JP5384767B1 - Communication device - Google Patents

Abstract

The storage unit 18 manages a common key table to be formed by combining a plurality of partial common key tables including a plurality of common keys. The security processing unit 15 executes security processing on the data by using any one of the common key tables managed in the storage unit 18. The MAC frame processing unit 14, the modulation / demodulation unit 13, and the RF unit 12 transmit data subjected to security processing. The key update unit 153 updates the common key table by adding a new partial common key table to the common key table.
[Selection] Figure 8

Description

  The present invention relates to a communication technique, and more particularly to a communication apparatus that executes security processing using a common key cryptosystem.

  The form of wireless communication for automobiles is roughly classified into road-to-vehicle communication and vehicle-to-vehicle communication (including road-to-vehicle communication). Both types of communication can be used for preventing collisions at intersections and rear-end collisions due to traffic jams at corners. For example, the current position information is detected in real time by GPS (Global Positioning System) in vehicle-to-vehicle communication, and the position information is exchanged between the vehicle-mounted devices, thereby preventing collision at an intersection. In road-to-vehicle communication, a roadside machine is installed at an intersection or on the roadside, and the driving support information as described above is transmitted from the roadside machine to the vehicle-mounted device. Compared with wired communication, wireless communication is easier to intercept by communication and impersonation by third party impersonation. Therefore, countermeasures against them are more important than wireless communication.

JP 2007-104310 A JP-A-8-331075 JP 2005-202913 A

  In road-to-vehicle communication and vehicle-to-vehicle communication that require emphasis on real-time performance, it is effective to adopt a common key encryption method. However, if road-to-vehicle communication and vehicle-to-vehicle communication are operated with the same common key, the security of both road-to-vehicle communication and vehicle-to-vehicle communication is broken if the key is leaked.

  The present invention has been made in view of such circumstances, and an object thereof is to provide a technique for efficiently improving the security of a communication system using a common key encryption method.

  In order to solve the above problems, a communication apparatus according to an aspect of the present invention includes a management unit that manages a common key table to be formed by combining a plurality of partial common key tables including a plurality of common keys; A communication unit that executes security processing for data by using any one of the common key tables managed by the management unit, and communication that transmits or receives data subjected to security processing by the processing unit A part. The management unit updates the common key table by adding a new partial common key table to the common key table.

  It should be noted that any combination of the above-described constituent elements and a conversion of the expression of the present invention between a method, an apparatus, a system, a recording medium, a computer program, etc. are also effective as an aspect of the present invention.

  ADVANTAGE OF THE INVENTION According to this invention, the security of the communication system using a common key encryption system can be improved efficiently.

It is a figure which shows the structure of the communication system which concerns on Example 1 of this invention. FIGS. 2A to 2D are diagrams showing a superframe format defined in the communication system. FIGS. 3A to 3B are diagrams illustrating the configuration of subframes. FIGS. 4A to 4F are diagrams illustrating frame formats of each layer defined in the communication system. FIGS. 5A and 5B are diagrams illustrating an example of the data structure of the security frame. It is a figure which shows another example of the data structure of a security frame. It is a figure which shows the structure of a base station apparatus. It is a figure which shows the structure of the terminal device mounted in the vehicle. It is a figure for demonstrating the normal message transmission / reception procedure in the road-vehicle communication using the communication system which concerns on a present Example. It is a figure for demonstrating the update procedure of the road-vehicle master key in the road-vehicle communication using the communication system which concerns on a present Example. It is a figure for demonstrating the normal message transmission / reception procedure in the vehicle-to-vehicle communication using the communication system which concerns on a present Example. 12A and 12B are diagrams showing the format of the common key table. It is a figure which shows an example of the operation method of a common key table. FIGS. 14A to 14B are diagrams showing still another example of the data structure of the security frame. It is a figure which shows an example of the data structure of the security frame contained in the vehicle-to-vehicle communication packet signal which concerns on Example 2 of this invention. It is a figure which shows an example of the data structure of a message format. It is a figure which shows an example of the data structure of the security frame contained in the road-vehicle communication packet signal. It is a figure which shows an example of the data structure of a frame authentication list. It is a figure which shows the example of a process of the road-vehicle communication packet in a terminal device. It is a figure which shows the structure of a base station apparatus. It is a figure which shows the structure of the terminal device mounted in the vehicle. It is a figure which shows the structural example of a verification part. It is a flowchart which shows the reception process of the RSU packet which concerns on a structural example. It is a flowchart which shows the RSU verification process of the RSU packet which concerns on a structural example. It is a flowchart which shows the MAC verification process of the RSU packet which concerns on a structural example. It is a figure which shows an example of the data structure of the security frame contained in a vehicle-to-vehicle communication packet signal. It is a figure which shows an example of the data structure of the security frame contained in the road-vehicle communication packet signal. It is a figure which shows the structural example of a verification part. It is a flowchart which shows the reception process of the RSU packet which concerns on a structural example. It is a flowchart which shows the RSU verification process of the RSU packet which concerns on a structural example. It is a flowchart which shows the MAC verification process of the RSU packet which concerns on a structural example. 32 (a)-(b) is a diagram illustrating a layer configuration defined in the base station apparatus of FIG. FIGS. 33A to 33E are diagrams showing an outline of processing in each layer of FIG. 34 (a)-(b) are diagrams illustrating the configuration of layers defined in the base station apparatus according to Embodiment 3 of the present invention. 35 (a)-(f) is a diagram showing an outline of processing in each layer of FIG. FIGS. 36A to 36F are diagrams showing an outline of another process in each layer of FIG. FIGS. 37A and 37B are diagrams illustrating an example of the data structure of the security frame included in the road-to-vehicle communication packet signal according to the fourth embodiment of the present invention. It is a figure which shows another example of the data structure of the security frame contained in the road-vehicle communication packet signal which concerns on Example 4 of this invention.

Example 1
The knowledge which became the basis of the Example of this invention is as follows. There is an encryption method as a technique for preventing impersonation and ensuring confidentiality. The encryption methods are roughly classified into public key encryption methods and common key encryption methods. The former has higher security than the latter because there is no need for the sender and receiver to share the key in advance and the key can be set for each sender. However, in the case of the same encryption strength, the former has a larger amount of data than the latter and has a large processing load, resulting in an increase in mounting cost. That is, both are in a trade-off relationship.

  Before describing the present invention in detail, an outline will be described. The embodiment of the present invention is based on road-to-vehicle communication executed to provide information to a terminal device mounted on a vehicle from a base station device installed at an intersection or a roadside, and from a terminal device mounted on the vehicle. The present invention relates to a communication system such as ITS (Intelligent Transport Systems) using inter-vehicle communication executed to provide information to other vehicles.

  In ITS, use of wireless communication similar to a standard such as IEEE 802.11 is under consideration. In such wireless communication, an access control function called CSMA / CA (Carrier Sense Multiple Access with Collision Avidance) is used. Therefore, in the wireless LAN, the same wireless channel is shared by the base station device and the plurality of terminal devices. In such CSMA / CA, after confirming that no other packet signal is transmitted by carrier sense, the packet signal is transmitted by broadcast (hereinafter, transmission of the packet signal by broadcast is referred to as “notification”).

  As inter-vehicle communication, the terminal device reports a packet signal storing vehicle information indicating the speed, position, etc. of the vehicle in which the terminal device is mounted. The terminal device that has received the packet signal recognizes the approach of the vehicle based on the information stored in the packet signal. In addition, as road-to-vehicle communication, the base station device broadcasts a packet signal in which intersection information, traffic jam information, and the like are stored.

  The intersection information includes information on the situation of the intersection such as the position information of the intersection, route information of the intersection where the base station device is installed, a photographed image, and position information of vehicles and pedestrians in the intersection. The terminal device displays this intersection information on the monitor. It is also possible to recognize the situation of the intersection based on this intersection information and notify the user of visual information or a voice message for the purpose of preventing collisions with vehicles, bicycles, and pedestrians due to encounters, right turns, and left turns. . The traffic jam information includes information related to the congestion status of the runway where the base station device is installed, road construction, and accidents. The terminal device transmits the traffic jam in the traveling direction to the user based on the traffic jam information. Further, a detour for detouring the traffic jam may be presented.

  FIG. 1 shows a configuration of a communication system 500 according to an embodiment of the present invention. This corresponds to a case where one intersection is viewed from above. The communication system 500 includes a base station device 20, a terminal device 10a mounted on the first vehicle 100a, and a terminal device 10b mounted on the second vehicle 100b. Area 202 indicates the radio wave range of the base station device 20, and outside area 204 indicates the radio wave range of the base station device 20. The upper side of the drawing corresponds to “north”, the first vehicle 100a proceeds from “south” to “north”, and the second vehicle 100b proceeds from “east” to “west”. The base station device 20 can communicate with an external device via the external network 200.

  2A to 2D show a superframe format defined in the communication system 500. FIG. FIG. 2A shows the structure of the super frame. The superframe is formed by N subframes indicated as the first subframe to the Nth subframe. For example, when the length of the superframe is 100 msec and N is 8, a subframe having a length of 12.5 msec is defined. N may be other than 8.

  FIG. 2B shows a configuration of a super frame generated by the first base station apparatus 20a. The first base station device 20a corresponds to any one of the base station devices 20. The first base station apparatus 20a sets a road and vehicle transmission period at the beginning of the first subframe. Moreover, the 1st base station apparatus 20a sets a vehicle transmission period following a road and vehicle transmission period in a 1st sub-frame. The vehicle transmission period is a period during which the terminal device 10 can notify the packet signal. That is, in the road and vehicle transmission period which is the head period of the first subframe, the first base station device 20a can notify the packet signal, and in the vehicle and vehicle transmission period subsequent to the road and vehicle transmission period of the first subframe, the terminal device 10 is defined to be able to broadcast the packet signal. Furthermore, the first base station apparatus 20a sets only the vehicle transmission period from the second subframe to the Nth subframe.

  FIG.2 (c) shows the structure of the super frame produced | generated by the 2nd base station apparatus 20b. The second base station apparatus 20b corresponds to a base station apparatus 20 different from the first base station apparatus 20a. The second base station apparatus 20b sets a road and vehicle transmission period at the beginning of the second subframe. Further, the second base station apparatus 20b sets the vehicle transmission period from the first stage of the road and vehicle transmission period in the second subframe, from the first subframe and the third subframe to the Nth subframe.

  FIG. 2D shows a configuration of a super frame generated by the third base station apparatus 20c. The third base station apparatus 20c corresponds to a base station apparatus 20 different from the first base station apparatus 20a and the second base station apparatus 20b. The third base station apparatus 20c sets a road and vehicle transmission period at the beginning of the third subframe. Also, the third base station apparatus 20c sets the vehicle transmission period from the latter stage of the road and vehicle transmission period in the third subframe, the first subframe, the second subframe, and the fourth subframe to the Nth subframe. In this way, the plurality of base station apparatuses 20 select different subframes, and set the road and vehicle transmission period at the beginning of the selected subframe.

  FIGS. 3A to 3B show subframe configurations. As shown to Fig.3 (a), a sub-frame is comprised in order of the road vehicle transmission period and the vehicle transmission period. In the road and vehicle transmission period, the base station device 20 can notify the packet signal, and in the vehicle and vehicle transmission period, the terminal device 10 can notify the packet signal. FIG. 3B shows an arrangement of packet signals (hereinafter referred to as RSU (Load Side Unit) packets) during the road-vehicle transmission period. As illustrated, a plurality of RSU packet signals are arranged in the road and vehicle transmission period. Here, the front and rear RSU packet signals are separated by SIFS (Short Interframe Space).

  4A to 4F show the frame formats of the respective layers defined in the communication system 500. FIG. FIG. 4A shows the frame format of the physical layer. As shown in the figure, a PLCP preamble, a PLCP header, a PSDU (Physical Layer Service Data Unit), and a tail are sequentially arranged in the frame. FIG. 4B shows a frame format of the MAC layer. This frame is stored in the PSDU of FIG. As illustrated, a MAC header, an MSDU (MAC Layer Service Data Unit), and an FCS (Frame Check Sequence) are sequentially arranged in the frame. FIG. 4C shows a frame format of the LLC layer. This frame is stored in the MSDU of FIG. As illustrated, an LLC header and an LSDU (LLC Layer Service Data Unit) are sequentially arranged in the frame.

  FIG. 4D shows the frame format of the inter-vehicle / road-vehicle shared communication control information layer. This frame is stored in the LSDU of FIG. As shown in the figure, an IR header and an APDU (Application Protocol Data Unit) are sequentially arranged in the frame. FIG. 4E shows the frame format of the security layer. This frame is stored in the APDU of FIG. As illustrated, a security header (Security Header), a payload (Payload), and a security footer (Security Footer) are sequentially arranged in the frame. FIG. 4F shows the frame format of the application layer. This frame is stored in the SPDU of FIG. 4E and is configured by application data. Hereinafter, the frame format is also referred to as a data structure.

  FIGS. 5A to 5B show an example of the data structure of the security frame. This corresponds to a security frame included in a road-to-vehicle communication packet signal notified from the base station device 20. FIG. 5A shows the security frame of the first RSU packet among the plurality of RSU packets shown in FIG. 3B, and FIG. 5B shows the security frame of the second and subsequent RSU packets. It is. In the data structure of FIG. 5A, “MAC system payload” is arranged after “version message type” and “MAC system header”, and finally “MAC system footer” is arranged. The “MAC scheme header” includes “key information”, “Nonce”, and “payload length”. The “MAC scheme payload” includes “public key certificate”, “hash value for authentication of subsequent packets”. ”,“ Application ”, and“ electronic signature ”. The “MAC system footer” includes “MAC”. Further, “key information” includes “master key ID” and “encrypted communication key”, and “Nonce” includes “device ID” and “random number”.

  “Version / message type” sets the version of the frame format. “Message format” sets two types: an authentication type (AT) that defines a data authentication method and a message type (MT) that specifies a protection format for “payload”. The “master key ID” is identification information for identifying the master key. The “encrypted communication key” is a communication key encrypted with a master key. This communication key generates a random number at the transmission source. “Nonse” is a unique value for each communication used to disturb the result in the encryption process (encryption or MAC generation) using the communication key. Here, “random number” and “device ID” are set. “Device ID” sets a device ID assigned to the terminal device 10 or base station device 20 that is the source of the packet signal. Here, the device ID is an identification number uniquely assigned to the terminal device 10 or the base station device 20.

  “Random number” is set to a random number generated by the transmission source when the packet signal is transmitted. That is, a unique value is set every time a packet signal is transmitted. Here, “random number” is used, but “random date” may be set to “date and time information” that indicates the transmission date and time of the message. In this case, since the date / time information needs to be unique for each transmission of the packet signal, a resolution finer than the period of the super frame is required. However, accuracy is not required. In “payload length”, the number of bytes of “payload” is set.

  The “public key certificate” sets a public key certificate for a public key unique to the transmission source base station apparatus 20. A public key certificate is a certificate that links a public key and the owner of the public key. The public key certificate includes signer identification information, public key certificate identification information (may be a device ID), expiration date, public key (including key generation algorithm, size, etc.), signer signature. Etc. are included. In the present embodiment, the signer is a certificate authority (CA). The signature is generated by a public key cryptosystem such as RSA, DSA (Digital Signature Algorithm), or ECDSA (Electric Curve-DSA). In this embodiment, ECDSA is employed. “Hash value for authentication of subsequent packet” sets a list of hash values for the subsequent security frame, more specifically, “application” of the subsequent security frame. In “Application”, road-to-vehicle application data is set.

  In the “electronic signature”, a signature for “authentication hash value of subsequent packet” and “application data” is set. The signature is a signature generated using a private key that is paired with the public key included in the “public key certificate”. Further, after setting the signature, the MAC value is derived and set to “MAC”. In this example, MAC calculation targets are “Nonce”, “payload length”, and “MAC payload” in the “MAC header”, and encryption targets are “MAC payload” and “MAC footer”. .

  In the data structure of FIG. 5B, “MAC system payload” is arranged after “version message type” and “MAC system header”, and finally “MAC system footer” is arranged. The structures of the “MAC header” and “MAC footer” are the same as those in FIG. In addition, the “MAC scheme payload” includes “certificate digest” and “application data”. In the “certificate digest”, the digest of the public key certificate for the public key unique to the base station apparatus 20 of the transmission source is set. Here, the digest of the body of the public key certificate, that is, a hash value for the signature target part of the public key certificate, for example, a value obtained by SHA-224 and SHA-225, or a part thereof is applied. The signature included in the public key certificate, a part of the signature, the public key, the certificate identification information (for example, serial number), and / or the device ID may be used as a digest. Further, when the device ID is used as a digest, the “digest” may be omitted if the device ID is the same as the device ID set in the “transmission source device ID” (not shown). The MAC value is derived and set to “MAC”. As in FIG. 5A, the MAC calculation targets are “Nonce”, “payload length”, and “MAC payload” in the “MAC header”. The objects of encryption are “MAC payload” and “MAC footer”.

  FIG. 6 shows another example of the data structure of the security frame. This corresponds to a security frame included in the inter-vehicle communication packet signal notified from the terminal device 10. In vehicle-to-vehicle communication, it is impossible to transmit a large-size packet signal compared to road-to-vehicle communication, the total number of packet signals to be notified is large, and the accuracy of information is lower than the information contained in the packet signal for road-to-vehicle transmission For this reason, public key cryptography is not used. Instead, the integrity of information included in the packet signal is authenticated using a MAC (Message Authentication Code) based on a common key cryptosystem. In this data structure, “version”, “message format”, “key ID”, “device ID”, “random number”, and “payload length” are arranged as MAC system headers, and then “MAC system payload” is “ “Device management code” and “Vehicle-to-vehicle application” are arranged, and finally “MAC” is arranged as a MAC payload payload footer.

  The “key ID” is a key ID that is identification information for designating a communication key shared in advance between the terminal device 10 and the base station device 20 or between a certain terminal device 10 and another terminal device 10. Set. “Device ID” sets a device ID assigned to the terminal device 10 that is the source of the packet signal. Here, the device ID is an identification number uniquely assigned to the terminal device 10.

  “Random number” is set to a random number generated by the transmission source when the packet signal is transmitted. That is, a unique value is set every time a packet signal is transmitted. Here, “random number” is used, but “random date” may be set to “date and time information” that indicates the transmission date and time of the message. In this case, since the date / time information needs to be unique for each transmission of the packet signal, a resolution finer than the period of the super frame is required. However, accuracy is not required. In the “payload length”, the number of bytes of the “MAC payload” is set. In the “application”, inter-vehicle application data is set. As in FIG. 5A, the MAC calculation targets are “Nonce”, “payload length”, and “MAC payload” in the “MAC header”, and the encryption target is “MAC payload”. It is a “MAC type footer”. 5A and 5B, the data arranged in advance of the “application” in the security frame of FIG. 6 and the data arranged after the “application” in the “security header” of FIG. This corresponds to the “security footer” in FIG. Hereinafter, the MAC system payload is simply referred to as a payload.

  FIG. 7 shows the configuration of the base station apparatus 20. The base station apparatus 20 includes an antenna 21, an RF unit 22, a modem unit 23, a MAC frame processing unit 24, a security processing unit 25, a data generation unit 26, a network communication unit 27, a storage unit 28, and a control unit 29. The security processing unit 25 includes an encryption / decryption unit 251, an encryption unit 252, and a key update unit 253.

  The configuration of the MAC frame processing unit 24, the security processing unit 25, the data generation unit 26, the network communication unit 27, the storage unit 28, and the control unit 29 can be realized by an arbitrary processor, memory, or other LSI in terms of hardware. In terms of software, it is realized by a program loaded in a memory or the like, but here, functional blocks realized by their cooperation are depicted. Accordingly, those skilled in the art will understand that these functional blocks can be realized in various forms only by hardware, or by a combination of hardware and software.

  The RF unit 22 receives a packet signal from the terminal device 10 and another base station device 20 by the antenna 21 as a reception process. The RF unit 22 performs frequency conversion on the received radio frequency packet signal to generate a baseband packet signal. The RF unit 22 outputs the baseband packet signal to the modem unit 23. In general, since a baseband packet signal is formed by an in-phase component and a quadrature component, two signal lines should be shown. However, in order to simplify the drawing, only one signal line is shown in FIG. Show. The RF unit 22 includes a low noise amplifier (LNA), a mixer, an AGC, an A / D conversion unit, etc. (not shown) as components of the reception system.

  The RF unit 22 transmits the generated packet signal from the base station apparatus 20 as a transmission process. The RF unit 22 performs frequency conversion on the baseband packet signal input from the modem unit 23 to generate a radio frequency packet signal. The RF unit 22 transmits a radio frequency packet signal from the antenna 21 during the RSU period. The RF unit 22 includes a PA (Power Amplifier), a mixer, a D / A converter, and the like (not shown) as components of the transmission system.

  The modem unit 23 demodulates the baseband packet signal from the RF unit 22 as a reception process. The modem unit 23 outputs the MAC frame to the MAC frame processing unit 24 from the demodulated result. Further, the modem unit 23 performs modulation on the MAC frame from the MAC frame processing unit 24 as transmission processing. The modem unit 23 outputs the modulated result to the RF unit 22 as a baseband packet signal.

  The communication system 500 according to the present embodiment employs an OFDM (Orthogonal Frequency Division Multiplexing) modulation scheme. In this case, the modem unit 23 performs FFT (Fast Fourier Transform) as the reception process, and executes IFFT (Inverse Fast Fourier Transform) as the transmission process.

  The MAC frame processing unit 24 extracts a security frame from the MAC frame from the modulation / demodulation unit 23 and outputs it to the security processing unit 25 as a reception process. The MAC frame processing unit 24 adds a MAC header, an LLC header, and an IR information header to the security frame from the security processing unit 25 as a transmission process, generates a MAC frame, and outputs the MAC frame to the modulation / demodulation unit 23. . Further, the packet signal transmission / reception timing is controlled so that packet signals from other base station apparatuses 20 or terminal apparatuses 10 do not collide.

  The network communication unit 27 is connected to the external network 200. The network communication unit 27 receives road information related to construction and traffic jams from the external network 200. Further, the network communication unit 27 receives a master key for road-to-vehicle communication (hereinafter referred to as a road-to-vehicle master key), an encrypted update key table, and a table update key. Further, the network communication unit 27 outputs the processing result by the security processing unit 25 to the external network 200, accumulates it in the storage unit 28, and periodically outputs it to the external network 200.

  The storage unit 28 stores various information (for example, a road-to-vehicle master key, a common key table, and a table update key). Here, the common key table is formed by combining a plurality of partial common key tables. The partial common key table includes a plurality of common keys. In the present embodiment, road information acquired from the external network 200, a new road-to-vehicle master key, an encrypted update key table and a table update key, and a device ID and a common key table ID provided from the terminal device 10 (hereinafter referred to as appropriate) Table ID) is temporarily stored. The control unit 29 controls processing of the entire base station apparatus 20. The data generation unit 26 generates service application data using information from a sensor, a camera (not shown) or the like, or information stored in the storage unit 28. Then, the message format is designated according to the contents of the service application data, and the generated application data and its data length are output to the security processing unit 25.

  The security processing unit 25 generates or interprets a security frame. When the security processing unit 25 receives the service application data from the data generation unit 26 as the transmission process, the security processing unit 25 outputs the security frame to be output to the MAC frame processing unit 24 and the data stored in the received service application data and the storage unit 28. Generate based on For example, the service application data received from the data generation unit 26 is set in the “road vehicle application” of the “MAC system payload” shown in FIGS. 5A to 5B, and the data length is set to the payload length of the security header. set. Also, a hash for the “road vehicle application” of the “MAC system payload” shown in FIG. 5B is calculated and set in the “hash list for authentication of subsequent packets” of the “MAC system payload” shown in FIG. To do. Also, a signature for “authentication hash list of subsequent packet” of “MAC system payload” and “application” is calculated and set to “electronic signature” of “MAC system payload”. In addition, “the communication key (random number) encrypted with the master key is set in the communication key of the security header key information. Also, the message authentication code (MAC) generated using the communication key (random number) is set. “Set in the security footer. Then, a security frame is generated by adding other security headers. After that, if the specified message format is encrypted data with authentication, the payload and message authentication code (MAC) are communicated. It is also possible to keep the message secret by encrypting it using a key (random number).

  The security processing unit 25 receives a security frame from the MAC frame processing unit 24 as a reception process. The security processing unit 25 confirms the contents of the security header in the security frame. If the message type is data with authentication, the encryption / decryption unit 251 executes message verification processing. When the message type is encrypted data with authentication, the encryption / decryption unit 251 executes message decryption processing and performs verification processing. If the message type is plain text, these processes are omitted.

  The security processing unit 25 includes an encryption / decryption unit 251, an encryption unit 252, and a key update unit 253. Here, in order to pay attention to packet transmission from the base station apparatus 20, attention is paid to processing for generating a security frame executed as transmission processing. The process of interpreting the security frame performed as the reception process is the same as the reception process of the terminal device 10 described later. The encryption / decryption unit 251 generates a message authentication code (MAC) for the payload using the communication key. The message authentication code (MAC) is generated by applying a MAC algorithm using an AES (Advanced Encryption Standard) -CBC (Cipher Block Chaining) mode. Note that Nonce and payload length are also used for generating the MAC. Next, when the message format is encrypted data with authentication, the payload and security footer are encrypted using the communication key. For encryption, an AES_CTR (CountTeR) mode is applied. In this embodiment, when the message format is encrypted data with authentication, the encryption / decryption unit 251 applies the AES-CCM (Counter with CBC-MAC) mode using a communication key (random number). An authentication code (MAC) is added and the payload and message authentication code (MAC) are encrypted. Note that without applying the AES-CCM mode, after encrypting from the payload, a message authentication code (MAC) may be added, or only encryption may be performed. In addition to the communication key, a nonce and a payload length are used for generating a message authentication code for the payload and for encrypting the payload and the security footer. This is based on CBC-MAC and CCM mode algorithms. By using the Nonce, different message authentication code values and encryption results can be obtained even if the payload and the communication key are the same.

  The encryption unit 252 encrypts a key transmitted from the base station device 20 to the terminal device 10. Specifically, the communication key (random number) used in the encryption / decryption unit 251 is encrypted with the road-vehicle master key. The encryption unit 252 encrypts the new master key with the current master key when updating the master key used in road-to-vehicle communication. The encryption unit 252 encrypts the new table update key with the current table update key when updating the common key table used in the vehicle-to-vehicle communication. The key update unit 253 performs a road-to-vehicle master key update process. Further, the common key table to be held by the terminal device 10 is updated.

  FIG. 8 shows a configuration of the terminal device 10 mounted on the vehicle 100. The terminal device 10 includes an antenna 11, an RF unit 12, a modem unit 13, a MAC frame processing unit 14, a security processing unit 15, a reception processing unit 161, a notification unit 162, a data generation unit 17, a storage unit 18, and a control unit 19. . The security processing unit 15 includes an encryption / decryption unit 151, a decryption unit 152, and a key update unit 153.

  The configuration of the MAC frame processing unit 14, the security processing unit 15, the reception processing unit 161, the notification unit 162, the data generation unit 17, the storage unit 18, and the control unit 19 is arbitrary in terms of hardware, such as an arbitrary processor, memory, and the like. Although it can be realized by an LSI and is realized by a program loaded into a memory in terms of software, here, functional blocks realized by their cooperation are drawn. Accordingly, those skilled in the art will understand that these functional blocks can be realized in various forms only by hardware, or by a combination of hardware and software.

  The antenna 11, the RF unit 12, the modem unit 13, and the MAC frame processing unit 14 are basically the same in configuration and operation as the antenna 21, the RF unit 22, the modem unit 23, and the MAC frame processing unit 24 in FIG. Hereinafter, these components will be described focusing on the differences. The antenna 11, the RF unit 12, the modem unit 13, and the MAC frame processing unit 14 notify a packet signal that stores data subjected to security processing such as addition of a message authentication code and encryption. The antenna 11, the RF unit 12, the modem unit 13, and the MAC frame processing unit 14 receive data that has been subjected to security processing using a common key cryptosystem.

  The reception processing unit 161 is based on the data received from the security processing unit 15 and the vehicle information of the own vehicle received from the data generation unit 17, the risk of collision, the approach of an emergency vehicle such as an ambulance or fire engine, and the road in the traveling direction And estimation of traffic congestion at intersections. Further, if the data is image information, it is processed to be displayed on the notification unit 162.

  The notification unit 162 includes means for notifying a user such as a monitor, a lamp, and a speaker (not shown). In accordance with an instruction from the reception processing unit 161, the driver is notified of the approach of another vehicle (not shown) via the notification means. In addition, traffic information, image information such as intersections, and the like are displayed on the monitor.

  The data generation unit 17 specifies a current position, a traveling direction, a moving speed, and the like of the vehicle 100 on which the terminal device 10 is mounted based on information supplied from a GPS receiver, a gyroscope, a vehicle speed sensor, and the like (not shown). The current position is indicated by latitude / longitude. Since the method for identifying these pieces of information can be realized by a generally known technique, description thereof is omitted here. The data generation unit 17 generates data to be notified to other terminal devices 10 and the base station device 20 based on the specified information, and outputs the generated data (hereinafter referred to as application data) to the security processing unit 15. . Then, the message format is designated according to the contents of the application data, and the generated application data and its data length are output to the security processing unit 15. Further, the specified information is output to the reception processing unit 161 as vehicle information of the own vehicle.

  The storage unit 18 stores various information (for example, a road-to-vehicle master key, a common key table, a table update key). In this embodiment, the road information acquired from the base station device 20, the vehicle information acquired from itself or another terminal device 10, the encrypted new road-to-vehicle master key acquired from the base station device 20, the encryption An update common key table and an encryption table update key are held. As described above, the common key table is formed by combining a plurality of partial common key tables. The partial common key table includes a plurality of common keys in the common key cryptosystem. The control unit 19 controls processing of the entire terminal device 10.

  The security processing unit 15 generates or interprets a security frame. The security processing unit 15 generates a security frame to be output to the MAC frame processing unit 14 based on the data stored in the storage unit 18 as a transmission process. For example, the inter-vehicle application data is set in the “MAC payload” shown in FIG. Also, the key ID of the communication key used for generating the message authentication code (MAC) is set in the “key ID” of the “key information” of the “MAC method header”, and the own device ID and random number are set in the “Nonce” To do. In addition, a message authentication code (MAC) generated using the communication key selected from the common key table by the key ID is set in the security footer. One communication key is arbitrarily selected from one partial common key table held in the storage unit 18. It is assumed that which partial common key table is selected in advance.

  Then, a security frame is generated by adding other security headers. When the message format is encrypted data with authentication, the message is concealed by encrypting the payload and the message authentication code (MAC) using the communication key. If the message type is plain text, these processes are omitted. As described above, the security processing unit 15 executes security processing for data by using any one of the common key tables held in the storage unit 18. The security process in the transmission process is to generate a message authentication code or encrypt it as described above.

  The security processing unit 15 receives a security frame from the MAC frame processing unit 14 as a reception process. The security processing unit 15 confirms the contents of the security header in the security frame. When the message type is data with authentication, the encryption / decryption unit 151 executes message verification processing. When the message format is encrypted data with authentication, the encryption / decryption unit 151 executes message decryption processing and verification processing. If the message format is plain text, these processes are omitted. That is, when the message type is data with authentication or the message format is encrypted data with authentication, when the security processing unit 15 receives the security frame shown in FIGS. The encrypted communication key in the security header is decrypted with the master key and the communication key is extracted. When the security frame shown in FIG. 6 is received, the common key used for the security frame is extracted as a communication key from the common keys held in the storage unit 18 according to the key ID. Then, the reception process opposite to the transmission process of the security process is executed with the extracted communication key. That is, when the message type is data with authentication, a MAC for the “MAC payload” is generated and compared with the value of “MAC”. If they match, the integrity of the message is confirmed. When the message type is encrypted data with authentication, the “MAC system payload” and the “MAC system footer” are decrypted, and the MAC for the compound word “MAC system payload” is generated and compared with the value of “MAC”. . If they match, the integrity of the message is confirmed. Further, in the security frame shown in FIG. 5A, the “electronic signature” is verified. If the verification is successful, the authenticity of the message sender can be confirmed. In the security frame shown in FIG. 5B, the hash of “application” is calculated, and compared with the hash for itself included in the “hash list for authentication of subsequent packets” of the security frame shown in FIG. 5A of the same group. To do. If the signature verification of the security frame shown in FIG. 5A of the same group succeeds and the hash matches, the authenticity of the message sender is confirmed. The security process reception process is a message verification process or a message decryption process.

  The security processing unit 15 includes an encryption / decryption unit 151, a decryption unit 152, and a key update unit 153. The encryption / decryption unit 151 can perform generation and verification of the MAC for the payload, and encryption and decryption for the payload and the message authentication code (MAC). That is, processing according to the message type of the message type of the security header is performed, and a function equivalent to the encryption / decryption unit 251 of the base station apparatus 20 is provided. Therefore, the transmission process is the same as that of the encryption / decryption unit 251 of the base station apparatus 20, and thus the description thereof is omitted. The encryption / decryption unit 151 receives a security frame from the MAC frame processing unit 14 as a reception process. When the message format is encrypted data with authentication, the encryption / decryption unit 151 decrypts the payload and the security footer using the communication key. Then, the message authentication code (MAC) added to the payload is verified. When the message format is encrypted data, the encryption / decryption unit 151 decrypts the payload using the communication key. Note that the decryption and verification are performed by a decryption algorithm corresponding to the encryption algorithm on the transmission side. When the message format is plain text, the encryption / decryption unit 151 does not perform decryption and verification.

  The decryption unit 152 decrypts the communication key (random number) included in the packet signal notified from the base station device 20 with the road-to-vehicle master key. When the master key used in road-to-vehicle communication is updated, the decryption unit 152 decrypts the encrypted new master key included in the packet signal notified from the base station device 20 with the current master key. Further, when the common key table used in the vehicle-to-vehicle communication is updated, the decryption unit 152 decrypts the encryption table update key included in the packet signal notified from the base station apparatus 20 with the current table update key.

  The key update unit 153 performs update processing of the road-to-vehicle master key to be held by itself (the terminal device 10) and update processing of the common key table for vehicle-to-vehicle communication. As described above, the common key table is formed by a plurality of partial common key tables. Here, the number of partial common tables that can be combined to form the common key table is determined in advance. The key update unit 153 updates the common key table by adding a new partial common key table to the common key table.

  Specifically, the key update unit 153 adds a new partial common key table for updating the common key table until the number of connectable partial common key tables is reached. Therefore, the number of common keys included in the common key table increases. On the other hand, after reaching the number of partial common key tables that can be combined, the key updating unit 153 uses the new partial common key table to update the partial common key table already included in the common key table in order to update the common key table. replace. Therefore, the number of common keys included in the common key table is constant. In the key update unit 253, the common key table is similarly updated.

  When the security processing unit 15 does not hold the partial common key table including the common key used as the communication key for generating and encrypting the message authentication code when performing verification and decryption in the storage unit 18, Is output to the key update unit 153. The key update unit 153 notifies the notification unit 162 of that fact. For example, the notification unit 162 displays on the monitor that it does not correspond to the latest common key, or outputs it as sound. Notification may be made by lighting a lamp, displaying an error message, or displaying a message prompting an inquiry. Thus, the driver recognizes that the latest partial common key table is not included in the key table held in the storage unit 18, that is, the current common key does not correspond to the latest common key. Furthermore, since the key ID is also assigned to the master key, if the master key is not held in the storage unit 18, the key update unit 153 notifies that fact. When the peripheral terminal device 10 or the base station device 20 is updated and the key is not shared with the terminal device 10, the driver is notified. If the key update unit 153 does not hold the common key used for generating or encrypting the message authentication code in the storage unit 18, the key update unit 153 requests the base station device 20 or another terminal device 10 to update the common key. To do. This may be done in accordance with an instruction from the driver or automatically.

  FIG. 9 is a diagram for explaining a normal message transmission / reception procedure in road-to-vehicle communication using the communication system 500 according to the present embodiment. The encryption / decryption unit 251 of the base station apparatus 20 generates a random number to be used as a communication key. The encryption / decryption unit 251 adds a message authentication code (MAC) to the plaintext transmission data using the communication key, and encrypts the transmission data with the MAC. At the same time, the encryption unit 252 encrypts the communication key using the road-vehicle master key. For these encryptions, a common key encryption method is used. The security processing unit 25 generates a packet signal that stores the encrypted transmission data and the encrypted communication key. The packet signal is notified to the outside through the antenna 21 from the RF unit 22 via the MAC frame processing unit 24 and the modem unit 23.

  The RF unit 12 of the terminal device 10 receives the packet signal via the antenna 11. The packet signal is passed to the security processing unit 15 through the modem unit 13 and the MAC frame processing unit 14. The decryption unit 152 decrypts the encrypted communication key stored in the packet signal with the road-to-vehicle master key shared with the base station device 20. The encryption / decryption unit 151 decrypts the encrypted transmission data stored in the packet signal with the decrypted communication key, and performs MAC verification. If the decryption and the MAC verification are successful, the encrypted transmission data is restored to plaintext transmission data.

  This message transmission / reception method has the following various merits. First, since the communication key can be dynamically changed, it is not necessary to hold a plurality of communication keys in advance unlike a message transmission / reception method in vehicle-to-vehicle communication described later. Further, since the random number is encrypted as the communication key, the risk of leakage of the road-to-vehicle master key from the communication path is small. As long as the road-to-vehicle master key is not leaked, basically, the system operation management organization and the road-to-vehicle service provider need not do anything. Even if the road-to-vehicle master key leaks, the risk of leaking the communication key is small unless the master key update mechanism is known. Furthermore, the risk of leakage can be reduced by updating the road-vehicle master key by road-vehicle communication. Since the amount of data to be updated is small, the update of the road-to-vehicle master key can be sufficiently handled by the road-to-vehicle communication.

  FIG. 10 is a diagram for explaining a road-to-vehicle master key update procedure in road-to-vehicle communication using the communication system 500 according to the present embodiment. In a device not shown, a new road-to-vehicle master key for update is generated. The new road-to-vehicle master key for update may be generated periodically, or may be generated when a leakage of the road-to-vehicle master key is detected, or both. When receiving the new road-to-vehicle master key, the key update unit 253 of the base station device 20 updates its own road-to-vehicle master key. Specifically, the current road-to-vehicle master key is recorded in the storage unit 28 as the previous road-to-vehicle master key, and the received new road-to-vehicle master key is recorded as the current road-to-vehicle master key.

  Then, control is performed so that the current road-to-vehicle master key (accepted new road-to-vehicle master key) is stored in the packet signal for a certain period after the update. The encryption unit 252 encrypts the current road-to-vehicle master key (accepted new road-to-vehicle master key) using the previous road-to-vehicle master key. For this encryption, a common key encryption method may be used, or a public key encryption method may be used. The new encrypted road-to-vehicle master key is stored in the packet signal and notified.

  When the encrypted road-to-vehicle master key stored in the packet signal is stored, the decrypting unit 152 of the terminal device 10 decrypts it using the current road-to-vehicle master key held by itself. Upon receiving the road-to-vehicle master key decrypted by the decryption unit 152, the key update unit 153 receives the original master key when the received road-to-vehicle master key is newer than the current master key held by itself. It is replaced with a key (the road-to-vehicle master key held in the storage unit 18 is also updated), and this new road-to-vehicle master key is used as an updated road-to-vehicle master key.

  FIG. 11 is a diagram for explaining a normal message transmission / reception procedure in inter-vehicle communication using the communication system 500 according to the present embodiment. The encryption / decryption unit 151 of the terminal device 10 selects a plurality of partial common key tables stored in the common key table, and randomly selects one communication key from the selected partial common key table. The key table in FIG. 11 corresponds to the common key table. Tables 1 and 2 in FIG. 11 correspond to the partial common key table. The encryption / decryption unit 151 generates a MAC for the plaintext transmission data using the communication key, and encrypts the transmission data with the MAC. The security processing unit 15 generates a packet signal that stores the encrypted transmission data and the key ID of the selected communication key. The packet signal is notified to the outside via the antenna 11 from the RF unit 12 via the MAC frame processing unit 14 and the modem unit 13.

  The RF unit 12 of another terminal device 10 receives the packet signal via the antenna 11. The packet signal is passed to the security processing unit 15 through the modem unit 13 and the MAC frame processing unit 14. The encryption / decryption unit 151 reads the communication key specified by the key ID stored in the packet signal from the common key table, decrypts the encrypted transmission data stored in the packet signal with the communication key, and performs MAC verification. To do. If the MAC verification is successful, the encrypted transmission data is restored to plain text transmission data. Such reception processing is also performed in the base station apparatus 20.

  This message transmission / reception method has the following various merits. First, since a communication key is used statically, the amount of data communication can be reduced compared to the above-described message transmission / reception method in road-to-vehicle communication. In addition, by holding a plurality of communication keys, the risk of leakage of communication keys from the communication path can be reduced. If the common key table is leaked, the security degradation can be suppressed by adding a new version of the partial common key table.

  12A to 12B show the format of the common key table. FIG. 12A shows the common key table in the initial state. As shown in the figure, only the table ID = 1 includes K communication keys. A group of K communication keys corresponds to one partial common key table. FIG. 12B shows the updated common key table. As shown, two partial common key tables with table ID = 1 and 2 are included. In the key table, the table ID of the partial common key table used for the transmission process is set in the Current Table ID. In FIG. 12A, the partial common key table with the table ID = 1 is selected, and in FIG. 12B, the common key used as the communication key is selected from the partial common key table with the table ID = 2.

  FIG. 13 shows an example of a common key table operation method. In FIG. 13, it is assumed that the common key table is formed by four partial common key tables. In the initial state (at the time of shipment), the terminal device 10 holds one partial common key table (version = 1, table ID = 1), and current table ID as table ID = 1. The terminal device 10 on the transmission side selects one communication key from the partial common key table (version = 1, table ID = 1) and uses it for MAC generation and encryption. The number of partial common key tables forming the common key table is not limited to four. Further, a plurality of partial common key tables may be held in the terminal device 10 in the initial state (at the time of shipment).

  A new partial common key table (version = 2, table ID = 2) is added to this partial common key table (version = 1, table ID = 1), and the Current Table ID is changed to table ID = 2. The The terminal device 10 on the transmission side selects one communication key from the latest partial common key table (version = 2, table ID = 2) indicated by the Current Table ID, and uses it for MAC generation and encryption. Similarly, a new partial common key table is added in the order of the partial common key table (version = 3, table ID = 3) and the partial common key table (version = 4, table ID = 4).

  When updating the common key table after the four partial common key tables are held in the terminal device 10, the oldest partial common key table (version = 1, table ID = 1) is replaced with a new partial common key table ( Version = 5, table ID = 1) is overwritten (updated). Thereafter, this process is repeated. In FIG. 13, the partial common key table surrounded by a thick line is the latest partial common key table.

  According to the embodiment of the present embodiment, since the common key table is not updated together but updated so as to add the partial common key table, the individuality of the partial common key table can be improved. In addition, since the individuality of the partial common key table is improved, the possibility that the entire common key table leaks can be reduced even if some partial common key tables leak. In addition, since the possibility of the entire common key table leaking is reduced, the security of the communication system can be improved. In addition, since the partial common key table is updated instead of updating the common key table collectively, the amount of data at the time of update can be reduced.

  Also, until the size of the common key table is exceeded, a partial common key table is added, and when the size of the common key table is reached, the partial common key table is replaced, so that the size of the common key table can be limited. Further, when the common key is not stored, the driver is notified to that effect, so that the driver can be prompted to update the common key. When the common key is not stored, the common key is requested to be updated, so that a new common key can be used.

  In the above, it demonstrated based on the Example of this invention. This embodiment is an exemplification, and it will be understood by those skilled in the art that various modifications can be made to the combination of each component and each processing process, and such modifications are also within the scope of the present invention. .

  The security frame included in the packet signal for road-to-vehicle communication notified from the base station device 20 may be configured as follows. FIGS. 14A to 14B show still another example of the data structure of the security frame. 5 (a)-(b) is a modified example, and FIG. 14 (a) is a security frame of the first RSU packet among the plurality of RSU packets shown in FIG. 3 (b). FIG. 14B shows the security frame of the second and subsequent RSU packets, which corresponds to FIG. 5B. A list in which hash values for “applications” of all security frames constituting the group are arranged is set in “frame authentication hash value” of the first RSU packet. The target of the electronic signature is only the “frame authentication hash value”. As a result, it is possible to prevent the verification of the electronic signature with respect to the “hash value for frame authentication” due to the unification of the processing and the loss due to the communication loss of the application data of the leading RSU packet. Can start. In FIG. 5A, “version message”, “MAC scheme header”, “public key certificate”, “hash value for packet authentication”, “electronic signature” arranged prior to application data. “MAC type footer” arranged after the application data in the security header is the security footer. In FIG. 5B, “version message”, “MAC method header”, and “certificate digest” are security headers, and “MAC method footer” arranged after application data is a security footer.

  In some cases, the communication key is selected from the double key table, or it may be sent after being encrypted with the double master key.

(Example 2)
The knowledge which became the basis of the Example of this invention is as follows. In order to ensure the confidentiality of the communication content, a method of performing message authentication using an encryption method for communication data is effective. The encryption methods are roughly classified into a public key encryption method and a common key encryption method. The former is higher in security than the latter, but has a large amount of data and a large processing load, resulting in higher implementation costs. That is, both are in a trade-off relationship. Road-to-vehicle communication is more public than vehicle-to-vehicle communication, so there are more requests to prevent spoofing and data tampering. Therefore, a system for notifying a packet signal storing data with a public key certificate and an electronic signature from the roadside device to the vehicle-mounted device has been studied.

  However, high-speed processing is required to execute verification of public key certificates and electronic signatures included in all packet signals, and it is necessary to install high-speed hardware in the terminal device. Since the public key cryptosystem is used for these verification processes, the amount of calculation increases, the circuit scale increases, and the cost increases. Furthermore, information cannot be obtained at an appropriate timing due to processing delay, and the user cannot enjoy the service at an appropriate timing. The present invention has been made in view of such circumstances, and an object of the present invention is to provide a technique for reducing processing load when receiving a packet signal while improving security.

  Here, as road-to-vehicle communication, the base station apparatus broadcasts a packet signal in which intersection information, traffic jam information, and the like are stored. Note that the “wireless device” may be a base station device or a terminal device.

  Since the configuration of the communication system 500 according to the embodiment of the present invention is the same as that of FIG. 1, the description thereof is omitted here. The format of the super frame defined in the communication system 500 is the same as that shown in FIGS. The base station apparatus 20 sets a road and vehicle transmission period at the beginning of one or more subframes and transmits a packet signal. Here, in order to simplify the description, it is assumed that one base station apparatus 20 transmits a packet signal using one subframe. In FIG. 2B, the other base station device 20 and the terminal device 10 arranged within the radio wave reachable distance of the first base station device 20a do not broadcast the packet signal during this period.

  Thus, the base station apparatus 20 provides a unique notification period in the superframe by monopolizing the road and vehicle transmission period of one subframe in order for the base station apparatus 20 to notify the packet signal (information). Although the number of subframes that can be set in the superframe is limited (eight in this embodiment), if the superframe is selected in consideration of the radio wave arrival distances of the plurality of base station apparatuses 20, the base station apparatus 20 There is no limit to the number of machines installed. Conversely, the base station apparatus 20 is not necessarily installed for all subframes in the superframe.

  The configuration of the subframe is the same as that shown in FIGS. In FIG. 3, one base station apparatus 20 sequentially transmits five RSU packets, that is, RSU packet 1, RSU packet 2, RSU packet 3, RSU packet 4, and RSU packet 5. The format of each layer frame defined in the communication system 500 is the same as that shown in FIGS.

  FIG. 15 shows a detailed configuration example of the frame format of the security layer of the packet signal for inter-vehicle communication transmitted by the terminal device 10. Public key cryptography is used for inter-vehicle communication because large packet signals cannot be transmitted, the total number of packet signals to be notified is large, and the accuracy of information is lower than the information contained in packet signals for road-to-vehicle transmission. Without using the MAC (Message Authentication Code) based on the common key cryptosystem, the integrity of the information included in the packet signal is authenticated. In this data structure, “version”, “message format”, “key ID”, “transmission source device ID”, “random number”, “data length” are arranged as a security header, followed by “payload”, Finally, “MAC” is arranged as a security footer. Here, “” represents a field constituting the security frame.

  “Version” sets the version of the frame format. “Message format” sets two types: an authentication type (AT) that defines a data authentication method and a message type (MT) that specifies a protection format for “payload”. FIG. 16 shows details of the “message format”. The authentication type (AT), which is the first two bits, consists of two 1-bit flag information MAC Flag and SIG Flag. The MAC Flag indicates whether or not the MAC authentication by the common key encryption method is supported, and the SIG Flag indicates whether or not the signature authentication by the public key encryption method is supported. In an inter-vehicle communication packet signal corresponding to only MAC authentication, MAC Flag = 1 and SIG Flag = 0. Any type of message type (AT) can be set. The message type (MT) includes a plain text data format (= 0), a data format with authentication (= 1), and an encrypted data format with authentication (= 2).

  The “key ID” is a key ID that is identification information for designating a communication key shared in advance between the base station apparatus 20 and the terminal apparatus 10 or between a certain terminal apparatus 10 and another terminal apparatus 10. Set. The “transmission source device ID” sets a device ID assigned to the terminal device 10 that is the transmission source of the packet signal. Here, the device ID is an identification number uniquely assigned to the terminal device 10 or the base station device 20.

  “Random number” is set to a random number generated by the transmission source when the packet signal is transmitted. That is, a unique value is set every time a packet signal is transmitted. Here, “random number” is used, but “random date” may be set to “date and time information” that indicates the transmission date and time of the message. In this case, since the date / time information needs to be unique for each transmission of the packet signal, a resolution finer than the period of the super frame is required. However, accuracy is not required.

  As the “data length”, the number of bytes of the “payload” is set. Application data is set in the “payload”. “MAC” is set to the MAC value when the message type (AT) is an authenticated data format (= 1) or an encrypted data format with authentication (= 2).

  Next, an encryption technique for the security frame in FIG. 15 will be described. Here, AES (Advanced Encryption Standard) is adopted as the common key cryptosystem. Specifically, when the data format is an authenticated data format (= 1), CBC-MAC (Cipher Block Chaining-Message Authentication Code) is used, and when the data format is an authenticated encrypted data format (= 2), CCM. (Counter with CBC Mode). Note that CCM is an encryption authentication mode that uses CBC-MAC for message authentication and CTR (CountTeR) mode for data concealment (encryption). In order to simplify the processing, it is assumed that the MAC calculation target and calculation procedure when the data format is the data format with authentication (= 1) conforms to the MAC calculation target and calculation procedure in the CCM.

  The MAC value is obtained using the communication key as the key ID set in the “key ID”. In the CCM CBC-MAC calculation, a nonce, which is a unique value for each communication used for disturbing the encryption result in the encryption using the communication key, is used for the counter block in the CBC-MAC calculation and the Counter mode. In the security frame of FIG. 15, the device ID and the random number set in the “transmission source device ID” and “random number” are concatenated and used as the nonce. This random number is a random number generated at the time of transmission in the terminal device 10 of the transmission source, and uniqueness is guaranteed within the range of the data length of the random number. Note that only a random number may be used as a nonce. The MAC calculation is performed on data obtained by concatenating a nonce and a data length with the head of application data set in the “payload”.

  In this example, MAC operation targets are “device ID”, “random number”, “data length”, and “payload”, and encryption targets are “payload” and “MAC”. As is obvious, the encryption is performed after the MAC value is obtained.

  FIG. 17 shows a detailed configuration example of a security layer frame of a road-vehicle communication packet signal transmitted by the base station apparatus 20. FIG. 17A is a security frame of the RSU packet 1 in FIG. 3, and FIG. 17B is a security frame of the RSU packets 2 to 5 in FIG. That is, the security frame of the first RSU packet in the RSU period follows FIG. 17A, and the security frames of the remaining RSU packets transmitted in the same RSU period follow FIG. 17B.

  In the data structure of FIG. 17A, “version”, “message format”, “key ID”, “source device ID”, “random number”, “data length”, “public key certificate”, “Frame number”, “final frame number”, and “frame authentication list” are arranged, followed by “payload”, and finally “electronic signature” and “MAC” as security footers. Since “version”, “message format”, “key ID”, “source device ID”, “random number”, “payload” and “MAC” are the same as those in the data structure of FIG. However, since this data structure supports both MAC authentication and signature authentication, MAC Flag = 1 and SIG Flag = 1.

  “Data length” is set with the total number of bytes of “public key certificate”, “frame number”, “final frame number”, “frame authentication list”, “payload”, and “electronic signature”. When “public key certificate”, “frame number”, “final frame number”, “frame authentication list”, “payload” and “electronic signature” are regarded as one field, the same data structure as the security frame in FIG. It becomes.

  The “public key certificate” sets a public key certificate for a public key unique to the transmission source base station apparatus 20. A public key certificate is a certificate that binds a public key and an owner of a private key that makes a pair with the public key. The public key certificate includes signer identification information, device ID, expiration date, public key (including key generation algorithm and size), signer signature, and the like. In the present embodiment, the signer is a certificate authority (CA). The signature is generated by a public key cryptosystem such as RSA, DSA (Digital Signature Algorithm), or ECDSA (Elliptic Curve-DSA). In this embodiment, ECDSA is employed.

  The “frame number” sets the order of security frames arranged in the RSU period, that is, the RSU packet order. If the frame number starts from 0, the security frame having the data structure shown in FIG. 17A is a security frame arranged at the head, so 0 is set. The “last frame number” sets the number of the last security frame transmitted in the RSU period, that is, the total number of RSU packets arranged in the RSU period−1. In the case of the security frame of the RSU packet transmitted by the base station apparatus 20 according to FIG. 3, 4 is set. The frame number may be 1 start. In this case, 1 is set in the “frame number” of the security frame having the data structure in FIG. 17A, and the total number of frames in the RSU period is set in the “last frame number”. The “frame authentication list” sets a list of authentication data for subsequent security frame data.

  In “electronic signature”, signatures for “frame number”, “final frame number”, “frame authentication list”, “authentication data list”, and “payload” are set. The signature is a signature generated using a private key that is paired with the public key included in the “public key certificate”. Since the signature target includes a “frame authentication list”, the necessity of signature cannot be determined by the message type (MT) of this security frame. Therefore, when the authentication type (AT) = 1, “electronic signature” ”Is set to the signature. Next, when the message type (MT) is the authenticated data format (= 1) or the encrypted data format with authentication (= 2), the MAC value is obtained after setting the signature and set to “MAC”. To do. Then, encryption is performed. In this example, MAC operation targets are “device ID”, “random number”, “data length”, “frame number”, “final frame number”, “frame authentication list”, “payload”, and “electronic signature”. The encryption targets are “frame number”, “final frame number”, “frame authentication list”, “authentication data list”, “payload”, “electronic signature”, and “MAC”.

  In the data structure of FIG. 17B, “version”, “message format”, “key ID”, “source device ID”, “random number”, “data length”, “digest”, “frame number” are used as security headers. ”And“ final frame number ”are arranged, followed by“ payload ”, and finally“ MAC ”as a security footer. For “version”, “message format”, “key ID”, “source device ID”, “random number”, “frame number”, “final frame number”, “payload”, and “MAC”, FIG. ) Is the same as that of the data structure, so the explanation is omitted.

  In the case of the security frame of the RSU packet transmitted by the base station apparatus 20 according to FIG. 3, “last frame number” is set to 4. The “frame number” of the RSU packet 2 is set to 1. Similarly, “frame numbers” of RSU packet 3, RSU packet 4, and RSU packet 5 are set to 1, 2, 3, and 4, respectively. As the “data length”, the total number of bytes of “digest”, “frame number”, “final frame number”, “payload”, and “electronic signature” is set. When “digest”, “frame number”, “final frame number”, and “payload” are regarded as one field, the data structure is the same as that of the security frame of FIG.

  In the “digest”, a digest of a public key certificate for a public key unique to the transmission source base station apparatus 20 is set. Here, the digest of the body of the public key certificate, that is, a hash value for the signature target part of the public key certificate, for example, a value obtained by SHA-224 and SHA-225, or a part thereof is applied. The signature included in the public key certificate, a part of the signature, the public key and / or the device ID may be used as a digest. Further, when the device ID is used as a digest, the “digest” may be omitted if the device ID is the same as the device ID set in the “transmission source device ID”. In this example, the calculation target of the MAC is “device ID”, “random number”, “data length”, “digest”, “frame number”, “final frame number”, and “payload”, and the encryption target is “frame” "Number", "final frame number", "digest", "payload" and "MAC".

  When one base station apparatus 20 uses a plurality of road and vehicle communication periods, all the security frames of the RSU packet transmitted in the subsequent RSU period may be as shown in FIG. In this case, among the RSU packets transmitted from the base station apparatus 20 to the superframe, the security frame of the first RSU packet conforms to FIG. 17A, and the security frames of the remaining RSU packets all conform to FIG.

  Further, in FIG. 4, the security frame has been described so as to be contained in the RSU packet. However, when the base station apparatus 20 concatenates and transmits a plurality of application data, the security frame may be configured in units of application data. Good. In this case, among the application data transmitted from the base station apparatus 20 to the superframe, the application data transmitted at the head is set in the “payload” of the security frame according to FIG. 17A, and the remaining application data Is set in the “payload” of a different security frame according to FIG. Thereafter, the packet is simply divided and transmitted as an RSU packet.

  FIG. 18 shows a configuration example of a list of authentication data set in the “frame authentication list”. It is a list in which MAC values of subsequent security frames are arranged in the order of frame numbers. The size is (number of bytes of authentication data) × (total number of frames−1). The MAC value to be set is the same as the MAC value set to “MAC” in FIG. A list of hash values may be used instead of the MAC values. In this case, the object of the hash calculation is “frame number”, “final frame number”, and “payload”. The “frame authentication list” is a list in which MAC values of subsequent security frames are arranged in the order of frame numbers, but a digest value by a hash function may be set instead of the MAC value.

  FIG. 19 illustrates a processing example of each RSU core when the terminal device 10 includes four RSU cores (RSU1 core to RSU4 core). In FIG. 16, the vehicle 100 proceeds from “west” to “east”. In the vicinity of the area through which the vehicle 100 passes, there are five roadside devices (first base station device 20a, second base station device 20b, third base station device 20c, fourth base station device 20d, fifth base in FIG. 16). A station device 20e) is installed.

  For convenience of explanation, the first base station apparatus 20a, the second base station apparatus 20b, the third base station apparatus 20c, the fourth base station apparatus 20d, and the fifth base station apparatus 20e transmit RSU packets according to FIG. And Also, the public key certificate verification and signature verification processing of the security frame of the RSU packet 1 are simply referred to as signature verification, and the MAC authentication processing for the security frames of the RSU packets 1 to 5 is referred to as MAC authentication. When the message type (MT) of the security frame of the received RSU packet is the encrypted data format with authentication (= 2), signature verification and MAC verification are executed after decryption.

  In FIG. 19, a period Tv indicates a period during which radio waves from the base station apparatus 20 cannot be received and the RSU core stops processing, a period Tc indicates a period during which signature verification is performed, and a period Tm indicates A period during which MAC verification is performed is shown, and a period Tmc indicates a period during which signature verification and MAC verification are performed in parallel. The period Tv starts when the vehicle 100 newly enters the radio wave range of the first base station device 20a. When entering the radio wave range of the first base station apparatus 20a and receiving the RSU packet 1, the RSU1 core executes signature verification of the RSU packet 1 broadcast from the first base station apparatus 20a. When the signature verification is successful, the period shifts to the period Tm.

  In the period Tm, the RSU1 core performs MAC verification of the received RSU packet and reports the MAC verification result. When the RSU packet 1 is received after a lapse of a certain time after shifting to the period Tm, the period shifts to the period Tmc. In the period Tmc, the signature verification for the RSU packet 1 that triggered the period transition and the MAC verification of the received RSU packet are performed in parallel. Then, the result of the MAC verification is reported. If the signature verification is successful, the period returns to the period Tm again. When the vehicle 100 goes out of the radio range of the first base station device 20a, the period transitions to the period Tv. After that, when the vehicle 100 enters the radio wave range of the fifth base station device 20e and receives the RSU packet 1 from the fifth base station device 20e, the vehicle 100 shifts again to the period Tc, and the RSU packet 1 from the fifth base station device 20e. Perform signature verification for. Subsequent processing is the same as the processing for the first base station apparatus 20a, and thus description thereof is omitted. The core for RSU2 to the core for RSU4 also execute the same processing as the core for RSU1.

  FIG. 20 shows the configuration of the base station apparatus 20. The base station apparatus 20 includes an antenna 21, an RF unit 22, a modem unit 23, a MAC frame processing unit 24, a security processing unit 25, a data generation unit 26, a network communication unit 27, a storage unit 28, and a control unit 29. Since this is the same as FIG. 7, the difference will be mainly described here.

  The network communication unit 27 is connected to the external network 200. The network communication unit 27 receives road information regarding construction and traffic jams from the external network 200.

  Further, the network communication unit 27 outputs the processing result by the security processing unit 25 to the external network 200, accumulates it in the storage unit 28, and periodically outputs it to the external network 200. The data generation unit 26 generates application data. For example, road information is set in application data. Then, the data format is designated according to the contents of the application data, and the generated application data and its data length are output to the security processing unit 25. The storage unit 28 stores various information. The control unit 29 controls processing of the entire base station apparatus 20.

  The security processing unit 25 generates or interprets a security frame. In this embodiment, since attention is paid to packet transmission from the base station apparatus 20, attention is paid to processing for generating a security frame. The security processing unit 25 outputs a security frame to be output to the MAC frame processing unit 24, such as application data received from the data generation unit 26, a secret key received from the certificate authority, a public key certificate, a communication key (common key), and the like. Generate by using.

  The security processing unit 25 includes a signature unit 1251, an encryption unit 1252, and a storage unit 1253. In this embodiment, the storage unit 1253 stores a secret key issued by a certificate authority (not shown), a public key certificate including a public key paired with the secret key, a digest of the public key certificate, a device ID, and a plurality of communication keys. Stored inside. Among these, the private key and the public key certificate are unique to the base station apparatus 20. The signature unit 1251 calculates a hash value for the signature target using a hash function and generates a signature for the signature target using the hash value calculated with the secret key stored in the storage unit 1253. The encryption unit 1252 selects one of the communication keys stored in the storage unit 1253, executes a MAC operation, and obtains a MAC value for the MAC target. The encryption unit 1252 encrypts the encryption target using the communication key used for the MAC operation.

  FIG. 21 shows a configuration of the terminal device 10 mounted on the vehicle 100. The terminal device 10 includes an antenna 11, an RF unit 12, a modem unit 13, a MAC frame processing unit 14, a security processing unit 15, a reception processing unit 161, a notification unit 162, a data generation unit 17, a storage unit 18, and a control unit 19. . Since this is the same as FIG. 8, here, the difference will be mainly described. The data generation unit 17 outputs the specified information to the reception processing unit 161 as vehicle information of the own vehicle. The storage unit 18 stores various information. The control unit 19 controls processing of the entire terminal device 10.

  The security processing unit 15 generates or interprets a security frame. In this embodiment, in order to pay attention to packet reception from the base station apparatus 20, attention is paid to processing for interpreting a security frame stored in the packet signal. The security processing unit 15 includes a verification unit 1151, a decryption unit 1152, and a storage unit 1153. The storage unit 123 stores therein an authentication public key issued by a certificate authority (not shown) in the present embodiment, its own device ID, and a plurality of communication keys. The decryption unit 1152 acquires the communication key specified by the “key ID” of the security frame from the storage unit 1153 and decrypts the encryption target. The verification unit 1151 calculates the hash value using a hash function, and uses the hash value and the public key for authentication stored in the storage unit 1153 to sign the public key certificate and signature of the base station apparatus 20. The MAC verification is performed using the communication key stored in the storage unit 1153 specified by the verification and the “key ID” of the security frame. The authentication key is a public key that is paired with the private key used to generate the signature of the public key certificate in the certificate authority.

  FIG. 22 shows a configuration example of the verification unit 1151. The verification unit 1151 according to the configuration example includes a hash calculation unit 1151a, an ECDSA verification unit 1151b, a digest holding unit 1151c, a MAC verification unit 1151d, and a verification control unit 1151e. In this configuration example, each RSU core includes a digest holding unit 1151c and a verification control unit 1151e.

  The hash calculator 1151a calculates a public key certificate and a hash value for the signature target of the RSU packet 1, that is, a security frame according to FIG. The ECDSA verification unit 1151b verifies the signature included in the public key certificate included in the packet signal broadcast from the base station apparatus 20, using the authentication key (public key) held in the storage unit 1153, and the RSU packet 1 is executed using the public key of the public key certificate included in the RSU packet 1. The authentication key may be incorporated in advance or may be acquired afterwards by a secure means and stored in the storage unit 1153. Specifically, according to the ECDSA verification algorithm, verification is performed using the public key, the hash value obtained by the hash calculation unit 1151a, and the signature. For convenience of explanation, verification of the public key certificate included in the RSU packet 1 and verification of the signature target are collectively referred to as RSU verification. Successful RSU verification (also called approval) means that both verifications have been approved.

  The digest holding unit 1151c holds the public key certificate for which RSU verification is successful and the digest, public key, device ID, and the like of the public key certificate of the security frame for which the signature target has been successfully verified. For convenience of explanation, these pieces of information are collectively referred to as RSU verification information. The digest holding unit 1151c holds RSU verification information for each RSU period (subslot). That is, the RSU verification information is held by the number of RSU cores. Although the hash value of the public key certificate is assumed here as the digest of the public key certificate, the serial number, public key, and / or device ID of the public key certificate may be used as a digest. That is, any information may be used as long as it is information that can identify the owner of the public key certificate or the private key that is paired with the public key certificate from the received security frame. When the serial number of the public key certificate is used, it is necessary to replace the digest of the public key certificate of the security frame with the serial number of the public key certificate. In this way, the amount of data held in the digest holding unit 1151c is reduced. The MAC verification unit 1151d calculates the MAC value for the MAC target of the RSU packets 1 to 5, and compares the MAC value obtained by the calculation with the MAC value set in “MAC” of the security frame to perform the MAC verification. Do. If they match, it will be successful (also called approval), and if they don't match, it will be failed (also called denial). For the MAC verification, a communication key specified by a key ID stored in the storage unit 1153 is used. Here, the description has been given focusing only on reception of road-to-vehicle communication, but the MAC verification unit 1151d is also used for transmission / reception processing of vehicle-to-vehicle communication, that is, MAC verification and MAC generation of the security frame in FIG. Note that MAC verification can be processed at a higher speed than ECDSA verification. Therefore, the MAC verification result and the application data can be provided to the reception processing unit 161 at the same timing.

  If the RSU verification is successful, the RSU packet 1 is an authentic base station device 20 certified by the certificate authority, and the RSU packet 1 is a legitimate packet signal transmitted from the authentic base station device 20. it can. However, since a public key cryptosystem (ECDSA in this embodiment) is used for this RSU signature, the processing load increases if public key certificate verification is performed for all RSU packets 1. Therefore, RSU verification is skipped as appropriate for a certain period.

  In the following, unless otherwise specified, the processing related to the RSU verification information in the digest holding unit 1151c is processing for the RSU verification information corresponding to the RSU period in which the packet signal is received. When the verification control unit 1151e receives the RSU packet 1 broadcast from the base station device 20, the verification control unit 1151e instructs the hash calculation unit 1151a to calculate the digest of the public key certificate included in the RSU packet 1. When the digest is calculated, the verification control unit 1151e compares the calculated digest with the digest held in the digest holding unit 1151c. If they are different, the verification control unit 1151e instructs the ECDSA verification unit 1151b to execute verification of the public key certificate included in the RSU packet 1. When the verification of the public key certificate is successful, the verification control unit 1151e instructs the ECDSA verification unit 1151b to execute the verification of the signature of the RSU packet 1. When signature verification succeeds, that is, when RSU verification succeeds, the verification control unit 1151e updates the RSU verification information held in the digest holding unit 1151c to the RSU verification information of the RSU packet 1 that has been verified. If public key certificate verification fails or signature verification fails (also referred to as RSU verification failure or denial), the process ends. When both digests correspond (more precisely, match), the RSU verification included in the packet signal is skipped. However, after the RSU verification, when a predetermined period elapses, RSU authentication is performed and the validity of the RSU verification information is reconfirmed. That is, for a certain period after RSU verification, it is considered that RSU verification is successful if the digest of the public key certificate matches. However, even if the RSU verification of the RSU packet 1 broadcast from a certain base station apparatus 20 is once successful, it is lost if left as it is, and therefore, RSU verification is performed at regular intervals to improve reliability. Note that the authenticity and correctness of the application data included in the RSU packets 1 and 2 are determined to be approved when both digests match and the MAC verification is successful.

  Next, RUS packet verification will be described. When receiving the RSU packet, the verification control unit 1151e instructs the MAC verification unit 1151d to perform MAC verification of the RSU packet. When the MAC verification is successful (approved), the MAC verification unit 1151d confirms the match between the RSU authenticated digest held in the digest holding unit 1151c and the digest of the public key certificate of the RSU packet. The digest of the public key certificate of the RSU packet is a hash value calculated by the hash calculator 1151a with the public key certificate included in the RSU packet as an input when the RSU packet 1 is used. In the case of RSU packets 2 to 5, the digest is set in the “digest” of the RSU packet. If a digest that matches the digest holding unit 1151c is held, the MAC verification unit 1151d determines that the RSU packet has been successfully verified, and notifies the approval. If the digest that matches the digest holding unit 1151c is not held, the RSU packet is not falsified, but it is determined that the transmission destination base station apparatus 20 cannot be specified, and the indefinite state is notified. When the MAC verification fails (denial), the verification control unit 1151e notifies the denial.

  By making this determination, the verification result can be output after the MAC verification is completed, and the verification result can be provided with substantially the same delay as the verification result of the inter-vehicle communication packet. Note that the verification of the inter-vehicle communication packet is only a confirmation of the coincidence of the MAC values, and therefore the detailed description thereof is omitted.

  FIG. 23 is a flowchart illustrating an RSU packet reception process of the terminal device 10 in which the verification unit 1151 according to the configuration example is used. The RF unit 12 receives the RSU packet. The RSU packet is output to the security processing unit 15 through the modem unit 13 and the MAC frame processing unit 14. When the verification unit 1151 of the security processing unit 15 receives the RSU packet, the processing is started. Upon receiving the RSU packet, the verification control unit 1151e instructs the MAC verification unit 1151d to start MAC verification (S10). Then, the frame number of the received RSU packet is confirmed (S11). When the frame number is 0 (Y of S11), the hash calculator 1151a is instructed to calculate the digest of the public key certificate arranged in the RSU packet. Upon receiving the instruction, the hash calculator 1151a calculates and obtains the digest of the public key certificate (S12). The verification control unit 1151e compares the digest of the public key certificate calculated by the hash calculation unit 1151a with the digest of the public key certificate held in the digest holding unit 1151c, and determines whether or not they match. (S13).

  If the digests do not match (N in S13), the verification control unit 1151e checks the operating state of the ECDSA verification unit 1151b (S17). When the ECDSA verification unit 1151b is on standby (Y in S17), the verification control unit 1151e instructs the ECDSA verification unit 1151b to start RSU authentication of the RSU packet (S14), and ends the processing for the RSU packet. On the other hand, when the ECDSA verification unit 1151b is in operation (N in S17), the verification control unit 1151e gives up the RSU verification of the received RSU packet and ends the processing for the RSU packet.

  When the digests match (Y in S13), the verification control unit 1151e checks the elapsed time since the RSU verification information including the digest is held in the digest holding unit 1151c (S16). This confirms the elapsed time from the successful RSU verification. If the predetermined time has elapsed (Y in S16), the process proceeds to step S17 in order to attempt RSU verification of the RSU packet. If the frame number is other than 0 in step S11 (N in S11), it is determined that RSU verification is not necessary, and the process for the RSU packet is terminated. If the predetermined time has not elapsed (N in S16), the process is terminated.

  FIG. 24 is a flowchart showing the RSU verification processing of the RSU packet in the ECDSA verification unit 1151b. The RSU packet 1 is targeted. When receiving an instruction to start RSU authentication of the RSU packet from the verification control unit 1151e, the ECDSA verification unit 1151b changes the operating state of the ECDSA verification unit to active (S30). Then, the authentication key stored in the storage unit 1153 is acquired, and the public certificate included in the RSU packet is verified (S31). If the verification is successful (Y in S31), the signature included in the RSU packet is verified using the public key included in the public key certificate (S32). When the verification is successful (Y in S32), the RSU verification information including the digest of the public key certificate stored in the digest holding unit 1151c is overwritten (S33). At this time, the elapsed time is reset. If verification of the public key certificate included in the RSU packet fails in step S30 (N in S31) or if verification of the signature included in the RSU packet fails in step S31 (N in S32), The RSU verification information received from the RSU packet is discarded (S35). When step S33 or step S35 ends, the operating state of the ECDSA verification unit is changed to standby (S34), and the RSU verification process ends.

  FIG. 25 is a flowchart showing the MAC verification processing of the RSU packet in the MAC verification unit 1151d. When the MAC verification unit 1151d receives an instruction to start MAC authentication of the RSU packet from the verification control unit 1151e, the MAC verification unit 1151d acquires the communication key stored in the storage unit 1153 according to the key ID of the RSU packet (S40). The MAC verification unit 1151d calculates the MAC value for the MAC calculation target of the RSU packet using the acquired communication key (S41). Then, the MAC value obtained by the calculation is compared with the MAC value included in the RSU packet (S42). When the two MAC values match (Y in S42), when the RSU packet is RSU packet 1, the digest of the public key certificate included in the RSU packet is acquired from the hash calculator 1151a (S43). When the RSU packet is RSU packet 2-5, the digest included in the RSU packet is extracted. The digest of the public key certificate held in the digest holding unit 1151c is compared with the acquired digest to determine whether or not they match (S44). If the two match (Y in S44), the MAC verification unit 1151d determines that the RSU packet has been successfully verified, and notifies the reception processing unit 161 of the approval (S45). If the two do not match (N in S44), the MAC verification unit 1151d determines that the transmission destination base station device 20 cannot be specified, and notifies the reception processing unit 161 of indefiniteness (S47). In step S42, if MAC verification fails (denial) (N in S42), the MAC verification unit 1151d notifies the reception processing unit 161 of denial (S46). In any of steps S47, S45, and S46, the MAC verification process is ended by the notification of the verification result to the reception processing unit 161. The application data included in the RSU packet is provided to the reception processing unit 161 in accordance with the notification of the verification result. Indefinite means a state where the result of the authentication process is not fixed. The reception processing unit 161 processes data included in a packet whose authentication is indefinite according to a preset rule. For example, the processing for the data may be stopped until it is authenticated, may be flagged as unauthenticated and passed to the notification unit 162, or depending on the importance of the information included in the message You may use both properly. When the notification unit 162 receives information that is flagged as unauthenticated, the notification unit 162 can notify the user of the information in a manner that allows the user to recognize that the information is unauthenticated.

  In order to improve safety, RSU verification is performed every predetermined period even in the reception area of the base station apparatus 20. Specifically, when the ECDSA verification unit 1151b confirms the passage of time after the verification and the digest holding unit 1151c holds the digest, a predetermined time has passed after the RSU verification. Indicates that RSU verification is performed. In addition, the digest held in the digest holding unit 1151c may be deleted after a predetermined time has elapsed. Moreover, you may use both together. When used together, it is necessary to lengthen the time until the digest is deleted from the digest holding unit 1151c with respect to the elapsed time until the ECDSA verification unit 1151b performs the RSU verification again.

  Hereinafter, an authentication (hereinafter referred to as “authentication 2”) different from the authentication so far (hereinafter referred to as “authentication 1”) will be described. Note that, in the description of the authentication 2, the description overlapping with the description of the authentication 1 is omitted as appropriate.

  FIG. 26 shows a detailed configuration example of the frame format of the security layer of the packet signal for inter-vehicle communication transmitted by the terminal device 10. Public key cryptography is used for inter-vehicle communication because large packet signals cannot be transmitted, the total number of packet signals to be notified is large, and the accuracy of information is lower than the information contained in packet signals for road-to-vehicle transmission. Without using the MAC (Message Authentication Code) based on the common key cryptosystem, the integrity of the information included in the packet signal is authenticated. In this data structure, “version”, “message format”, “key ID”, “transmission source device ID”, “random number”, “data length” are arranged as security headers, and “device management code” as payload thereafter. "Application data" is arranged, and finally "MAC" is arranged as a security footer. Here, “” represents a field constituting the security frame.

  “Equipment management code” sets a status code for notifying the other terminal device 10 and the base station device 20 of the operating state of the terminal device 10. Application data is set in “APP data”. “MAC” is set to the MAC value when the message type (AT) is an authenticated data format (= 1) or an encrypted data format with authentication (= 2).

  FIG. 27 shows a detailed configuration example of a security layer frame of a road-vehicle communication packet signal transmitted by the base station apparatus 20. FIG. 27A is a security frame of the RSU packet 1 in FIG. 3, and FIG. 27B is a security frame of the RSU packets 2 to 5 in FIG. That is, the security frame of the first RSU packet in the RSU period follows FIG. 27A, and the security frames of the remaining RSU packets transmitted in the same RSU period follow FIG. 27B.

  In the data structure of FIG. 27A, “version”, “message format”, “key ID”, “source device ID”, “random number”, “data length”, “public key certificate”, “Message ID”, “Frame number”, “Final frame number” and “Frame authentication list” are arranged, followed by “Device management information” and “APP data” as payload, and finally “Electronics information” as security footer. “Signature” and “MAC” are arranged. Since “version”, “message format”, “key ID”, “transmission source device ID”, “random number”, “APP data”, and “MAC” are the same as those in the data structure of FIG. However, since this data structure supports both MAC authentication and signature authentication, MAC Flag = 1 and SIG Flag = 1.

  “Data length” includes “public key certificate”, “frame number”, “message ID”, “final frame number”, “frame authentication list”, “device management”, “APP data”, and “electronic signature”. The total number of bytes is set. “Public key certificate”, “frame number”, “message ID”, “final frame number”, “frame authentication list”, “device management”, “APP data”, and “electronic signature” are considered as one field. The data structure is the same as that of the security frame of FIG.

  “Message ID” is a transmission-specific number that is assigned every time the base station apparatus 20 transmits, and the same value is set in all RSU packets transmitted in one superframe. For example, it is a count value that is incremented for each transmission.

  “Device management” is a field for notifying an abnormality or an instruction from the base station device 20 to an arbitrary terminal device 10 and providing data, and includes “device management code”, “target device ID”, and “parameter length”. , “Parameters” are arranged. In the “device management code”, a code indicating notification to the terminal device 10 and data provision is set. This code is in the same system as the code set in the “device management code” in FIG. 26, and it is assumed that whether the status notification is notification or data provision is identified by 1 bit of the MSB. That is, when the MSB is 0, the status notification code is used in the security frame of FIG. When MAC is 1, it is used in the security frame of FIG. The notification / information providing code arranges an option field according to its value. “Parameter length” and “parameter” are optional fields and are used when providing data. The “target device ID” is set to the device ID of the terminal device 10 that performs notification or data provision. All 0 is set when notifying or providing data to the terminal device 10 unspecified. “Parameter length” is the number of bytes of “parameter”. “Parameter” sets data to be provided.

  In “electronic signature”, “message ID”, “frame number”, “final frame number”, “frame authentication list”, “authentication data list”, and signature for the payload are set. The signature is a signature generated using a private key that is paired with the public key included in the “public key certificate”. Since the signature target includes a “frame authentication list”, the necessity of signature cannot be determined by the message type (MT) of this security frame. Therefore, when the authentication type (AT) = 1, “electronic signature” ”Is set to the signature. Next, when the message type (MT) is the authenticated data format (= 1) or the encrypted data format with authentication (= 2), the MAC value is obtained after setting the signature and set to “MAC”. To do. Then, encryption is performed. In this example, the calculation target of the MAC is “device ID”, “random number”, “data length”, “message ID”, “frame number”, “final frame number”, “frame authentication list”, payload, and “electronic signature” The encryption targets are “message ID”, “frame number”, “final frame number”, “frame authentication list”, “authentication data list”, payload, “electronic signature”, and “MAC”.

  In the data structure of FIG. 27B, “version”, “message format”, “key ID”, “source device ID”, “random number”, “data length”, “digest”, “frame number” are used as security headers. , “Final frame number”, “APP data” as the payload, and “MAC” as the security footer at the end. About “Version”, “Message Format”, “Key ID”, “Sender ID”, “Random Number”, “Message ID”, “Frame Number”, “Last Frame Number”, “APP Data”, and “MAC” Is the same as that of the data structure of FIG.

  In the case of the security frame of the RSU packet transmitted by the base station apparatus 20 according to FIG. 3, “last frame number” is set to 4. “Frame number” of the RSU packet 2 is set to 1. Similarly, “frame numbers” of RSU packet 3, RSU packet 4 and RSU packet 5 are set to 1, 2, 3, 4 respectively. In the “data length”, the total number of bytes of “digest”, “message ID”, “frame number”, “final frame number”, payload, and “electronic signature” is set. When “digest”, “message ID”, “frame number”, “final frame number” and payload are regarded as one field, the data structure is the same as that of the security frame of FIG.

  In the “digest”, a digest of a public key certificate for a public key unique to the transmission source base station apparatus 20 is set. Here, the digest of the body of the public key certificate, that is, a hash value for the signature target part of the public key certificate, for example, a value obtained by SHA-224 and SHA-225, or a part thereof is applied. The signature included in the public key certificate, a part of the signature, the public key and / or the device ID may be used as a digest. Further, when the device ID is used as a digest, the “digest” may be omitted if the device ID is the same as the device ID set in the “transmission source device ID”. In this example, the calculation target of the MAC is “device ID”, “random number”, “data length”, “digest”, “message ID”, “frame number”, “final frame number”, and payload, and the encryption target is , “Message ID”, “frame number”, “final frame number”, “digest”, payload and “MAC”.

  When one base station apparatus 20 uses a plurality of road and vehicle communication periods, all the security frames of the RSU packet transmitted in the subsequent RSU period may be as shown in FIG. In this case, among the RSU packets transmitted from the base station apparatus 20 to the superframe, the security frame of the first RSU packet conforms to FIG. 27A, and the security frames of the remaining RSU packets all conform to FIG. 27B.

  Further, in FIG. 4, the security frame has been described so as to be contained in the RSU packet. However, when the base station apparatus 20 concatenates and transmits a plurality of application data, the security frame may be configured in units of application data. Good. In this case, among the application data transmitted from the base station apparatus 20 to the superframe, the application data transmitted at the head is set in the “APP data” of the security frame according to FIG. Data is set in “APP data” of different security frames according to FIG. Thereafter, the packet is simply divided and transmitted as an RSU packet.

  FIG. 18 shows a configuration example of a list of authentication data set in the “frame authentication list”. It is a list in which MAC values of subsequent security frames are arranged in the order of frame numbers. The size is (number of bytes of authentication data) × (total number of frames−1). The MAC value to be set is the same as the MAC value set to “MAC” in FIG. A list of hash values may be used instead of the MAC values. In this case, the hash calculation targets are “message ID”, “frame number”, “final frame number”, and payload.

  For convenience of explanation, it is assumed that all base station apparatuses 20 transmit RSU packets according to FIG. Also, the public key certificate verification and signature verification processing of the security frame of the RSU packet 1 are simply referred to as signature verification, and the MAC authentication processing for the security frames of the RSU packets 1 to 5 is referred to as MAC authentication. When the message type (MT) of the security frame of the received RSU packet is the encrypted data format with authentication (= 2), signature verification and MAC verification are executed after decryption.

  FIG. 28 shows a configuration example of the verification unit 1151. The verification unit 1151 according to the configuration example includes a hash calculation unit 1151a, an ECDSA verification unit 1151b, an RSU verification information holding unit 1151f, a MAC verification unit 1151d, and a verification control unit 1151e.

  The storage of the RUS verification result will be described. When the RSU packet is received, the verification control unit 1151e confirms the match between the digest included in the RSU verification information held in the RSU verification information holding unit 1151f and the digest of the public key certificate of the RSU packet. The digest of the public key certificate of the RSU packet is a hash value calculated by the hash calculator 1151a with the public key certificate included in the RSU packet as an input when the RSU packet 1 is used. In the case of RSU packets 2 to 5, the digest is set in the “digest” of the packet. If the digest that matches the RSU verification information holding unit 1151f is held, the verification control unit 1151e acquires the verification result and the message ID from the RSU verification information including the digest. Then, as the verification result of the RSU packet, the MAC verification result, the acquired verification result, and the message ID are notified to the reception processing unit 161.

  As described above, the MAC verification result, the RSU verification result of the RSU packet transmitted from the same base station apparatus 20 performed immediately before, and the message ID that is identification information of the RSU packet are notified as the verification result of the RSU packet. Thus, the verification result can be output after the MAC verification is completed, and the verification result can be provided with substantially the same delay as the verification result of the inter-vehicle communication packet. The reception processing unit 161 determines whether to use data. Note that the verification of the inter-vehicle communication packet is only a confirmation of the coincidence of the MAC values, and therefore the detailed description thereof is omitted.

  FIG. 29 is a flowchart illustrating an RSU packet reception process of the terminal device 10 in which the verification unit 1151 according to the configuration example is used. The RF unit 12 receives the RSU packet. The RSU packet is output to the security processing unit 15 through the modem unit 13 and the MAC frame processing unit 14. When the verification unit 1151 of the security processing unit 15 receives the RSU packet, the processing is started. Upon receiving the RSU packet, the verification control unit 1151e instructs the MAC verification unit 1151d to start MAC verification (S110). Then, the frame number of the received RSU packet is confirmed (S111). When the frame number is 0 (Y in S111), the hash calculation unit 1151a is instructed to calculate the digest of the public key certificate arranged in the RSU packet. Upon receiving the instruction, the hash calculation unit 1151a calculates and obtains the digest of the public key certificate (S112). The verification control unit 1151e compares the digest of the public key certificate calculated by the hash calculation unit 1151a with the digest of the public key certificate held in the RSU verification information holding unit 1151f, and determines whether or not they match. Determine (S113).

  If the digests do not match or the digests match and the verification result is data denial or RSU denial (N in S113), the verification control unit 1151e checks the operating state of the ECDSA verification unit 1151b (S117). When the ECDSA verification unit 1151b is on standby (Y in S117), the verification control unit 1151e instructs the ECDSA verification unit 1151b to start RSU authentication of the RSU packet (S114), and ends the processing for the RSU packet. On the other hand, when the ECDSA verification unit 1151b is in operation (N in S117), the verification control unit 1151e gives up the RSU verification of the received RSU packet and ends the processing for the RSU packet.

  When the digests match and the verification result is RSU approved (Y in S113), the verification control unit 1151e checks the elapsed time since the RSU verification information including the digest is held in the RSU verification information holding unit 1151f. (S116). This confirms the elapsed time from the successful RSU verification. When the predetermined time has elapsed (Y in S116), the process proceeds to step S14 in order to attempt RSU verification of the RSU packet. If the frame number is other than 0 in step S111 (N in S111), it is determined that RSU verification is not necessary, and the process for the RSU packet is terminated. If the predetermined time has not elapsed (N in S116), the process is terminated.

  FIG. 30 is a flowchart showing the RSU verification processing of the RSU packet in the ECDSA verification unit 1151b. The RSU packet 1 is targeted. When receiving an instruction to start RSU authentication of the RSU packet from the verification control unit 1151e, the ECDSA verification unit 1151b changes the operating state of the ECDSA verification unit to active (S130). Then, the authentication key stored in the storage unit 1153 is acquired, and the public certificate included in the RSU packet is verified (S131). If the verification is successful (Y in S131), the signature included in the RSU packet is verified using the public key included in the public key certificate (S132). If the verification is successful (Y in S132), the RSU verification information stored in the RSU verification information holding unit 1151f is overwritten with the RSU verification information in which the RSU verification result is RSU approved (S133). At this time, the elapsed time is reset. If the signature verification included in the RSU packet fails (N in S132), the RSU verification information stored in the RSU verification information holding unit 1151f is overwritten with the RSU verification information in which the RSU verification result is data denial (S134). ). Alternatively, when the verification of the public key certificate included in the RSU packet fails in step S131 (N in S131), the RSU verification information in which the RSU verification result is RSU rejection is stored in the RSU verification information holding unit 1151f. The existing RUS verification information is overwritten (S135). When step S133, step 134, or step S135 ends, the ECDSA verification unit operation state is changed to standby (S136), and the RSU verification process ends.

  FIG. 31 is a flowchart showing the MAC verification processing of the RSU packet in the MAC verification unit 1151d. When receiving an instruction to start MAC authentication of the RSU packet from the verification control unit 1151e, the MAC verification unit 1151d acquires the communication key stored in the storage unit 1153 according to the key ID of the RSU packet (S140). The MAC verification unit 1151d calculates the MAC value for the MAC calculation target of the RSU packet using the acquired communication key (S141). Then, the MAC value obtained by the calculation is compared with the MAC value included in the RSU packet (S142). When the two MAC values match (Y in S142), when the RSU packet is RSU packet 1, the digest of the public key certificate included in the RSU packet is acquired from the hash calculator 1151a. When the RSU packet is RSU packet 2-5, the digest included in the RSU packet is extracted. The digest of the public key certificate held in the RSU verification information holding unit 1151f is compared with the acquired digest to determine whether or not they match (S143).

  If both match (Y in S143), the MAC verification unit 1151d sends the MAC verification result (approval) of the RSU packet, the RSU verification result held in the RSU verification information holding unit 1151f, and the message ID to the reception processing unit 161. (S144). When the two do not match (N in S143), the MAC verification result (approval) and RSU verification denial of the RSU packet are notified to the reception processing unit 161 (S145). If the MAC verification fails (denied) in step S142 (N in S142), and the digests of the public key certificates match (Y in S146), the MAC verification unit 1151d determines that the MAC verification result (denial) of the RSU packet is the same. The RSU verification information held in the RSU verification information holding unit 1151f and the message ID are notified to the reception processing unit 161 (S147).

  When the two do not match (N in S146), the reception processing unit 161 is notified of the MAC verification result (denial) and RSU verification denial of the RSU packet (S148). When the reception processing unit 161 is notified of the verification result in any of steps S144, S145, S147, or S148, the MAC verification process ends. The application data included in the RSU packet is provided to the reception processing unit 161 in accordance with the notification of the verification result. The reception processing unit 161 processes the received application data according to a preset rule based on the two verification results. For example, the application data may be adopted only when both are authenticated, and when one of the two verification results is approved and the other is denied or indefinite, a flag indicating that it is not authenticated is set and a notification unit is set. 162 may be used, or both may be properly used according to the importance of the information included in the message.

  When the notification unit 162 receives information that is flagged as unauthenticated, the notification unit 162 can notify the user of the information in a manner that allows the user to recognize that the information is unauthenticated. The device management information is preferably handled as important data. In this case, the reception processing unit 161 holds the message ID, device management information, and MAC verification result of the RSU packet from which the crisis management information has been extracted, and manually handles the RSU authentication result and message data provided together with application data for the subsequent RSU packet. Decide whether to use the device management information that you have confirmed and stored. When the two message IDs match and the RSU authentication is approved, the crisis management information is adopted. When the message ID matches and the RSU authentication is not approved, and when the message ID that has received the retained message ID is overtaken, the retained device management information is discarded. In this way, important data can be extracted only from RSU packets approved by RSU authentication.

The authentication 1 described above may be summarized as follows.
(1) When the vehicle-mounted device that has reached the transmission area of the roadside unit (RSU) reaches the area, signature verification (public key certificate and frame signature verification, hereinafter referred to as RUS authentication) is performed, and then MAC verification ( (Hereinafter referred to as frame authentication).
(2) Reaching the communication area is performed by digesting the RSU-authenticated RSU public key certificate (the hash value of the public key certificate body or a part thereof, or the public key certificate public key or part thereof) The identification number of the certificate, the identification information (device ID) to be granted, etc.).
(3) The frame is approved with the digest confirmation of the RSU-authenticated roadside device and the MAC verification result.
(4) A valid time for RUS authentication is set, and re-authentication is performed at regular intervals. During the re-authentication process, the MAC verification result is valid with the result of the previous RSU authentication.

Authentication 2 may be summarized as follows.
(1) Perform MAC verification as needed.
(2) When the frame transmitted from the RSU matches the digest of the RSU-authenticated RSU public key certificate, it is added to the MAC verification result and notified.
(3) Holds the digest information of the roadside device approved by RSU authentication. The RUS certification is updated periodically.

  Below, the process demonstrated so far is demonstrated in relation to a layer. FIG. 32A shows the configuration of layers defined in the base station apparatus 20 and FIG. 32B shows the layers defined in the terminal apparatus 10. A layer configuration of transmission processing in the base station apparatus 20 in FIG. The application layer is included in the data generation unit 26 or the network communication unit 27. Specifically, road alignment information and sensor installation information held in advance in a storage unit (not shown) of the base station device 20, light extinction information of a traffic signal provided together with the base station device 20, or the base station device 20 An application layer corresponding to application data transmitted from the base station apparatus 20 such as sensor information indicating the position or movement of a vehicle or a person detected by sensors installed in the vicinity of the mobile station is included in the data generation unit 26. An application layer corresponding to application data provided via a network from a traffic control center such as construction information, fallen object information, traffic jam information, or emergency vehicles is included in the network communication unit 27. The separation processing layer, the packet management layer, and the security management layer are included in the security processing unit 25 in FIG. 20, and the wireless transmission layer is included in the RF unit 22, the modem unit 23, and the MAC frame processing unit 24 in FIG.

  The layer configuration of the reception process in the terminal device 10 in FIG. The application layer is included in the reception processing unit 161 in FIG. 20, the separation processing layer, the packet management layer, and the security management layer are included in the security processing unit 15 in FIG. 20, and the wireless reception layer is the RF unit 12 in FIG. Included in the modem 13 and the MAC frame processor 14.

  The application layer includes one type or a plurality of types of applications. Here, it is assumed that three types of applications APP1, APP2, and APP3 are configured, and each provides application data D1, D2, and D3. Application data to be transmitted is input from the application layer to the division processing layer. 33 (a) to 33 (e) show an overview of processing in each layer of transmission processing in the base station apparatus 20. FIG. The horizontal axis indicates time. FIG. 33A shows application data input to the division processing layer. The split processing layer arranges the application data input from multiple applications in the transmission order, and considers the size of each application data and the size of additional data such as header or footer added by each lower layer, especially security management layer And divide it into sizes that can be sent. FIG. 33B shows a data series divided by the division processing layer. For example, D1 is divided into D1 (i) and D2 (ii). An EL header is added to each of the divided data. Returning to FIG. The EL header includes combination information for reconstructing application data divided at the time of reception. The division processing layer outputs the divided data to the packet management layer.

  The packet management layer adds the current date and time as the transmission date and time to the top of the divided data. The transmission date and time is added as a countermeasure against the replacement attack. FIG. 33C shows a data series to which the transmission date and time is added by the packet management layer. Returning to FIG. The packet management layer outputs the data with the transmission date and time added to the security management layer. The security management layer executes security processing on the data to which the transmission date / time is added. FIG. 33 (d) shows data that has been subjected to security processing. For example, a MAC header, a public key certificate, a HASH list, a signature, a MAC, and a digest are added to the data. This corresponds to FIGS. 17 (a)-(b). Note that the HASH list corresponds to the frame authentication list in FIG. Since the HASH list is generated in units of data, it includes hash values generated for each of D1 (i), D1 (ii), and the like. Returning to FIG. The security management layer outputs the security-processed data to the packet management layer, and the packet management layer outputs this to the wireless transmission layer. The wireless transmission layer stores each data in a packet signal and broadcasts the packet signal. FIG. 33 (e) shows a packet signal. Here, SL1, SL2, etc. indicate the road and vehicle transmission period described above, and P1, P2, etc. indicate packet signals.

  In the reception processing of the terminal device 10, the processing in FIG. 33 proceeds in the reverse order from (e) to (b), the application data D1, D2, and D3 are reconfigured with reference to the EL header, and the corresponding application APP1. , Output to APP2 and APP3.

(Example 3)
Next, a third embodiment of the present invention will be described. The third embodiment aims to simplify security processing in a situation where data is divided. Until now, the HASH list was generated after dividing the data. As described above, the size of the HASH list depends on the number of divided data. That is, the size is a variable value and not a fixed value. For this reason, when the size of the HASH list becomes large and data cannot be stored in one packet signal, the data is further divided and the HASH list is created again. In order to simplify such processing, the base station apparatus according to the third embodiment generates a HASH list before dividing the data, and divides the data to which the HASH list is added. Since the number of data is recognized at the time of input, the size of the HASH list is fixed at that time. As a result, since the size of the HASH list is regarded as a fixed value in the division process, the process is simplified. The communication system 500 according to the third embodiment is of the same type as that of FIG. 1, the base station device 20 is of the same type as that of FIG. 20, and the terminal device 10 is of the same type as that of FIG. Below, it demonstrates focusing on a difference.

  In FIG. 20, the security processing unit 15 inputs a plurality of types of application data. The security processing unit 15 generates a list including representative values of each data derived by using the public key cryptosystem for each of a plurality of types of application data. Here, a hash value is generated by applying a hash function for each application data. Further, the security processing unit 25 generates a HASH list by collecting hash values for each of a plurality of application data. At this stage, the HASH list becomes a fixed value. The security processing unit 25 divides the HASH list and a plurality of types of application data into a plurality of pieces. At that time, the HASH list is added to the preceding stage of the first application data. The division is performed in application program units. Further, the MAC frame processing unit 24 generates a plurality of packet signals by storing each of the division results in the packet signal. The modem unit 23 and the RF unit 22 broadcast a plurality of packet signals.

  FIG. 34A shows the configuration of layers defined in the terminal apparatus 10 in the base station apparatus 20 according to the third embodiment of the present invention, and FIG. Similarly to FIG. 32, the layer configuration of the transmission processing in the base station apparatus 20 will be described here as well. The application layer is included in the data generation unit 26 or the network communication unit 27. The enhancement layer, packet management layer, upper security management layer, and lower security management layer are included in the security processing unit 25 of FIG. 20, and the wireless transmission layer is the RF unit 22, the modulation / demodulation unit 23, and the MAC frame processing unit 24 of FIG. include. The layer configuration of the reception process in the terminal device 10 of FIG. The application layer is included in the reception processing unit 161 in FIG. 20, the separation processing layer, the packet management layer, and the security management layer are included in the security processing unit 15 in FIG. 20, and the wireless reception layer is the RF unit 12 in FIG. Included in the modem 13 and the MAC frame processor 14.

  FIGS. 35A to 35F show an overview of processing in each layer of transmission processing in the base station apparatus 20. FIG. 35 (a) shows application data input to the division processing layer, which is the same as FIG. 33 (a). Returning to FIG. The extension layer adds the transmission date and time to the head of the input application data. FIG. 35B shows a series of application data to which the transmission date / time is added. Returning to FIG. The enhancement layer outputs the application data with the transmission date and time added to the upper security management layer.

  The upper security management layer executes security processing on the application data to which the transmission date and time are added. FIG. 35C shows data that has been subjected to security processing. For example, a public key certificate, a HASH list, a signature, and a digest are added to the application data. Returning to FIG. The upper security management layer outputs the application data subjected to the security processing to the extension layer.

  The enhancement layer divides it according to the size of the application data subjected to security processing. FIG. 35D shows a series of data divided by the enhancement layer. Similar to FIG. 33B, D1 is divided into D1 (i) and D2 (ii). An EL header is added to each of the divided data. Returning to FIG. The enhancement layer outputs the divided data to the packet management layer, and the packet management layer outputs this to the lower security management layer.

  The lower security management layer executes security processing on the divided data. FIG. 35 (e) shows data that has been subjected to security processing. For example, a MAC header and MAC are added to the data. Returning to FIG. The lower security management layer outputs the security-processed data to the packet management layer, and the packet management layer outputs this to the wireless transmission layer. The wireless transmission layer stores each data in a packet signal and broadcasts the packet signal. FIG. 35 (f) shows a packet signal, which is the same as FIG. 33 (e). In the reception processing of the terminal device 10, the processing in FIG. 35 proceeds in the reverse order from (e) to (b), the application data D1, D2, and D3 are reconfigured with reference to the EL header, and the corresponding application APP1. , Output to APP2 and APP3.

Example 4
Although the base station apparatus 20 according to the third embodiment so far stores the HASH list and the head data in the same packet signal, they may be included in another packet signal. That is, the security processing unit 25 includes the HASH list in a packet signal that does not include a plurality of types of data. For this reason, a packet signal containing data and a packet signal containing a HASH list are generated separately. FIGS. 36A to 36F show an outline of another process in each layer. These are shown in the same manner as FIGS. 35 (a)-(f), so only the differences will be described. FIG. 36C shows data that has undergone security processing. Here, the HASH list is configured separately without being linked to D1.

  FIGS. 37A and 37B show an example of the data structure of the security frame included in the road-to-vehicle communication packet signal according to the fourth embodiment of the present invention. FIG. 37 (a) shows the format of the first data in FIG. 35 (c), and FIG. 37 (b) shows the format of the second transition data in FIG. 35 (c). Here, the MAC system payload of FIG. 37A and the signature system payload of FIG.

  FIG. 38 shows another example of the data structure of the security frame included in the road-vehicle communication packet signal according to the fourth embodiment of the present invention. This shows the format of the data in FIG. Here, the MAC system payload is a MAC target, and the Nonce, payload length, and MAC system payload are encryption targets.

  According to the embodiment of the present invention, since the HASH list is generated before the data is divided, the HASH list can be handled as a fixed amount of data in the division process. In addition, since the HASH list is handled as a fixed amount of data, the processing can be simplified. Further, since the packet signal including the HASH list is generated separately from the packet signal including the data, the packet signal including the data can be generated regardless of the HASH list.

  In the above, this invention was demonstrated based on the Example. This embodiment is an exemplification, and it will be understood by those skilled in the art that various modifications can be made to the combination of each component and each processing process, and such modifications are also within the scope of the present invention. .

  The outline of one embodiment of the present invention is as follows. A communication apparatus according to an aspect of the present invention includes a management unit that manages a common key table to be formed by combining a plurality of partial common key tables including a plurality of common keys, and a common managed by the management unit A processing unit that executes security processing for data by using any one of the common keys in the key table and a communication unit that transmits or receives data subjected to security processing in the processing unit. The management unit updates the common key table by adding a new partial common key table to the common key table.

  According to this aspect, since the partial common key table is not updated together but updated so as to add the partial common key table, the individuality of the partial common key table is improved, and some partial common key tables are leaked. Even in this case, the possibility of the entire common key table leaking can be reduced.

  The number of partial common tables that can be combined to form the common key table managed by the management unit is determined, and the management unit updates the common key table until the number of partial common key tables that can be combined is reached. In order to update the common key table after adding a new partial common key table and reaching the number of partial common key tables that can be combined, a new partial common key table is added. It may be replaced by a common key table. In this case, the partial common key table is added until the size of the common key table is exceeded, and when the size of the common key table is reached, the partial common key table is replaced, so that the size of the common key table can be limited.

  Another embodiment of the present invention is also a communication device. This apparatus includes a receiving unit that receives data subjected to security processing by a common key encryption method, a management unit that manages a common key in the common key encryption method, and a receiving unit among common keys managed by the management unit And a processing unit that executes a receiving process of the security process using the common key used for the data received in step. When the common key used for the data received by the receiving unit is not managed, the management unit notifies that fact.

  According to this aspect, when the common key is not stored, the driver is notified to that effect, so the driver can be prompted to update the common key.

  The management unit may request the update of the common key when the common key used for the data received by the receiving unit is unmanaged. In this case, since the common key is requested to be updated when the common key is not stored, the new common key can be used.

  The management unit manages a common key table to be formed by combining a plurality of partial common key tables including a plurality of common keys, and adds a new partial common key table to the common key table. The common key table may be updated.

  Yet another embodiment of the present invention is a terminal device. This device includes a first packet signal to which a source-specific public key certificate, a signature verifiable with a public key included in the public key certificate, and a message authenticator using a common key cryptosystem are added, and a source-specific A terminal device that receives and verifies information identifying a public key certificate and a second packet signal to which a message authenticator using a common key cryptosystem is added, and a plurality of packets broadcast from a wireless device A receiver for receiving a signal; a first verifier for verifying a signature included in the first packet signal; and a message authenticator included in the first packet signal or the second packet signal. A second verification unit; and a digest holding unit that holds a digest of the public key certificate included in the first packet signal verified by the first verification unit. When receiving the first packet signal, the first verification unit verifies the public key certificate and the signature included in the received packet signal, and holds the digest of the public key certificate in the digest holding unit when the verification is successful. The second verification unit verifies the message authenticator included in the received packet signal when receiving the first packet signal or the second packet signal, and digests the public key certificate included in the received packet signal. Is stored in the digest holding unit, and when the verification is successful, the packet signal is notified as valid.

  Yet another embodiment of the present invention is also a terminal device. This device includes a first packet signal to which a source-specific public key certificate, a signature verifiable with a public key included in the public key certificate, and a message authenticator using a common key cryptosystem are added, and a source-specific A terminal device that receives and verifies a digest of a public key certificate and a second packet signal to which a message authenticator using a common key cryptosystem is added, and a plurality of packet signals broadcast from a wireless device are received. A receiving unit for receiving; a first verification unit for verifying a signature included in the first packet signal; and a second for verifying a message authenticator included in the first packet signal or the second packet signal. A verification unit; and a verification information holding unit that holds a verification result related to the first packet signal verified by the first verification unit. When receiving the first packet signal, the first verification unit verifies the public key certificate and the signature included in the received packet signal, and uses verification information including at least the verification result and the digest of the public key certificate. Updating the verification information held in the verification information holding unit, and the second verification unit, when receiving the first packet signal or the second packet signal, verifies the message authenticator included in the received packet signal; When the verification information corresponding to the digest of the public key certificate included in the received packet signal is held in the verification information holding unit, the verification in the first verification unit held in the verification information holding unit together with the verification result of the message authenticator Attach the result and notify.

  Yet another embodiment of the present invention is a communication device. This device receives multiple types of application data, one of the received application data, a source-specific public key certificate, a signature that can be verified with the public key contained in the public key certificate, and a message using a common key cryptosystem Communication for transmitting a first message including an authenticator, one of received application data, information specifying a sender-specific public key certificate, and a second message including a message authenticator using a common key cryptosystem An apparatus for transmitting a first message and one or more second messages as a group, wherein the first message is a first message and one or more second messages belonging to a group Contains a list for authentication of hash or message authenticators for application data contained in each , The signature is a signature for the authentication list, and the message authenticator of the first message is the public key certificate included in the message for the authentication list, the signature, and the application data, and the second message The message authenticator is for the specific information and application data of the public key certificate included in the message.

  The public key certificate, authentication list, signature, application data, and message authenticator included in the first message may be encrypted and transmitted.

  For some or all of the second message, the public key certificate identification information, application data, and message authenticator included in the message may be encrypted and transmitted.

  The first message and the second message may be divided into one or more packet signals and transmitted.

  The packet signal including the authentication list does not include application data.

  Yet another embodiment of the present invention is also a communication device. This device includes an input unit that inputs a plurality of types of data, a generation unit that generates a list including representative values of each data derived for each of the plurality of types of data input in the input unit, and a generation unit And a dividing unit that divides a plurality of types of data input in the input unit into a plurality of packet signals, and a notification unit that notifies the plurality of packet signals divided in the dividing unit.

  The dividing unit may include the list in a packet signal that does not include a plurality of types of data.

  10 terminal device, 11 antenna, 12 RF unit, 13 modem unit, 14 MAC frame processing unit, 15 security processing unit, 17 data generation unit, 18 storage unit, 19 control unit, 20 base station device, 21 antenna, 22 RF unit , 23 modem unit, 24 MAC frame processing unit, 25 security processing unit, 26 data generation unit, 27 network communication unit, 28 storage unit, 29 control unit, 100 vehicle, 151 encryption / decryption unit, 152 decoding unit, 153 key update unit 161 reception processing unit, 162 notification unit, 200 external network, 202 area, outside 204 area, 251 encryption / decryption unit, 252 encryption unit, 253 key update unit, 500 communication system.

  ADVANTAGE OF THE INVENTION According to this invention, the security of the communication system using a common key encryption system can be improved efficiently.

Claims (7)

A first packet signal to which a source-specific public key certificate, a signature verifiable with a public key included in the public key certificate, and a message authenticator using a common key cryptosystem are added;
A communication device that receives and verifies information identifying a public key certificate unique to a sender and a second packet signal to which a message authenticator by a common key cryptosystem is added,
A receiver that receives a plurality of packet signals broadcast from the wireless device;
A first verification unit for verifying a signature included in the first packet signal;
A second verification unit for verifying a message authenticator included in the first packet signal or the second packet signal;
A digest holding unit that holds a digest of the public key certificate included in the first packet signal verified by the first verification unit;
The first verification unit performs verification of the public key certificate and signature included in the received packet signal when receiving the first packet signal, and if the verification is successful, the digest of the public key certificate is Hold it in the digest holder,
When the second verification unit receives the first packet signal or the second packet signal, the second verification unit verifies the message authenticator included in the received packet signal, and the public key certificate included in the received packet signal. When the digest is held in the digest holding unit and the verification is successful, the communication apparatus notifies that the packet signal is valid. A first packet signal to which a source-specific public key certificate, a signature verifiable with a public key included in the public key certificate, and a message authenticator using a common key cryptosystem are added;
A communication device that receives and verifies a digest of a public key certificate unique to a sender and a second packet signal to which a message authenticator by a common key cryptosystem is added,
A receiver that receives a plurality of packet signals broadcast from the wireless device;
A first verification unit for verifying a signature included in the first packet signal;
A second verification unit for verifying a message authenticator included in the first packet signal or the second packet signal;
A verification information holding unit that holds a verification result related to the first packet signal verified by the first verification unit;
When receiving the first packet signal, the first verification unit performs verification of the public key certificate and signature included in the received packet signal, and at least a verification result and a digest of the public key certificate Update the verification information held in the verification information holding unit with the verification information included,
When the second verification unit receives the first packet signal or the second packet signal, the second verification unit verifies the message authenticator included in the received packet signal, and the public key certificate included in the received packet signal. When the verification information corresponding to the digest is held in the verification information holding unit, the verification result in the first verification unit held in the verification information holding unit is attached and notified together with the verification result of the message authenticator. A communication device. Receive multiple types of application data,
A first message including one of the received application data, a source-specific public key certificate, a signature verifiable with the public key included in the public key certificate, and a message authenticator using a common key cryptosystem;
A communication device that transmits one of received application data, information specifying a public key certificate unique to a sender, and a second message including a message authenticator using a common key encryption method,
Sending the first message and one or more of the second messages as a group;
The first message includes an authentication list of a hash or a message authenticator for application data respectively included in the first message and one or more of the second messages belonging to one group, and the signature includes the signature A signature for the list for authentication,
In the message authenticator of the first message, the public key certificate included in the message is for the authentication list, the signature, and the application data.
The communication apparatus according to claim 2, wherein the message authenticator of the second message is for the specific information of the public key certificate and the application data included in the message.   4. The communication apparatus according to claim 3, wherein the public key certificate, the authentication list, the signature, the application data, and the message authenticator included in the first message are encrypted and transmitted. .   The specific information of the public key certificate, the application data, and the message authenticator included in the message are encrypted and transmitted for a part or all of the second message. The communication device according to claim 3 or claim 4.   6. The communication apparatus according to claim 3, wherein the first message and the second message are divided into one or more packet signals and transmitted.   The communication apparatus according to claim 6, wherein the application data is not included in a packet signal including the authentication list.