JP5605294B2 - Authentication system and authentication method - Google Patents

Description

  The present invention relates to an authentication system and an authentication method, and in particular, includes a vehicle capable of traveling and an electronic device that performs communication and connection with the vehicle to execute a predetermined function, and the electronic device that is connected and connected to the vehicle has a predetermined function. The present invention relates to an authentication system and an authentication method suitable for causing a vehicle to authenticate an electronic device before execution.

  Conventionally, an authentication system that uses a public key certificate for authentication between devices is known (for example, see Patent Document 1). In this authentication system, mutual authentication is performed before a plurality of devices exchange information. Specifically, a plurality of devices perform mutual authentication by verifying the other party's public key certificate before exchanging information. This public key certificate includes information indicating the attribute (serial number) of each device, the expiration date of information, and the like.

JP 2007-274380 A

  By the way, the above-described authentication system includes a vehicle that can run and a maintenance device for the vehicle (for example, a failure diagnosis device that diagnoses a vehicle failure used in a vehicle dealer or an update execution device that updates data and software of an in-vehicle ECU). When it is applied to communication connection with an electronic device such as the above, inconvenience occurs when authentication before information exchange between the vehicle and the electronic device is performed based on the attribute and the expiration date. For example, in such a configuration, once authentication between the vehicle and the electronic device is completed, information can be exchanged between the two anywhere within the validity period. It was possible to take place at a location off the dealer's premises. For this reason, in the above-described authentication system, there is a concern that security may not be ensured when authenticating the vehicle and the electronic device.

  SUMMARY An advantage of some aspects of the invention is that it provides an authentication system and an authentication method capable of improving security in authentication between a vehicle and an electronic device.

  The above object includes a vehicle capable of traveling and an electronic device that communicates with the vehicle to execute a predetermined function, and before the electronic device that is connected to the vehicle to perform the predetermined function, An authentication system for causing a vehicle to authenticate the electronic device, wherein the electronic device is configured to store at least information on effective positions at which execution of the predetermined function is permitted, and when the vehicle is in communication with the vehicle, the vehicle Authentication information transmission means for transmitting authentication information including information on the effective position stored in the storage means, and the vehicle receives the authentication information transmitted from the electronic device connected in communication. Authentication information receiving means, own vehicle position detecting means for detecting the own vehicle position, and the own vehicle position detected by the own vehicle position detecting means as information in the authentication information received by the authentication information receiving means. Position authentication means for determining whether or not the effective position is included, and execution of the predetermined function in the electronic device when the position authentication means determines that the vehicle position matches the effective position And an apparatus operation permission means for permitting the operation.

  Further, the above object is an authentication method for causing the vehicle to authenticate the electronic device before the electronic device communicably connected to the travelable vehicle performs a predetermined function, wherein the electronic device communicates with the vehicle. An authentication information transmitting step of transmitting authentication information including information on an effective position at which execution of the predetermined function is permitted to the vehicle when connected; and the authentication information transmitted from the electronic device to which the vehicle is connected. In the authentication information receiving step, the vehicle position detecting step in which the vehicle detects the vehicle position, and the vehicle position in which the vehicle is detected in the vehicle position detecting step in the authentication information receiving step. A position authentication step for determining whether or not the effective position included as information in the received authentication information matches, and the vehicle in the position authentication step; Position is achieved by an authentication method and an equipment operation permission step of permitting execution of the predetermined function in the electronic device when it is determined that matching the effective position.

  ADVANTAGE OF THE INVENTION According to this invention, the security in authentication with a vehicle and an electronic device can be improved.

It is a block diagram of the authentication system which is one Example of this invention. It is the figure showing the state by which the maintenance apparatus 14 is put before the maintenance apparatus with which the authentication system of a present Example is equipped, and a vehicle are connected by communication. It is a figure showing the specific content of the electronic certificate which the certificate issuing apparatus issues in a present Example. It is a figure showing the specific content of the effective area contained in the electronic certificate which a certificate issuing apparatus issues in a present Example. It is a flowchart of an example of the main routine which the vehicle side performs in the authentication system of a present Example. It is a flowchart of an example of the subroutine which the vehicle side performs in the authentication system of a present Example.

  Hereinafter, specific embodiments of an authentication system according to the present invention will be described with reference to the drawings.

  FIG. 1 shows a configuration diagram of an authentication system 10 according to an embodiment of the present invention. As shown in FIG. 1, the authentication system 10 of the present embodiment includes a vehicle 12 that can travel and move, and a maintenance device 14 that communicates with the vehicle 12 and executes a predetermined function that will be described later. . The authentication system 10 is a vehicle authentication system that causes the vehicle 12 to authenticate the maintenance device 14 before the maintenance device 14 connected to the vehicle 12 performs a predetermined function.

  The maintenance device 14 is an electronic device mainly composed of a microcomputer and having a memory and the like. The maintenance device 14 is, for example, a device for performing vehicle maintenance provided at least one for each vehicle maintenance company, vehicle dealer, or vehicle repair factory. The predetermined function executed by the maintenance device 14 includes, for example, a function for collecting fault data accumulated in each on-board electronic control unit (ECU) in the vehicle 12 and diagnosing a vehicle fault, or the ECU has A function for updating data and software. The maintenance device 14 is communicatively connected to the vehicle 12 via an interface. The maintenance device 14 can be attached to and detached from the vehicle 12 through an interface.

  FIG. 2 is a diagram illustrating a state in which the maintenance device 14 is placed before the maintenance device 14 included in the authentication system 10 of the present embodiment and the vehicle 12 are connected to each other by communication. The maintenance device 14 is placed in a state of being connected to the network IF 16 before being connected to the vehicle 12, and can access the certificate issuing device 18 through the network IF 16. The maintenance device 14 is detachable from the network IF 16. The certificate issuing device 18 is installed in a certificate authority operated by an electronic certificate issuing service company, a government, a company, or the like, and issues an electronic certificate required by the maintenance device 14 connected for communication through the network IF 16. Is possible. The maintenance device 14 can acquire an electronic certificate issued from the certificate issuing device 18 to be accessed and store it in the memory.

  The certificate issuing device 18 has an ID for identifying each maintenance device 14 that can be accessed in advance, a function that is permitted to be executed in the maintenance device 14, a function permitted to be executed in the maintenance device 14, and the maintenance device 14. Various types of information such as the area where execution is permitted (for example, in the premises of the dealer where the maintenance equipment 14 is installed, the town, ward, city, etc. where the dealer is located; hereinafter referred to as an effective area) are stored in memory Is stored. The electronic certificate issued by the certificate issuing device 18 may be encrypted using the public key by the certificate issuing device 18 or the acquired maintenance device 14.

  FIG. 3 is a diagram showing specific contents of the electronic certificate issued by the certificate issuing device 18 according to the present embodiment. FIG. 4 is a diagram showing the specific contents of the valid area included in the electronic certificate issued by the certificate issuing device 18 of this embodiment. For example, as shown in FIG. 3, the electronic certificate issued by the certificate issuing device 18 is the ID of the maintenance device 14 to which the electronic certificate is issued, the public key, and the execution of a predetermined function in the maintenance device 14. The permitted expiration date (for example, up to ○ month × day Δ), the permitted function permitted to be executed on the maintenance device 14 (for example, only the failure diagnosis function), the predetermined function on the maintenance device 14 It includes various information such as the valid area where execution is permitted and the signature of the issuer who is the issuer of the electronic certificate. Also, the valid area information in the digital certificate includes various types of information such as the north limit latitude, the south limit latitude, the east end longitude, and the west end longitude of the valid area, as shown in FIG.

  The vehicle 12 has a maintenance device connection ECU 20 that is connected to the maintenance device 14 through an interface. The maintenance device connection ECU 20 is connected to the in-vehicle LAN 22 and can execute communication according to the communication protocol of the in-vehicle LAN 22 with the in-vehicle device connected to the in-vehicle LAN 22. As will be described in detail later, the maintenance device connection ECU 20 has the authority to permit or deny execution of a predetermined function of the maintenance device 14 that is connected by communication via an interface (that is, a function to authenticate the maintenance device 14). And when the authentication of the maintenance device 14 is completed, the vehicle data necessary for executing the predetermined function of the maintenance device 14 is collected via the in-vehicle LAN 22, and the maintenance device 14 is collected. It is possible to transfer.

  The maintenance device connection ECU 20 has a built-in clock. For example, the timepiece can receive time data indicating the current time by receiving a radio wave from a transmission station that transmits a standard radio wave, and can record the current time. The maintenance device connection ECU 20 can acquire the current time based on the current time carved by the clock. Further, the maintenance device connection ECU 20 has a secret key that is paired with a public key that can be included in the electronic certificate issued by the certificate issuing device 18 or transmitted by the maintenance device 14.

  A car navigation system 24 is connected to the in-vehicle LAN 22. The car navigation system 24 receives GPS signals transmitted as radio waves from a plurality of GPS satellites orbiting the earth, and on the earth of the vehicle 12 on the basis of advanced calculation results using the received GPS signals. It is possible to detect a geographical position (vehicle position) as at least latitude and longitude information. For example, the car navigation system 24 can display a mark indicating the detected position of the vehicle on the road map on a display that is visible to the driver or the like. In addition, the car navigation system 24 detects the vehicle position at a predetermined cycle, and sends vehicle position information to the in-vehicle LAN 22 for each detection. The maintenance device connection ECU 20 can receive the vehicle position information transmitted from the car navigation system 24 to the in-vehicle LAN 22, acquire the vehicle position information, and temporarily store it in the memory.

  Next, an authentication operation of the authentication system 10 according to the present embodiment will be described with reference to FIGS. FIG. 5 shows a flowchart of an example of a main routine executed by the maintenance device connection ECU 20 of the vehicle 12 in the authentication system 10 of the present embodiment. FIG. 6 shows a flowchart of an example of a subroutine executed by the maintenance device connection ECU 20 of the vehicle 12 in the authentication system 10 of the present embodiment.

  In this embodiment, the maintenance device 14 is connected to the network IF 16 before being connected to the vehicle 12, that is, before executing a predetermined function (see FIG. 2). The connection of the maintenance device 14 to the network IF 16 is preferably performed in a room whose entry is restricted by a vehicle maintenance company or the like.

  The maintenance device 14 communicates with the vehicle 12 to execute a predetermined function. Immediately before the maintenance device 14 is connected to the network IF 16, it first accesses the certificate issuing device 18 to issue an electronic certificate. Request. The issue request by the maintenance device 14 is made by specifying the ID of the maintenance device 14. When the certificate issuance apparatus 18 receives a certificate issuance request from the maintenance device 14 communicatively connected via the network IF 16, the certificate issuance device 18 performs a process based on the information corresponding to the maintenance device 14 stored in the memory. 3. Generate and issue an electronic certificate including information as shown in FIG. The generated / issued electronic certificate includes information on an expiration date and an effective area where execution of a predetermined function is permitted in the maintenance device 14 based on the generation / issue time.

  After making an electronic certificate issuance request to the certificate issuing device 18 as described above, the maintenance device 14 acquires the electronic certificate issued by the certificate issuing device 18 and stores it in the memory. That is, the electronic certificate stored in the memory is updated to the latest one. After the maintenance device 14 stores the electronic certificate in the memory, the user (maintenance staff) releases the connection between the maintenance device 14 and the network IF 16. The maintenance device 14 acquires the electronic certificate issued by the certificate issuing device 18 and stores it in the memory. After the connection with the network IF 16 is released, the maintenance device 14 next approaches the vicinity of the vehicle 12 to be maintained by the user. Alternatively, the vehicle is brought into the passenger compartment and connected to the maintenance device connection ECU 20 of the vehicle 12 through an interface (see FIG. 1).

  The maintenance device connection ECU 20 of the vehicle 12 can detect the communication connection with the maintenance device 14 and, when detecting the communication connection, authenticates the maintenance device 14 connected to the communication. At the time of this authentication, the electronic certificate stored in the memory of the maintenance device 14 is sent to the maintenance device connection ECU 20. The maintenance device connection ECU 20 receives the electronic certificate stored in the memory by the maintenance device 14 and sent from the maintenance device 14, and authenticates the maintenance device 14 based on the contents included in the electronic certificate. Do.

  The maintenance device connection ECU 20 acquires an electronic certificate stored in the memory by the maintenance device 14 from the maintenance device 14 to be connected for communication (step 100). Then, the form (form) of the acquired electronic certificate and the signature of the issuer that issued the electronic certificate included in the electronic certificate are verified (step 110). As a result of the verification, if it is determined that both the form and the issuer signature of the acquired electronic certificate match the desired one (at the time of an affirmative determination in step 120), then the maintenance included in the acquired electronic certificate The effective area where the execution of the predetermined function in the work device 14 is permitted is verified (step 130).

  Specifically, the maintenance device connection ECU 20 first verifies the valid area in step 130 in the valid area where the execution of the predetermined function is permitted in the maintenance device 14 included in the acquired electronic certificate. The information on the north limit, south limit, east end, and west end of the effective area is acquired from the information (step 132), and the car navigation system 24 is detected based on the GPS signal and transmitted from the car navigation system 24 to the in-vehicle LAN 22 The own vehicle position information is received, and the latitude and longitude information of the current position where the own vehicle 12 is located are acquired (step 134). The car navigation system 24 detects the position of the vehicle based on the GPS signal at a predetermined cycle and sends the vehicle position information to the in-vehicle LAN 22, and the maintenance device connection ECU 20 detects the current position of the vehicle 12. As the information, the latest information is always acquired from the car navigation system 24 through the in-vehicle LAN 22 and temporarily stored in the memory.

  In the maintenance equipment connection ECU 20, the latitude and longitude indicating the current position of the host vehicle 12 acquired in step 134 is surrounded by the latitudes in the north and south limits and the east and west longitudes of the effective area acquired in step 132. It is determined whether it is within the range of the area to be recorded (step 136). If the current position of the host vehicle 12 is not within the range of the effective area, the host vehicle 12 does not exist in the effective area where the execution of the predetermined function of the maintenance device 14 is permitted. It is not reasonable to perform the function. On the other hand, when the current position of the host vehicle 12 is within the range of the effective region, the host vehicle 12 exists in the effective region where the execution of the predetermined function of the maintenance device 14 is permitted. It is allowed to execute the predetermined function.

  If the maintenance device connection ECU 20 determines that the current position of the host vehicle 12 is within the range of the effective region as a result of the verification of the effective region as described above (when an affirmative determination is made in step 140), the maintenance device connection ECU 20 Items other than the valid area included in the electronic certificate are verified (step 150). For example, it is determined whether or not the current time acquired using a clock is within an expiration date that permits execution of a predetermined function in the maintenance device 14. As a result of the verification, if it is determined that the current time has not expired and other items other than the valid region match the desired items (when an affirmative determination is made in step 160), then the maintenance for communication connection is performed. Processing for permitting execution of a predetermined function of the appliance 14 is performed (step 170). Specifically, for the maintenance device 14 connected for communication, first, the maintenance device 14 is authenticated with the public key of the electronic certificate, and then the permission function included in the electronic certificate is permitted. A command that permits execution of the command is issued through the interface.

  In this case, the maintenance device 14 connected in communication with the maintenance device connection ECU 20 executes the permitted predetermined function in accordance with the execution permission command from the maintenance device connection ECU 20. For example, a failure diagnosis function of the vehicle 12 is executed or ECU data or software in the vehicle 12 is updated.

  If the maintenance device connection ECU 20 determines that either the electronic certificate form or the issuer signature obtained from the maintenance device 14 does not match the desired one (during a negative determination in step 120), the maintenance device connection ECU 20 When it is determined that the current position of the vehicle 12 is outside the range of the effective area (when a negative determination is made in step 140), and the current time has passed the expiration date, and other items other than the effective area are desired If it is determined that they do not match (when negative determination is made in step 160), processing for rejecting execution of a predetermined function of the maintenance device 14 to be connected for communication is performed (step 180). Specifically, the maintenance device 14 connected for communication is notified through the interface that the execution of the function is rejected, or a command for permitting the execution of the function is not issued. In this case, the maintenance device 14 that is in communication connection with the maintenance device connection ECU 20 does not execute a predetermined function.

  As described above, in the authentication system 10 of the present embodiment, the maintenance device connection ECU 20 of the vehicle 12 issues the certificate issuance device 18 to issue the maintenance device when the maintenance device 14 connected via communication is authenticated. In addition to verifying the expiry date and issuer signature that are permitted to execute a predetermined function in the maintenance device 14 included in the electronic certificate sent from the device 14, the maintenance device included in the electronic certificate It is verified whether or not the host vehicle 12 exists within the range of the effective area where the execution of the predetermined function in the device 14 is permitted. When the own vehicle 12 exists in the valid area, the current time is within the validity period, and the signature of the issuer is confirmed, it is determined that the communication-connected maintenance device 14 has been authenticated. The execution of a predetermined function in the maintenance device 14 is permitted. On the other hand, if the own vehicle 12 does not exist in the valid area and the current time has passed, or the signature of the issuer cannot be confirmed, the communication-connected maintenance device 14 cannot be authenticated. And the execution of the predetermined function in the maintenance device 14 is rejected.

  In other words, in the present embodiment, only when the vehicle 12 is in an effective area where the operation of the maintenance device 14 is permitted, the maintenance device 14 to which the vehicle 12 is communicatively connected is authenticated to the maintenance device. The execution of 14 functions can be permitted. On the other hand, the authentication of the maintenance device 14 and the execution of the maintenance device 14 are permitted only within the region of the valid area included in the electronic certificate issued by the certificate issuing device 18. The

  The vehicle position used for authentication of the maintenance device 14 by the vehicle 12 is detected by the car navigation system 24 of the vehicle 12 based on the GPS signal sent from the GPS satellite. Since GPS signals (radio waves) from GPS satellites are very difficult to falsify, the vehicle position detected based on the GPS signals is highly reliable information and is a maintenance device for the vehicle 12. It is difficult to rewrite the vehicle position information acquired in the connection ECU 20. For this reason, it is extremely difficult to authenticate the maintenance device 14 that is communicatively connected to the vehicle 12 outside the effective region, and as a result, the third party who has stolen the vehicle 12 without the permission of the maintenance device 14 outside the effective region. It is possible to prevent the various data from being sucked up from the vehicle 12 by executing the predetermined function.

  Further, in the authentication system 10 of the present embodiment, the car navigation system 24 detects the position of the own vehicle based on the GPS signal at a predetermined cycle, sends the own vehicle position information to the in-vehicle LAN 22, and connects to a maintenance device. The ECU 20 always acquires the latest information as the current position information of the host vehicle 12 from the car navigation system 24 through the in-vehicle LAN 22 and temporarily stores it in the memory, and the updated current position is the area range of the effective region. To determine if it is inside. In this case, even if the vehicle 12 is initially in the effective area, when the vehicle 12 subsequently travels and goes out of the effective area, it is assumed that the maintenance device 14 for communication connection cannot be authenticated. However, the execution of the function of the maintenance device 14 can be refused.

  Therefore, according to the authentication system 10 of the present embodiment, security in authentication between the vehicle 12 and the maintenance device 14 can be improved.

  In this embodiment, the maintenance device 14 obtains an electronic certificate issued from the certificate issuing device 18 to authenticate the maintenance device 14 to which the vehicle 12 is communicatively connected. It is preferable that the timing of acquiring the local information is immediately before the authentication. According to this configuration, the expiration date and valid area included in the electronic certificate can be minimized, so that the maintenance device 14 is authenticated and the function execution of the maintenance device 14 is permitted. This is because the time and area can be limited, and as a result, the risk of misuse against an emergency theft can be minimized.

  In the above embodiment, the maintenance device 14 is in the “electronic device” described in the claims, and each position in the effective area is in the “effective position” in the claims. 14 issuance of a certificate stored in the memory to the maintenance device connection ECU 20 when the maintenance device 14 is connected to the maintenance device connection ECU 20 of the vehicle 12 in the “storage means” described in the claims. The transmission of the electronic certificate from the device 18 corresponds to the “authentication information transmission means” and “authentication information transmission step” described in the claims, and the electronic certificate corresponds to the “authentication information” described in the claims. In the “authentication information receiving means” and “authentication information receiving step” described in the claims, the maintenance equipment connection ECU 20 receives the electronic certificate from the maintenance equipment 14. According to the “own vehicle position detecting means” and the “own vehicle position detecting step” described in the claims, it is a maintenance device that the stem 24 detects the current position of the own vehicle 12 based on the GPS signal from the GPS satellite. The connection ECU 20 executes the processing of steps 130 and 140 in the “position authentication means” and “position authentication step” described in the claims, and the maintenance equipment connection ECU 20 executes the processing of step 170 Corresponds to “apparatus operation permission means” and “apparatus operation permission step” described in the claims.

  By the way, in the above-described embodiment, when the maintenance equipment connection ECU 20 of the vehicle 12 authenticates the maintenance equipment 14 connected by communication, the maintenance equipment used as the connection log information is used as the connection log information. Non-volatile memory for each information of the electronic certificate sent from 14 and the vehicle position compared with the valid area included in the electronic certificate and the time compared with the valid time included in the electronic certificate It is good also as keeping in. According to such a modified example, even when the maintenance device 14 is illegally used in the effective region and is connected to the vehicle 12 for communication, the fact that the unauthorized use has been performed can be recorded as a record. It is possible to suppress the unauthorized use of the device for use 14 itself, and when the unauthorized use is performed, it is possible to leave a record of the date and time of the unauthorized use and data.

  Further, in the above-described embodiment, as the information on the effective area in which the execution of the predetermined function in the maintenance device 14 is permitted, the north limit latitude, the south limit latitude, the east end longitude, and the west end longitude of the effective area are displayed. Although the information is used, such an effective area is not limited to an area surrounded by a square or a rectangular quadrilateral, and as such an effective area, an area surrounded by a circle (that is, a certain center is defined A region within a predetermined distance from the center), a region surrounded by an elliptical shape, or the like may be set, or a triangular or pentagonal shape may be used.

  Further, in the above-described embodiment, the place where the execution of the predetermined function in the maintenance device 14 is permitted is the above-mentioned effective area having a certain area range, but the pinpoint specific position (effective position) may be used. Good.

DESCRIPTION OF SYMBOLS 10 Authentication system 12 Vehicle 14 Maintenance equipment 20 Maintenance equipment connection ECU
24 car navigation system

Claims (5)

A vehicle capable of traveling, and an electronic device that performs communication with the vehicle and executes a predetermined function, and the electronic device connected to the vehicle and communicates with the vehicle before executing the predetermined function. An authentication system for authenticating
The electronic device stores at least information on effective positions at which execution of the predetermined function is permitted, and information on the effective positions stored in the storage means to the vehicle when connected to the vehicle. Authentication information transmitting means for transmitting authentication information including,
The vehicle is detected by authentication information receiving means for receiving the authentication information transmitted from the electronic device connected in communication, own vehicle position detecting means for detecting the own vehicle position, and the own vehicle position detecting means. Position authentication means for determining whether or not the vehicle position matches the effective position included as information in the authentication information received by the authentication information receiving means; and the vehicle authentication position is determined by the position authentication means. And a device operation permission unit that permits execution of the predetermined function in the electronic device when it is determined that the position matches the position.   2. The authentication system according to claim 1, wherein the own vehicle position detecting means detects the own vehicle position based on a GPS signal transmitted from a GPS satellite. The own vehicle position detecting means detects the own vehicle position at a predetermined cycle,
The authentication system according to claim 1, wherein the position authentication unit determines whether or not the latest vehicle position detected by the vehicle position detection unit matches the effective position.   4. The maintenance apparatus according to claim 1, wherein the electronic device is a maintenance device that performs a failure diagnosis of the vehicle or an update of data or software of an electronic control unit mounted on the vehicle as the predetermined function. The authentication system according to any one of the above. An authentication method for causing the vehicle to authenticate the electronic device before the electronic device connected in communication with the travelable vehicle performs a predetermined function,
An authentication information transmitting step of transmitting authentication information including information on an effective position at which execution of the predetermined function is permitted to the vehicle when the electronic device is in communication connection with the vehicle;
An authentication information receiving step in which the vehicle receives the authentication information transmitted from the electronic device connected in communication;
A vehicle position detection step in which the vehicle detects a vehicle position;
Position authentication for determining whether or not the vehicle position detected in the vehicle position detection step matches the effective position included as information in the authentication information received in the authentication information reception step. Steps,
A device operation permission step for permitting execution of the predetermined function in the electronic device when the vehicle is determined in the position authentication step that the vehicle position matches the effective position;
An authentication method comprising:

Images