JP5503692B2 - Wireless control security system - Google Patents

Description

  The present invention provides a wireless control system that includes a mobile system such as a train and a ground system that communicates with the mobile system. The present invention relates to a system for maintaining communication security.

  A system that performs train control for high-density line sections, etc., calculates a speed control pattern on the vehicle based on stop position information from the ground, and is a CBTC (Communications-Based Train Control) that is an on-board calculation main system that performs control. ). In realizing CBTC, use of a wireless transmission path is considered, and in using a wireless transmission path, it is essential to deal with threats such as tampering with communication data.

  In radio control for a mobile body, a handover technique is required to perform radio switching associated with movement. However, if authentication processing for preventing spoofing associated with connection switching is repeatedly performed during handover, security is performed. There is a problem that the overhead of communication increases and affects the communication of control data.

  As a wireless security system for controlling such a moving body, there is the following Patent Document 1.

JP 2002-300152 A

  In Patent Document 1, an authentication continuation key issued at the time of establishing authentication in a communication security holding system that realizes security of communication performed between a mobile station and a base station side device composed of a plurality of base stations and an authentication server. Thus, authentication is performed when authentication is continued thereafter.

  Since the base station of the base station side device is installed beside the road or the track, if security information for continuation of authentication is stored in the base station in order to support high-speed movement of the moving body, unauthorized access to the base station There was a risk of obtaining security information.

  In addition, the existing configuration does not consider processing when the system is scaled up or multiplexed.

  The present invention has been made in view of such circumstances, and considers the arrangement of security information and processing by making the base station side system hierarchical. In addition, by distributing the security processing load to each layer, the expansion of the system on the base station side can be ensured and the operation of the multiplex system can be handled.

That is, the present invention is a wireless control security system that takes into account the safety on the base station side with respect to the mobile unit, that is, the safety on the ground system side.
1. The ground system has a three-stage configuration of an access point (AP), an access point control device (APM), and a ground control device.
2. Information and processing associated with the realization of the security function are shared by the AP, APM, and ground control device that constitute the ground system.
3. Security information newly generated during system operation, for example, an encryption key, is generated and distributed by the ground control device.

  More specifically, the wireless control security system according to the present invention is a communication system including a vehicle control device included in a mobile body and a ground system including a ground control device, an APM, and an AP. An information storage unit, a security information storage unit, a random number generation unit, a security information processing unit, a control message generation / processing unit, a control message protection unit, a ground control device, a unique information storage unit, a security information storage unit, network configuration information APM includes a storage unit, a random number generation unit, a control message generation / processing unit, a security information distribution unit, and a security information ground control unit sharing unit. APM has a unique information storage unit, a security information storage unit, a network configuration information storage unit, a security unit An information processing unit and a control message protection unit are provided. Security information storage unit, the security information processing unit, a control message protection unit comprises.

  The ground control device generates a random number and key data corresponding to the vehicle control device, and periodically sends the random number and key data to the APM. The APM uses the random number and key data sent from the ground control device as security information. Vehicle control obtained by authentication by performing mutual authentication between the vehicle control device and the security information certificate processing unit via the AP using the random numbers generated by the vehicle control device and the ground control device set in the storage unit Using the device ID, the key data is distributed to the AP and the vehicle control device. The unique key information necessary for the authentication is previously held by the APM and the vehicle control device.

  Further, the vehicle control device, APM and AP use the key data to protect communication data generated by the vehicle control device and the ground control device.

  In addition, a basic configuration is a ground control system in which a plurality of APs are connected to the APM and a plurality of APMs are connected to the ground control device, and information transmitted by the ground control device is shared by the plurality of APMs and APs. Features.

  In addition, the first ground control device that shares information transmitted by the ground control device among the plurality of logic control devices and establishes communication with the vehicle control device receives the second position information and security information related to the vehicle control device. The first ground control device serving as the movement source transmits the security information and control information of the vehicle control device to the second ground control device serving as the movement destination in accordance with the movement of the vehicle control device. The second ground control device transmits the position information and security information of the vehicle control device acquired with the movement of the vehicle control device to the first ground control device.

  Also, transmission of security information of the vehicle control device from the first ground control device to the second ground control device, and location information and security of the vehicle control device from the second ground control device to the first ground control device Information transmission is performed periodically.

  Each of the vehicle control device, the ground control device unit, the APM, and the AP has a multi-system control configuration including a plurality of devices, and security information is shared between the ground control devices of the multi-system control configuration. .

  According to the above aspect, in the wireless control security system in which the ground system captures a moving body such as a train and transmits and receives train control information, the ground system has a three-stage configuration of AP, APM, and ground control device, thereby performing security processing. To reduce the load associated with the system and enable expansion to large-scale systems.

  According to the present invention, it is possible to cope with the operation of a multiplex system while ensuring the expandability of the system.

It is a figure showing the system configuration | structure of this embodiment. It is a figure showing the implementation example of the apparatus in the system configuration of this embodiment. It is a figure showing the data structure of the memory | storage device of the ground control apparatus of this embodiment. It is a figure showing the data structure of the memory | storage device of the ground control apparatus of this embodiment. It is a figure showing the data structure of the memory | storage device of APM of this embodiment. It is a figure showing the data structure of the memory | storage device of APM of this embodiment. It is a figure showing the data structure of the memory | storage device of the vehicle control apparatus of this embodiment. It is a figure showing the data structure of the memory | storage device of AP of this embodiment. It is a flowchart showing the normal process at the time of system starting of this embodiment. It is a flowchart showing the protection communication process of the control message of this embodiment. It is a flowchart showing the security information sharing process of the ground device system of this embodiment. It is a flowchart showing the security information sharing process of the ground device system of this embodiment. It is a flowchart showing the security information sharing process of the ground device system of this embodiment. It is a flowchart showing the authentication process between the ground control apparatus and vehicle control apparatus from which the management main body of this embodiment differs. It is a flowchart showing the re-authentication process between the ground control apparatus and vehicle control apparatus of this embodiment. It is a figure which shows the data format of the communication message of this embodiment. It is a figure which shows the data format of the communication message of this embodiment. It is a figure which shows the data format of the communication message of this embodiment.

  Embodiments to which the present invention is applied will be described below.

  The present embodiment is a system (communication system including a wireless control security system) for controlling a train that is a moving body, and targets a certain train control area on a track on which the train moves, and a plurality of access points in this area. A ground control system comprising one access point control device (APM) connected to (AP) and one ground control device connected to a plurality of APMs is installed.

  By installing multiple ground control systems and connecting the ground control devices of each ground control system, it is possible to cope with the large scale of the system.

  Each ground control device controls the train by sending control data to the train under management via the AP managed by each ground control device. If the train moves from the management of a certain ground control device to the management of an adjacent ground control device, the two ground control devices cooperate to continue the train control.

  FIG. 1 is a diagram showing the system configuration of the present embodiment. This embodiment is a vehicle control device (111) installed in a ground control device (101) (102), an APM (103) (104) (105), an AP (106) (107) (108), and a train (112). ), Ground unit (113) (114). Although it is possible to mount a plurality of vehicle control devices (111) on the train (112), it is assumed here that one unit operates. A plurality of APs (106) (107) are connected to the APM (103), and a plurality of APMs (103) (104) are connected to the ground control device (101). The ground control device (101) and the ground control device (102) are connected. The vehicle control device (111) acquires position information from the ground unit (113) when passing over the ground unit (113). That is, the position information acquired from the ground unit (113) becomes the current position of the train (112).

  FIG. 2 shows a vehicle control device installed in the ground control device (101) (102), APM (103) (104) (105), AP (106) (107) (108), and train (112) of this embodiment. It is an apparatus block diagram which shows the Example of (111). The terminal (201) includes a CPU (202), a memory (203), a storage device (204), a communication IF (205), and a peripheral device connection IF (206). The terminal is connected to another terminal (201) via the communication IF (205) and further via the network (210), and is connected to the display device (207) via the peripheral device connection IF (206). The CPU (202) is a device that controls the operation of the terminal (201). In the storage device (204) and the memory (203), various processing programs and data necessary for controlling the operation of the terminal (201) are stored and loaded. When the CPU (202) executes various processing programs stored in the storage device (204) and the memory (203), various processing described later is executed. However, the present invention is not limited to this, and various processing programs may be installed in the terminal (201) via a storage / communication medium.

  3 and 4 show data stored in the storage device (204) of the ground control devices (101) and (102).

  FIG. 3A shows a storage device (204) of the ground control devices (101) and (102), an identifier R-ID (340) of the ground control device, security information (300) (350), and network configuration information (310). (320) indicates that the control processing unit (330) is stored. The R-ID (340) stores a different identifier for each device.

  FIG. 3B shows security information (300) related to the vehicle control device. The vehicle control device ID (301), the encryption key (303), the APM-MAC key (304), the AP-MAC key (309), the status ( 305), counter (306), random number (307), mechanism designation code (308), temporary encryption key (361), temporary APM-MAC key (362), temporary AP-MAC key (363), authentication for unmanaged vehicle It consists of a key (364) and an unmanaged vehicle flag (365).

  The vehicle control device ID (301) is a vehicle-specific identifier for identifying the vehicle and is set in advance. However, for example, when a new train is added or when entering a route with another company's route, the vehicle control device ID of an unmanaged train is not set.

  The encryption key (303), the APM-MAC key (304), the AP-MAC key (309), and the counter (306) are set in an authentication process performed prior to communication between the vehicle and the ground control system. Used for secure communication of control messages.

  The status (305) indicates to what level the authentication process with the vehicle control device has been completed. The random number (307) is set in the authentication process and used to generate authentication data.

  The mechanism designation code (308) is information sent from the vehicle control device at the time of authentication. The temporary encryption key (361), the temporary APM-MAC key (362), the temporary AP-MAC key (363), and the unmanaged vehicle authentication key (364) are moved to the ground control device that is not managing the vehicle control device. Or when a vehicle control device that is not managed by the ground control device moves. When authentication with an unmanaged vehicle control device occurs due to the addition of a vehicle control device or entering another company's route, an unmanaged vehicle authentication key (364) is used. The vehicle control device uses the temporary encryption key (361), the temporary APM-MAC key (362), and the temporary AP-MAC key (363) while moving from the managed ground control device to the unmanaged ground control device. Perform message protection communication.

  The unmanaged vehicle flag (365) is turned on when the ground control device is an unmanaged vehicle control device.

  FIG. 3C shows security information (350) relating to ground control devices with different management entities, and includes a ground control device ID (351) of another company, an encryption key (352), and a MAC key (353). The value of the security information (350) is set in advance and is used when notifying the temporary encryption key (361), the temporary APM-MAC key (362), and the temporary AP-MAC key (363).

  FIG. 4A is a configuration diagram of the network configuration information (310), and includes a route ID (311) that is a route identifier and a ground control device ID (312) of each ground control system. That is, it shows that the configuration of the ground system of the route ID is configured by each ground control system including the ground control devices R-ID1 to R-IDn. The ground control devices R-ID1 to R-IDn may include ground control devices with different management entities.

  FIG. 4B is a configuration diagram of the network configuration information (320), and the APM ID (321) of the APM connected to the ground control device and a list of APs associated with the APs connected to each APM. (322).

  FIG. 4C is a configuration diagram of the control processing unit (330). A control message generation / processing unit (331), a random number generation unit (332), a security information distribution unit (333), and a security information ground control unit sharing unit (334).

  5 and 6 show data stored in the storage device (204) of the APM (103) (104) (105).

  FIG. 5A shows the APM-ID (550) which is the identifier of the corresponding APM, the security information (530) (540) in the storage device (204) of the APM (103) (104) (105), and the network configuration. It shows that the information (310) (510) and the control processing unit (520) are stored. The network configuration information (310) indicates that it is the same as the ground control device.

  FIG. 5B is a configuration diagram of security information (530) related to the vehicle control device. The vehicle control device ID (531), the vehicle unique key (532), the encryption key (533), and the APM-MAC key (534). , Status (535), counter (536), random number (537), mechanism designation code (538), temporary encryption key (561), temporary APM-MAC key (562), unmanaged vehicle authentication key (563), management It consists of an outside vehicle flag (564). The vehicle control device ID (531) is an identifier unique to the vehicle for identifying the vehicle, and the vehicle unique key (532) is a unique key for each vehicle. The vehicle control device ID (531) and the vehicle unique key (532) are set in advance. However, the vehicle control device ID and the vehicle unique key of the unmanaged vehicle control device are not set.

  The encryption key (533), the APM-MAC key (534), and the counter (536) are set by an authentication process performed prior to communication between the vehicle and the ground control system.

  The status (535) indicates to what level the authentication process with the vehicle control device is completed.

  The random number (537) is set in the authentication process and is used for generating authentication data. The mechanism designation code (538) is information sent from the vehicle control device at the time of authentication.

  The temporary encryption key (561), the temporary APM-MAC key (562), and the unmanaged vehicle authentication key (563) are information on the unmanaged vehicle control device, and when the unmanaged vehicle control device moves. Is set. For authentication with the unmanaged vehicle control device, an unmanaged vehicle authentication key (563) is used. A temporary encryption key (561) and a temporary APM-MAC key (562) are used for protected communication of control messages when an unmanaged vehicle control apparatus moves.

  The unmanaged vehicle flag (564) is turned on in the case of information on an unmanaged vehicle control device.

  FIG. 5C shows security information (540) related to the AP connected to the corresponding APM. From the AP ID (541) for identifying the AP, the AP unique encryption key (542), and the AP unique MAC key (543). Become. The security information (540) may be distributed from the ground control device (101), but is assumed to be set in advance here.

  FIG. 6A shows network configuration information (510) in which the ground control device ID (511) to which the corresponding APM (103) (104) (105) is connected is stored.

  FIG. 6B is a configuration diagram of the control processing unit (520) of the APM (103) (104) (105). The control processing unit (520) stores a control message protection unit (521) and a security information processing unit (522).

  FIG. 7 shows data stored in the storage device (204) of the vehicle control device (111).

  In FIG. 7A, the storage device (204) of the vehicle control device (111) stores an identifier T-ID (730) indicating the corresponding vehicle control device, security information (700), and a control processing unit (720). It is shown that.

  FIG. 7B is a configuration diagram of the security information (700). The vehicle unique key (702), the encryption key (703), the APM-MAC key (704), the AP-MAC key (712), and the ground control device It consists of ID (705), status (706), counter (707), random number (708), position (710), time (709), mechanism designation code (711), and unmanaged vehicle authentication key (713).

  The vehicle unique key (702) is set in advance.

  The encryption key (703), the APM-MAC key (704), the AP-MAC key (712), and the counter (707) are set in an authentication process that is performed prior to communication between the vehicle and the APM, and are used for protected communication of control messages. used.

  The ground control device ID (705) indicates an identifier of the ground control device that is controlling the vehicle. That is, it means that the corresponding vehicle control device is located under the ground control device ID (705).

  The status (706) indicates to what level the authentication process with the APM has been completed.

  The random number (708) is generated and set during the authentication process and transmitted to the APM.

  The position (710) and the time (709) are information acquired when the train passes over the ground unit (113) (114), and are transmitted from the vehicle control unit (111) to the ground control unit (101) (102). This is one of the control information transmitted to.

  The mechanism designation code (711) is a value for designating an encryption algorithm used at the time of authentication.

  The unmanaged vehicle authentication key (713) is used when authenticating with an unmanaged ground system.

  FIG. 7C is a configuration diagram of the control processing unit (720). A control message generation / processing unit (721), a random number generation unit (722), a security information processing unit (723), and a control message protection unit (724).

  FIG. 8 shows data stored in the storage device (204) of the AP (106) (107).

  In FIG. 8A, the storage device (204) of the AP (106) (107) includes an identifier AP ID (830) indicating the corresponding AP, security information (800) (810), and a control processing unit (820). Indicates that it will be stored.

  FIG. 8B is a configuration diagram of security information (800) related to the vehicle control device, and includes a vehicle control device ID (801), an AP-MAC key (802), a temporary AP-MAC key (804), and a mechanism designation code. (803). The vehicle control device ID (801), the AP-MAC key (802), and the mechanism designation code (803) are set during the authentication process. The temporary AP-MAC key (804) is set when the vehicle control device (111) moves to an unmanaged ground control system or when the unmanaged vehicle control device (111) moves.

  FIG. 8C is a configuration diagram of security information (810) regarding the corresponding AP, and includes an AP-specific encryption key (811) and an AP-specific MAC key (812), which are keys specific to the AP. Assume that the security information (810) is set in advance.

  FIG. 8D is a configuration diagram of the control processing unit (820), which includes a security information processing unit (821) and a control message protection unit (822).

  FIG. 9 shows a process when the train (112) is activated. The vehicle control device (111), via the AP (106), authenticates the APM (103), the ground control device (101) and the communication partner to be a correct partner, and the vehicle control device (111) after the authentication. Share the key to detect the confidentiality and tampering of the data communicated between the computer and the ground system.

  The process at the time of start-up includes a security information processing unit (723) and a random number generation unit (722) of the vehicle control device (111), a security information processing unit (522) of the APM (103), and a random number generation of the ground control device (101). Section (332) and the security information distribution section (333). The random number generation units (722) and (332) are not limited to this, but use, for example, a pseudo random number generation system described in FIPS (Federal Information Processing Standards) 186-2.

  In the vehicle control device (111), in step (901), the vehicle control device (111) is powered on and the random number generation unit (722) is initialized. In initialization of the random number generation unit (722), physical electromagnetic fluctuation information that can be measured when the power is turned on is acquired, and set in the random number generation unit (722) based on the information to generate a random number. . In this case, for example, as an example, it is conceivable to acquire physical electromagnetic fluctuation information having a different value every time, and generate a different random number every time based on the acquired information. In step (902), a mechanism C1 such as an algorithm for authentication and encryption is designated, the initialized random number generator generates a random number R1, and the mechanism C1 and the random number R1 are sent to the APM (103) as an authentication request message. Send.

  Here, the format of the transmission message will be described. 16 and 17 show the communication data format of this embodiment.

  FIG. 16A shows the basic configuration of the communication data format of this embodiment, which is composed of a header (1601), a counter (1602), a data length (1603), and data (1604).

  FIG. 16B shows the configuration of the header (1601), which includes a message type (1611), a transmission source ID (1612), a transmission destination ID (1613), and a security version (1614).

  In the case of the authentication request message sent in step (902), the message type (1611) of the header (1601) indicates a value indicating the authentication request, the transmission source ID (1612) indicates the vehicle control device ID (730), and the transmission destination. A value indicating broadcast is set in ID (1613), and a value indicating the security version of this system is set in security version (1614). Data (1604) is set according to FIG. Specifically, a random number is set in the random number 1 (1701), and an encryption algorithm used for the following authentication is set in the mechanism designation code (1703). The value of the mechanism designation code (1703) is also set in the mechanism designation code (711).

  When the APM (103) receives the authentication request message, the authentication acceptance determination and the mechanism setting in step (911) are performed.

  In the determination of acceptance of authentication, it is confirmed whether or not the transmission source ID (1612) is registered in the vehicle control device ID (301) of the security information (300). If registered, the mechanism designation code (1703) is set to the mechanism designation code (711), and the random number request, the mechanism designation code (1703), and the vehicle control device ID (1702) are sent to the ground control device (101). . If it is not registered, discard the authentication request message.

  When the ground control device (101) receives the random number request and the mechanism designation code (1703), the mechanism setting and random number generation in step (921) are performed.

  In the mechanism setting, the mechanism specifying code (1703) is set in the mechanism specifying code (308). The random number generation unit (332) generates a random number and sends it to the APM (103).

  When the APM (103) receives a random number from the ground control device (101), the ground authentication data is generated in step (912), and a ground authentication data message is generated.

  The ground authentication data message is generated according to the format of FIG. The header (1601) is generated according to the format of FIG. A value indicating the ground authentication data message is set in the message type (1611) of the header (1601), the APM-ID (550) is set in the transmission source ID (1612), and the vehicle control device corresponding to the transmission destination ID (1613). A value indicating the version of this system is set in the ID (531) and the security version (1614). The counter (1602) need not be set. A value indicating the entire length of the ground authentication data message is set in the data length (1603), and the ground authentication data generated in step (912) is set in the data (1604).

  In the ground authentication data, according to the format of FIG. 17B, a random number generated by the vehicle control device is set to random number 1 (1711), and a random number generated by the ground control device is set to random number 2 (1712). It is generated by encryption according to the mechanism designation code (538) of the device ID (531). If the corresponding vehicle control device ID (531) is a managed vehicle control device, the vehicle unique key (532) is used, and if it is an unmanaged vehicle control device, the unmanaged vehicle authentication key (563) is used for encryption. Turn into.

  When the vehicle control device (111) receives the ground authentication data message, verification of the ground authentication data and generation of vehicle authentication data in step (903) are performed.

  In the verification of the ground authentication data, the data (1604) of the received ground authentication data message is decrypted. When the vehicle control device (111) is under the control of the transmission source ID, the vehicle unique key (702) is used for decryption, and when it is different, the unmanaged vehicle authentication key (713) is used for decryption. If the decrypted result does not match the random number sent in step (902), the ground authentication data message is discarded as a verification failure.

  In the generation of the vehicle authentication data, a vehicle authentication data message is generated according to the format of FIG. The header (1601) is generated according to the format of FIG. The message type (1611) of the header (1601) is a value indicating a vehicle authentication data message, the transmission source ID (1612) is a vehicle control device ID (730), and the transmission destination ID (1613) is a value indicating broadcast. In the security version (1614), a value indicating the version of this system is set. The counter (1602) need not be set. A value indicating the length of the entire vehicle authentication data message is set in the data length (1603), and vehicle authentication data is set in the data (1604). In the vehicle authentication data, the random number generated by the ground control device is set to random number 1 (1711) and the random number generated by the vehicle control device is set to random number 2 (1712) according to the format of FIG. 711) is encrypted and generated. The key used for encryption uses the key used for verification of ground authentication data.

  When the APM (103) receives the vehicle authentication data message, the vehicle authentication data in step (913) is verified. The verification of the vehicle authentication data is performed in the same procedure as the verification of the ground authentication data in step (903). If the verification fails, the vehicle authentication data message is discarded. If the verification is successful, key information is requested from the ground control device (101).

  When the ground control device (101) receives the key request, it generates / sets the counter and generates / sets the key in step (922).

  As with the step (921), the counter and key generate four random numbers and set them in the encryption key (303), APM-MAC key (304), AP-MAC key (309), and counter (306). (103).

  When the APM (103) receives the counter / key from the ground control device (101), the counter / key is set and the key is encrypted in step (914) to generate a key message.

  In the counter / key setting, the counter / key received from the ground control device (101) is stored in the counter (536), the encryption key (533), and the APM-MAC key (534) of the security information (530).

  The key message is generated according to the format of FIG. The header (1601) is generated according to the format of FIG. The message type (1611) of the header (1601) has a value indicating a key message, the source ID (1612) has an APM-ID (550), and the destination ID (1613) has a corresponding vehicle control device ID ( 531) and a value indicating the version of this system is set in the security version (1614). A counter (536) is set in the counter (1602), and a value indicating the length of the entire key message is set in the data length (1603). Encrypted key data is set in the data (1604).

  The encrypted key data is generated according to FIG. The encryption key (1731) includes the encryption key (533), the APM-MAC key (1732) includes the APM-MAC key (534), the AP-MAC key (1733) includes the AP-MAC key (535), The ground control device ID (511) is set in the ground control device ID (1734), and encryption is performed according to the mechanism designation code (538). If the corresponding vehicle control device ID (531) is a managed vehicle control device, the vehicle unique key (532) is used, and if it is an unmanaged vehicle control device, the unmanaged vehicle authentication key (563) is used for encryption. Turn into.

  When the vehicle control device (111) receives the key message, the key decryption, key setting, and counter setting in step (904) are performed, and an authentication completion message is sent to the APM (103).

  In the key decryption, the vehicle control device (111) uses the vehicle unique key (702) when the transmission source ID is managed, and the unmanaged vehicle authentication key (713) when the vehicle control device (111) is under the management of the data (1604). ).

  In the key setting, the decrypted encryption key (1731) is used as the encryption key (703), the decrypted APM-MAC key (1732) is used as the APM-MAC key (704), and the decrypted AP-MAC key (1733) is used as the AP- In the MAC key (712), the decrypted ground control device ID (1734) is set as the ground control device ID (705).

  In the counter setting, the counter (1602) is set to the counter (707).

  When the APM (103) receives the authentication completion message, it performs the authentication completion in step (915). When the authentication is completed, the status (535) of the corresponding vehicle control device ID is authenticated, and the result is transmitted to the ground control device (101). The same processing is performed in the ground control device (101).

  Here, the authentication process is described by a method using common key cryptography. However, ISO / IEC 9798, CHAP (Challenge Handshake Authentication Protocol), and the like are known, and these can be used.

  Since the communication between the vehicle control device (111) and the AP (106) is wireless, there may be a case where the message does not reach due to the radio wave condition or the like. However, the APM (106) does not periodically complete the authentication process. A message corresponding to the authentication status is transmitted to the apparatus. The vehicle control device (111) also responds to the case where the message is lost by periodically transmitting a message corresponding to the authentication status.

  The ground control device (101) that has succeeded in mutual authentication with the vehicle control device (111) performs protected communication of control messages between the corresponding vehicle control device (111) and all APMs and APs that are under management. In order to enable this, it is necessary to notify the APM (103) (104) and AP (106) (107) connected to the ground control device (101) of the security information necessary for the protection communication of the control message. The procedure of this security information sharing process is shown in FIG.

  First, the ground control device (101) performs key output in step (1101). In the key output, an APM key notification message is created according to the format of FIG. 16A and is periodically transmitted to the APM. The header (1601) is generated in accordance with the format of FIG. The message type (1611) is a value indicating an APM key notification message, the transmission source ID (1612) is a ground control device ID (340), the transmission destination ID (1613) is a value indicating broadcast, and the security version In (1614), the security version of this system is set. The counter (1602) need not be set. In the data length (1603), a value indicating the entire length of the APM key notification message is set, and in the data (1604), security information necessary for protection communication of the control message is set according to the format of FIG. The vehicle control device ID (1811) is the vehicle control device ID (301), the encryption key (1812) is the encryption key (303), and the APM-MAC key (1813) is the APM-MAC key. (304) AP-MAC key (309) is set in AP-MAC key (1814), and mechanism designation code (308) is set in mechanism designation code (1815).

  When the APM (103) (104) receives the APM key notification message, status setting, key setting, and AP-MAC key output in step (1104) are performed.

  In the status setting, the status (535) of the corresponding vehicle control device is authenticated. The key setting includes the received encryption key (1812), APM-MAC key (1813), and mechanism specification code (1815), respectively, the security information (530) encryption key (533), APM-MAC key (534), and mechanism specification. Set to code (538).

  The AP-MAC key output creates an AP key notification message according to the format of FIG. The header (1601) is generated in accordance with the format of FIG. The message type (1611) is a value indicating the AP key notification message, the transmission source ID (1612) is the APM-ID (550), the transmission destination ID (1613) is the ID (541) of each AP, In the security version (1614), the security version of this system is set. The counter (1602) need not be set. A value indicating the entire length of the AP key notification message is set in the data length (1603), and an encrypted AP-MAC key is set in the data (1604). As for the encrypted AP-MAC key, the vehicle control device ID (531) of the vehicle control device (111) is assigned to the vehicle control device ID (1821), and the AP-MAC key (1822) in accordance with the format of FIG. ) Is set with the AP-MAC key (1813) of the APM key notification message, the mechanism specification code (1823) is set with the mechanism specification code (1815), and encrypted with each AP-specific encryption key (542). The In the falsification detection code (1625), the header (1601), the counter (1602), the data length (1603), and the data (1604) are input, and the falsification detection code generated using each AP-specific MAC key (543) ( (Also referred to as MAC).

  When the AP (106) (107) receives the AP key notification message, AP-MAC key setting in step (1109) is performed.

  In the AP-MAC key setting, the alteration detection code is verified and decrypted.

  In the verification of the falsification detection code, the received AP key notification message header (1601), counter (1602), data length (1603), and data (1604) are input, and the falsification generated with the AP unique MAC key (812). It is confirmed whether the detection code matches the falsification detection code (1625). If they do not match, the AP key notification message is discarded as the alteration detection code verification failure.

  In the decryption, the vehicle control device ID (1821), the AP-MAC key (1822), the mechanism designation code (1823) obtained by decrypting the data (1604) with the AP unique encryption key (542), and the security information (800 ), Vehicle control device ID (801), AP-MAC key (802), and mechanism designation code (803).

  Here, when an AP is stolen, leakage of the AP-MAC key is prevented by invalidating the unique encryption key and unique MAC key of the corresponding AP. However, it is also possible for all APs to use the same encryption key and MAC key according to the requirements of the system.

  FIG. 10 shows control message transmission / reception processing performed by the ground control device (101) and the vehicle control device (111) via the APM (103) (104) and the AP (106) (107).

  Control message transmission / reception includes control message generation / processing unit (331) of ground control device (101), control message protection unit (521) of APM (103) (104), and control message protection of AP (106) (107). Part (822), the control message generating / processing part (721) and the control message protecting part (724) of the vehicle control device (111).

  In step (1001), the ground control device (101) generates a control message for the corresponding vehicle control device (111) in accordance with the format of FIGS.

  The message type (1611) of the header (1601) indicates a value indicating a control message, the transmission source ID (1612) indicates the ground control device ID (340) of the corresponding ground control device (101), and the transmission destination ID (1613). ) Is set to the corresponding vehicle control device ID (301), and the security version (1614) is set to a value indicating the presence or absence of encryption and the presence or absence of MAC assignment. A counter (306) of the corresponding vehicle control device is set in the counter (1602), a value indicating the length of the entire control message is set in the data length (1603), and control information is set in the data (1604).

  The generated control message is transmitted to the APM (103) (104).

  When the APM (103) (104) receives the control message from the ground control apparatus (101), the APM (103) (104) stores the counter and protects the control message (encryption and MAC assignment) in step (1002).

  In storing the counter, the counter (1602) of the received control message is set in the counter (536) of the corresponding vehicle control device.

  The protection of the control message is determined by the value of the security version (1614) of the control message. When the security version (1614) of the control message indicates that message protection is present, a protection control message is generated according to FIG. 16 (c).

  The header (1601) and counter (1602) have the header (1601) and counter (1602) values of the received control message, and the data length (1603) is the data length of the received control message and the length of the falsification detection code. Set the value after adding. In the data (1624), a value obtained by encrypting the data (1604) of the received control message with the encryption key (533) of the corresponding vehicle control device is set. The MAC (tamper detection code 1625) is generated with the header (1601), counter (1602), data length (1603), and data (1624) as input and the APM-MAC key (534) of the corresponding vehicle control device. Set the tamper detection code.

  In step (1003), the vehicle control device (111) performs counter verification / storage, falsification detection code verification, and decryption of the control message for the received protection control message.

  The verification of the counter (1602) confirms that the difference between the counter (536) of the security information (530) and the counter (1602) of the protection control message is within a certain threshold. If it is not within the threshold, the protection control message is discarded. If it is within the threshold, the counter (1602) is set in the counter (707) of the security information (700).

  The MAC (1625) is verified by receiving the header (1601), counter (1602), data length (1603), and data (1624) of the received protection control message, and inputting the APM-MAC key (704) of the security information (700). ) To generate a falsification detection code and confirm that it is the same value as the MAC (1625) of the received protection control message. If the values are different, the protection control message is discarded as a verification failure of the falsification detection code. When the values are the same, the data (1624) is decrypted using the encryption key (703) of the security information (700), and control is performed on various devices of the vehicle according to the decrypted data.

  Next, the vehicle control device (111) generates a response message in step (1007), encrypts the response message, and assigns a MAC.

  In response message generation, a response message is generated in accordance with the formats of FIGS. The message type (1611) in the header (1601) indicates a value indicating a response message, the transmission source ID (1612) in the header (1601) includes the vehicle control device ID (730), and the transmission destination ID (in the header (1601)) ( 1613) is the ground control device ID (705) of the security information (700), the counter (1602) is the security information (700) counter (707), and the data length (1603) is the response message length. Set. Response information is set in the data (1604).

  In response message encryption and MAC assignment, a protection response message is created according to the format of FIG. The header and counter of the response message are added to the header (1601) and the counter (1602), and the length of the alteration detection code for APM and the alteration detection code for AP is added to the data length of the response message to the data length (1603). Set the value. A value obtained by encrypting the response message data (1604) with the encryption key (703) is set in the data (1624). For MAC (1625), the header (1601), counter (1602), data length (1603), and data (1624) are input, and the tampering generated with the APM-MAC key (704) and AP-MAC key (712) Set each detection code.

  When the AP (106) receives the protection response message from the vehicle control device (111), the AP (106) performs the falsification detection code verification process in step (1004). The verification of the falsification detection code is performed in the same manner as the verification of the falsification detection code in step (1003) using the AP-MAC key (802) of the corresponding vehicle control device. If the verification fails, the protection response message is discarded here, and if the verification is successful, it is transmitted to the APM (103).

  In step (1005), the APM (103) verifies the counter (1602), verifies the MAC (1625), decrypts the data (1624), and generates a response message.

  The counter (1602) is verified using the counter (536) of the security information (530) in the same manner as the counter verification in step (1003). If the counter verification fails, the protection response message is discarded.

  The verification of the MAC (1625) is performed in the same procedure as the MAC verification of the step (1003) using the APM-MAC key (534) of the security information (530). If the MAC verification fails, the protection response message is discarded.

  The decryption of the data (1624) is performed in the same procedure as the decryption of the data in step (1003) using the encryption key (533) of the security information (530).

  The response message is generated according to the format of FIG. The header of the received protection response message is stored in the header (1601), the counter of the received protection response message is stored in the counter (1602), and the alteration of the AP is detected from the data length of the received protection response message in the data length (1603). A value obtained by subtracting the length of the code and the length of the alteration detection code for APM is set in the data (1604), and the decoded data is set.

  The generated response message is transmitted to the ground control device (101).

  When the ground control device (101) receives the response message, in step (1006), the value of the response message counter (1602) is incremented by 1 and set in the counter (306) of the security information (300).

  This process is repeated periodically.

  Next, a process when it is detected that the timing for moving the ground control device (101) from the subordinate of the ground control device (101) as the vehicle moves will be described with reference to FIG. FIG. 11 shows security information sharing processing.

  When the ground control device (101) detects the movement of the vehicle control device (111), a destination determination in step (1102) is performed. When the management subject moves to the same ground control device, the counter output and the key output in step (1110) are performed.

  The counter output is generated according to the format of FIGS. The message type (1611) of the header (1601) has a value indicating a counter notification message, the transmission source ID (1612) has a ground control device ID (340), and the transmission destination ID (1613) has a destination ground control. Set the device ID. It is not necessary to set the counter (1602). In the data length (1603), the length of the entire counter notification message is set. Data (1604) is generated in accordance with the format of FIG. A vehicle control device ID (301) of the vehicle control device (101) is set in the vehicle control device ID (1841), and a counter (306) is set in the counter (1842). For key output, a key notification message is created in the same procedure as in step (1101). The created counter notification message and key notification message are transmitted to the ground control device (102).

  When the ground control device (102) receives the counter notification message and the key notification message, the status change, counter setting, and key setting in step (1106) are performed. In the status change, the status (305) of the same vehicle control device ID (301) as the vehicle control device ID (1811) of the key notification message is authenticated.

  In the counter setting, the counter (1842) is set to the counter (306) of the same vehicle control device ID (301) as the vehicle control device ID (1841) of the counter notification message.

  In the key setting, the encryption key (303), APM-MAC key (304), AP-MAC key (309) of the same vehicle control device ID (301) as the vehicle control device ID (1811) of the key notification message is encrypted ( 1812), APM-MAC key (1813), and AP-MAC key (1814) are set.

  Then, after outputting the key in step (1107), a key notification message is transmitted to the subordinate APM as in step (1101). APM also performs key setting and transmission of an AP key notification message in the same manner as in step (1104). The AP also performs key setting in the same manner as in step (1109).

  When the ground control device (102) receives a response message from the vehicle control device (111), the ground control device (102) transmits a movement notification message to the ground control device (101) after confirming the movement in step (1108). Notify that the move is complete.

  When the ground control device (101) receives the movement notification message, the status update is made unauthenticated in step (1103), and the key notification message transmission, the counter notification message transmission, and the control message transmission to the vehicle control device (101) are finished. To do.

  Note that even if the movement notification message has not arrived, if it is recognized that the response message has not arrived from the APM (103) (104) for a certain period of time, step (1103) is performed.

  Next, the processing when it is determined in step (1102) to move to an unmanaged ground control device will be described with reference to FIG. FIG. 12 shows security information sharing processing.

  If it is determined in step (1102) that the mobile station is to be moved to an unmanaged ground control device, the counter output, temporary key generation, and temporary key output in step (1201) are performed. The temporary key is used for protection communication of control messages until the ground control device (102) at the destination and the vehicle control device (111) complete the authentication.

  In the counter output, a counter notification message is created as in step (1110).

  In the temporary key generation, a random number is generated by a random number generation unit (332) of the ground control device (101), and the generated random number is used as a temporary encryption key, a temporary APM-MAC key, a temporary AP-MAC key, an unmanaged vehicle authentication key. And The generated temporary encryption key, temporary APM-MAC key, temporary AP-MAC key, and unmanaged vehicle authentication key are the temporary encryption key (361), temporary APM-MAC key (362), and temporary AP of the security information (300). -Set the MAC key (363) and the unmanaged vehicle authentication key (364), respectively.

  In the temporary key output, a temporary key notification message according to FIG. The header (1601) follows the format shown in FIG. 16B, the message type (1611) indicates a value indicating a temporary key notification message, the transmission source ID (1612) indicates a ground control device ID (340), and the transmission destination ID. In (1613), the destination ground control device ID (351) is set, and in the security version (1614), the corresponding security version is set. Nothing is specified for the counter (1602). In the data length (1603), a value indicating the length of the entire temporary key notification message is set. In the data (1624), according to the format of FIG. 18C, the vehicle control device ID (301) is the vehicle control device ID (1831), the temporary encryption key (361) is the encryption key (1832), and the APM-MAC The temporary APM-MAC key (362) as the key (1833), the temporary AP-MAC key (363) generated as the AP-MAC key (1834), and the authentication key for unmanaged vehicle generated as the authentication key (1835) ( 364) is set in the mechanism designation code (1836) with the mechanism designation code (308) and encrypted with the encryption key (352) of the destination ground control apparatus ID. In the falsification detection code (1625), the falsification detection code generated with the MAC key (353) is set with the header (1601), counter (1602), data length (1603), and data (1624) as inputs.

  When the ground control device (102) receives the temporary key notification message, it performs verification of the falsification detection code in step (1202), decryption of the temporary key notification message, temporary key setting, status setting, counter setting, and temporary key output.

  The tampering detection code is verified by using the received key notification message header (1601), counter (1602), data length (1603), and data (1624) as inputs, and the same manufacturer's ground control device ID (351) as the source ID. The falsification detection code is generated with the MAC key (353), and it is confirmed whether it is the same value as the falsification detection code (1625). If the values are different, the key notification message is discarded as a falsification detection code verification failure.

  In the decryption of the key notification message for the unmanaged ground control device, the data (1624) is decrypted with the encryption key (352) of the ground control device ID (351) that is the same as the transmission source ID.

  The key setting includes the vehicle control device ID (1831), the encryption key (1832), the APM-MAC key (1833), the AP-MAC key (1834), and the authentication key (1835) of the decrypted data (1624) as security information ( 300) vehicle control device ID (301), temporary encryption key (361), temporary APM-MAC key (362), temporary AP-MAC key (363), and unmanaged vehicle authentication key (364). Further, the unmanaged vehicle flag (365) is turned on.

  In the status setting, similarly to the status setting in step (1104), “authenticated” is set in the status (305) of the vehicle control device ID (1831) of the temporary key notification message.

  The counter setting is performed in the same manner as in step (1106).

  In the temporary key output, an APM temporary key notification message is generated according to the format of FIG. The header (1601) follows the format of FIG. 16B, the message type (1611) indicates a value indicating the APM temporary key notification message, the transmission source ID (1612) indicates the ground control device ID (340), and the transmission destination ID. An ID indicating broadcasting is set in (1613), and a value indicating the security version of this system is set in the security version (1614). Nothing is set in the counter (1602). In the data length (1603), the length of the APM temporary key notification message is set. According to FIG. 18C, the data (1604) includes security information in the vehicle control device ID (1831), the encryption key (1832), the APM-MAC key (1833), the AP-MAC key (1834), and the authentication key (1835). (300) vehicle control device ID (301), temporary encryption key (361), temporary APM-MAC key (362), temporary AP-MAC key (363), and unmanaged vehicle authentication key (364) are set. . However, the data (1604) is not encrypted in the APM key notification message.

  When the APM (105) receives the temporary key notification message for APM, temporary key setting and temporary key output in step (1203) are performed. In the temporary key setting, the vehicle controller ID (1831), the encryption key (1832), the APM-MAC key (1833), and the authentication key (1835) of the data (1604) are used as the vehicle controller ID (531) of the security information (530). ), Temporary encryption key (561), temporary APM-MAC key (562), and unmanaged vehicle authentication key (563). Further, the unmanaged vehicle flag (564) is turned on.

  In the temporary key output, an AP key notification message is created in accordance with the format of FIG. The header (1601) follows the format of FIG. 16B, the message type (1611) indicates the value indicating the temporary key notification message for AP, the source ID (1612) indicates the APM ID (550), and the destination ID (1613). ) Is set to the ID indicating broadcast, and the security version (1614) is set to a value indicating the security version of this system. Nothing is set in the counter (1602). In the data length (1603), the length of the temporary key notification message for AP is set. In accordance with FIG. 18B, the data (1624) includes the vehicle control device ID (531) corresponding to the vehicle control device ID (1821), and the AP-MAC key (1822) of the received APM key notification message AP- The MAC key (1834), the mechanism specification code (1836) are set in the mechanism specification code (1823), and the value encrypted with the unique encryption key (542) of each AP is set. In the alteration detection code (1625), the header (1601), the counter (1602), the data length (1603), and the data (1624) are input, and the alteration detection code generated with each AP unique MAC key (543) is set. .

  When the AP receives the temporary key notification message for AP, in step (1204), the alteration detection code and decryption are performed in the same procedure as in step (1109). The vehicle control device ID (1821), AP-MAC key (1822), mechanism designation code (1823) of the decrypted data (1624), security specification (800), vehicle control device ID (801), and temporary AP-MAC key (804) and the mechanism designation code (803), respectively.

  Further, FIG. 13 will be used to explain the processing when it is determined in step (1102) to move to an unmanaged ground control device. FIG. 13 shows security information sharing processing.

  When it is determined in step (1102) that the ground control device is to be moved to an unmanaged ground control device, the ground control device (101) is subordinate to the APM (103) (104), AP (106) (107) and the corresponding vehicle control device ( 111), a temporary key notification message for APM and a key notification message in step (1301) are generated and transmitted to the APM (103) (104) together with the control message.

  The generation of the APM key notification message is the same as the generation of the temporary key notification message for APM in step (1202), the generation of the key notification message is in step (1101), and the generation of the control message is the same as in step (1001).

  When the APM (103) (104) receives the temporary key notification message for APM, the key notification message, and the control message, the processing is performed in the same procedure as steps (1204) (1104) (1002) in step (1302). Create a temporary key notification message and a protection control message. Also, a temporary key notification message for the vehicle control device is created.

  When the AP (106) (107) receives the AP temporary key notification message, the temporary key is set in the same procedure as in step (1204) in step (1304).

  When the vehicle control device (111) receives the temporary key notification message for vehicle control device and the protection control message, the protection control message is processed in the same procedure as in step (1003) in step (1303). The temporary key notification message for the vehicle control device verifies the falsification detection code (1625) using the APM-MAC key (704) of the vehicle control device (111). If verification of the falsification detection code fails, the temporary key message for the vehicle control device is discarded.

  If the verification is successful, the data (1624) is decrypted using the encryption key (703). Decrypted data encryption key (1731), APM-MAC key (1732), AP-MAC key (1733), unmanaged vehicle authentication key (1734) encryption key (703), APM-MAC key (704), The AP-MAC key (712) and the unmanaged vehicle authentication key (713) are set.

  And the authentication process between the ground control apparatus and vehicle control apparatus from which a management main body differs is performed. This process will be described with reference to FIG. FIG. 14 shows this authentication process.

  In step (1401), the vehicle control device (101) generates a protection response message according to the same procedure as in step (1004), and generates an authentication request message according to the same procedure as in step (902). However, a value indicating a response message with an authentication message is set in the message type (1611) of the protection response message. The generated protection response message and authentication request message are transmitted to the APM (103) (104).

  When the APM (103) (104) receives the protection response message and the authentication request message, in step (1402), the verification of the protection response message by the same procedure as in step (1005) and the authentication by the same procedure as in step (911) are performed. Accept the request. However, a temporary encryption key (561) and a temporary APM-MAC key (562) are used as keys for verification of the protection response message. A response message and a random number request are transmitted to the ground control apparatus (101).

  When the ground control device (101) receives the response message and the random number request, in step (1403), a control message is created in the same procedure as in step (1001), a mechanism is set in the same procedure as in step (921), and a random number is created. The APM (103) (104) is notified.

  When the APM (103) (104) receives the control message and the random number, the ground authentication data is generated and the control message is protected in step (1404). The generation of the ground authentication data is performed in the same procedure as in step (912) using the unmanaged vehicle authentication key (563) of the corresponding vehicle control device (101). The protection of the control message is performed in the same procedure as steps (1001) to (1006) using the temporary encryption key (561) and the temporary APM-MAC key (562).

  The re-authentication process is performed according to the procedure shown in FIG. FIG. 15 shows this re-authentication process. As shown in FIG. 15, when the ground control device sends a re-authentication request to the vehicle control device (101) in step (1511), the normal control message protection communication is performed as in steps (1401) to (1406). However, re-authentication processing is performed in steps (1501) to (1509).

  Here, a message related to authentication and a message related to control are created and sent together, but may be processed as one message, and if the message length that can be sent is limited, The authentication message may be divided according to the length.

  In addition, here, the communication path of the ground control system, that is, the communication path between the ground control devices and between the ground control device and the APM is assumed to be safe, and security measures are not taken for the corresponding communication routes. Can be equally protected by authentication and key sharing technology. Also, the mechanism designation code or the like can be omitted when the same mechanism (encryption algorithm or the like) is used as the system.

  Thus, according to the present embodiment, in a wireless control security system that captures and controls a moving body such as a train, the ground system is associated with security processing by adopting a three-stage configuration of AP, APM, and ground control device. It is possible to provide a wireless control security system that reduces the load, enables expansion to a large-scale system, and allows a terrestrial control device, which is a device behind, to generate a security state and facilitate multi-terminal startup processing. Of course, it is possible to adopt only one of these features.

  This system can be applied not only to control of trains and the like, but also to service systems related to moving objects such as cars and pedestrians.

  101, 102: Ground control device, 103, 104, 105: APM, 106, 107, 108: AP, 111: Vehicle control device, 112: Train, 113, 114: Ground child, 201: Terminal, 202: CPU, 203 : Memory, 204: Storage device, 205: Communication IF, 206: Peripheral device connection IF, 207: Display device, 210: Network.

Claims (3)

A wireless control security system including a vehicle control device included in a moving body and a ground system that communicates with the vehicle control device,
The ground system includes a plurality of access points, a plurality of access point control devices connected to the plurality of access points, and one or a plurality of ground control devices connected to the plurality of access point control devices. Consisting of a stage structure,
The ground train control unit generates a key for realizing the security function sends the generated the key to the access point control apparatus,
The wireless control security system, wherein the access point control device generates a key message obtained by encrypting the received key and transmits the key message to the vehicle control device . The wireless control security system according to claim 1,
The vehicle control device performs decryption of the key based on the key message received from the access point control device, and transmits an authentication completion message to the access point control device.
When the access point control device receives the authentication completion message, authentication is completed, and the result is sent to the ground control device.
When the ground control device receives the result, the authentication is completed,
The ground control device, when authentication is completed, further creates a key notification message for the access point control device, and transmits to the access point control device,
When the access point control device receives the access point control device key notification message, the access point control device creates an access point key notification message and transmits it to the access point . The wireless control security system according to claim 2,
A wireless control security system, wherein when the access point is stolen, the unique encryption key and the unique MAC key of the stolen access point are invalidated .

Images