagram of the in-vehicle device 100 that receives the revocation control information 310, and is the same as the in-vehicle device 100 of the first embodiment except for a part thereof. The difference from the in-vehicle device 100 of the first embodiment is that the terminal ID recording unit 106 is a unique key recording unit 107 and the content management unit 130 is a content decrypting unit 150.

  The second embodiment will be described below along the flow of processing when performing model change registration described in the revocation control request.

  FIG. 12 is a flowchart showing the operation of the unique encryption key ring update unit 410 when the revocation management device 400 receives the revocation control request 320. The unique encryption key bundle update unit 410 first reads the unique encryption key bundle recorded in the unique encryption key bundle recording unit 403 (step S411). Next, the key corresponding to the old model ID specified in the revocation control request 320 is invalidated in the read unique cryptographic key ring (step S412). In other words, the corresponding key on the unique encryption key ring recording unit 403 is deleted. Similarly, the key corresponding to the new model ID specified in the revocation control request 320 is validated (step S413). That is, processing for storing the corresponding key on the unique encryption key ring recording unit 403 is performed. Finally, the unique encryption key bundle modified in step S412 and step S413 is overwritten and recorded in the unique encryption key bundle recording unit 403 (step S414).

  The above is the operation of the unique encryption key ring update unit 410.

  FIG. 13 is a flowchart showing the operation of the decryption key ring creation unit 420. The decryption key bundle creation unit 420 first reads the unique encryption key bundle recorded in the unique encryption key bundle recording unit 403 (step S421). Then, the process of encrypting the disk key using the unique encryption key is repeated for each in-vehicle device to create a decryption key bundle (steps S422 to S425). N in S424 is the number of in-vehicle devices.

  The above is the operation of the decryption key ring creation unit 420. The revocation control information distribution unit 405 creates the revocation control information 310 by assigning the expiration date 312 and the validity condition 313 to the decryption key bundle 311 created in this way, and distributes this to the in-vehicle device 100. The means for distributing the revocation control information 310 may be written in a recording medium such as a CD and distributed to a dealer, or may be distributed using radio waves such as terrestrial waves.

  The operation of the in-vehicle device 100 that receives the revocation control information 310 created and distributed in this way is the same as that of the in-vehicle device 100 of the first embodiment except for the following points.

  FIG. 14 is a flowchart showing the operation of the content decrypting unit 150 in the in-vehicle device 100. The difference from the operation of the content management unit 106 according to the first embodiment is that the decryption key bundle 311 described in the received revocation control information 310, that is, the disk, instead of the process of determining whether or not the own device is invalidated. The key is that the key is decrypted using the unique encryption key recorded in the unique key recording unit 107 (step S152).

  The above is the description of the revocation management system of the second embodiment.

  The unique encryption key bundle shown in FIG. 9 may simply list the encryption keys of the in-vehicle devices. If there is a problem in size when enumerating the encryption keys of all the in-vehicle devices, the encryption key may be expressed in a format as shown in FIG. 15, for example, in order to reduce the size. FIG. 15 shows n × 4 different encryption keys in a matrix of n rows and 4 columns, which is a known encryption key recording method used for copyright protection in DVD. Here, the unique key for each in-vehicle device includes index information (c1, c2, c3, c4) for each column and four encryption keys K (c1, 1), K (c2, 2), K (c3, 3), represented by K (c4, 4). In the case of this method, there are some restrictions on the invalidation of the in-vehicle device, but it is possible to represent a unique key for the fourth power of the in-vehicle device and manage more in-vehicle devices.

  By the above processing, when the user changes the model of the car navigation system, it is difficult to access the HDD on the old model and the HDD on the new model can be accessed. This makes it possible to reduce unauthorized duplication of content.

  Since it is possible to force the user to update the revocation control information even in a device that is not connected to the network, it can be used in all content handling devices including in-vehicle devices.

It is a block diagram of the vehicle-mounted apparatus of Example 1. It is a figure which shows the example of data of the revocation control information of Example 1. FIG. It is a data block diagram of the driving history recording part of Example 1. 6 is a flowchart illustrating a processing procedure of a revocation control information receiving unit according to the first embodiment. It is a flowchart which shows the process sequence of the effectiveness judgment part of Example 1. 6 is a flowchart illustrating a processing procedure of a content management unit according to the first exemplary embodiment. It is a whole block diagram of the revocation management system of Example 2. It is an example of the revocation control request | requirement of Example 2. FIG. It is a block diagram of the revocation management apparatus of Example 2. It is a figure which shows the data structure of the revocation control information of Example 2. It is a block diagram of the vehicle-mounted apparatus of Example 2. FIG. 10 is a flowchart illustrating a processing procedure of a unique encryption key ring update unit according to the second embodiment. It is a flowchart which shows the process sequence of the decoding key ring production part of Example 2. It is a flowchart which shows the process sequence of the content decoding part of Example 2. It is an example of the format of the specific encryption key ring of Example 2, and a decryption key ring.

Explanation of symbols

100: vehicle-mounted device, 104, 108: revocation control information recording unit, 120: validity determination unit, 130: content management unit, 140: driving history recording unit, 150: content decryption unit, 210, 310: revocation control information, 320 : Revocation control request, 400: Revocation management device

Claims (12)

An in-vehicle device installed in a vehicle,
An invalidation control information recording unit in which information indicating an identifier list that identifies an in-vehicle device that has expired and valid conditions related to operation history is stored as invalidation control information;
An operation history recording unit that stores a numerical value of a current operation history with respect to a numerical value of an operation history at the time when the revocation control information is recorded in the revocation control information recording unit;
A content recording unit for recording content;
It is determined whether or not the current operation history satisfies the validity condition of the revocation control information.If the current operation history does not satisfy the validity condition, an validity determination unit that invalidates the recording of the revocation control information;
An in-vehicle apparatus comprising: a content management unit that permits access to the content when the revocation control information is valid in response to the request to access the content. The revocation control information further includes information related to an expiration date of the information, and the in-vehicle device further includes means for invalidating the expiration control information that has passed the expiration date. In-vehicle device. The in-vehicle device according to claim 1, wherein the identifier list is a set of digital certificates allocated to the revoked in-vehicle device. The valid condition is that a travel distance of the vehicle after receiving the revocation control information is less than a certain value, or a travel time of the vehicle after receiving the revocation control information is less than a certain value. The vehicle-mounted device according to claim 1, comprising any one of the above. An in-vehicle device installed in a vehicle,
A revocation control information recording unit in which information indicating a list of valid disk keys encrypted by the unique encryption key and valid conditions regarding the operation history is stored as revocation control information;
An operation history recording unit that stores a numerical value of a current operation history with respect to a numerical value of an operation history at the time when the revocation control information is recorded in the revocation control information recording unit;
A content recording unit for recording content encrypted by the disc key;
It is determined whether or not the current operation history satisfies the validity condition of the revocation control information.If the current operation history does not satisfy the validity condition, an validity determination unit that invalidates the recording of the revocation control information;
A content decryption unit that responds to an access request to the content and decrypts the corresponding encrypted disk key with a unique encryption key held and permits access to the content when the revocation control information is valid An in-vehicle device characterized by comprising: 6. The revocation control information further includes information related to an expiration date of the information, and the in-vehicle device further includes means for invalidating the expiration control information that has passed the expiration date. In-vehicle device. The unique encryption key is an encryption key that is different for each in-vehicle device, and the list of the encrypted effective disk keys is a unique encryption key bundle that is key bundle information describing the unique encryption key with respect to all in-vehicle devices. The in- vehicle device according to claim 5, wherein the in-vehicle device is a list of results obtained by encrypting the disk key using individual encryption keys included in the disk . The valid condition is that a travel distance of the vehicle after receiving the revocation control information is less than a certain value, or a travel time of the vehicle after receiving the revocation control information is less than a certain value. The in-vehicle device according to claim 5, comprising any one of the above. A revocation management device that distributes information about a revoked in-vehicle device,
A revocation control request receiving unit that receives a revocation control request including information indicating an invalid in-vehicle device and information indicating a valid in-vehicle device;
A unique encryption key bundle recording unit for storing a unique encryption key unique to each of the in-vehicle devices;
In accordance with information included in the revocation control request, a unique encryption key bundle update unit that performs the process of validating and invalidating the unique encryption key to update the unique encryption key bundle recording unit;
A decryption key bundle creating unit that creates a decryption key bundle by encrypting a disk key necessary for encrypting content with a valid unique encryption key;
A revocation management apparatus comprising: a revocation control information distribution unit that distributes revocation control information including the decryption key bundle to each of the in-vehicle devices. A revocation management system having a revocation management device that distributes information related to a revoked vehicle-mounted device and a vehicle-mounted device installed in the vehicle,
The revocation management device is:
Means for receiving a revocation control request including information indicating an invalid in-vehicle device and information indicating a valid in-vehicle device;
Storage means for storing a unique encryption key unique to each of the in-vehicle devices;
Means for extracting a valid unique encryption key from among the unique encryption keys in the storage means according to the information included in the revocation control request;
Means for creating a list of encrypted disk keys by encrypting a disk key required for encrypting content with a valid unique encryption key;
Means for delivering revocation control information including information indicating the list of encrypted disk keys and valid conditions related to operation history to each of the in-vehicle devices;
The in-vehicle device is
A revocation control information recording unit in which the revocation control information is stored;
An operation history recording unit that stores a numerical value of a current operation history with respect to a numerical value of an operation history at the time when the revocation control information is recorded in the revocation control information recording unit;
A content recording unit for recording content encrypted by the disc key;
It is determined whether or not the current operation history satisfies the validity condition of the revocation control information.If the current operation history does not satisfy the validity condition, an validity determination unit that invalidates the recording of the revocation control information;
A content decryption unit that responds to an access request to the content and decrypts the corresponding encrypted disk key with a unique encryption key held and permits access to the content when the revocation control information is valid A revocation management system characterized by comprising: The revocation control information further includes information related to an expiration date of the information, and the in-vehicle device further includes means for invalidating the revocation control information that has passed the expiration date. Revocation management system. The valid condition is that a travel distance of the vehicle after receiving the revocation control information is less than a certain value, or a travel time of the vehicle after receiving the revocation control information is less than a certain value. The revocation management system according to claim 10, comprising any one of the above.

Images