JP6160544B2 - OBE - Google Patents

Description

  The present invention relates to an in-vehicle device provided with a current authentication method and a new authentication method as an IC card authentication method.

  Since ETC (Electronic Toll Collection System) on-board equipment handles personal information (charge settlement information, entrance / exit information on highways, vehicle information, etc.) by authenticating the ETC card, the user is concerned about security. Is very interested. In the future, if it is planned to introduce a new authentication method (hereinafter referred to as the new authentication method) with higher security than the current authentication method (hereinafter referred to as the current authentication method), considering the burden of ETC card replacement for the user, There is a need to provide an on-board ETC device that supports the new authentication method in addition to the current authentication method.

Japanese Patent Application No. 2013-107120

  By the way, when both the current authentication method and the new authentication method are installed in the ETC on-board unit, if the current authentication method with low security is broken, the current authentication method is used. If it is breached, a security hole will occur in the ETC on-board device, increasing the risk of leakage of personal information, falsification of payment information, and the like.

In addition, there is no means for giving the information that the vulnerability of the current authentication method is increased to the ETC on-board unit, and the user cannot recognize it, and therefore cannot switch to the new authentication method.
In Patent Document 1 filed earlier by the present applicant, in response to the above-mentioned problem, “the current authentication method is automatically invalidated when security of the current authentication method is weak, or a manual selection function by user selection is provided”. Proposes a way to prevent security vulnerabilities.

  However, in the invention of Patent Document 1, when the expiration date of the current authentication method is exceeded, whether or not to shift to the new authentication method is left to the user's selection, and if the user continues to select the current authentication method, There was a problem that the state of high vulnerabilities continued.

The present invention has been made in view of the above circumstances, and its purpose is to switch from the current authentication method to the new authentication method when the security vulnerability increases in a configuration equipped with the current authentication method and the new authentication method. An object of the present invention is to provide a vehicle-mounted device capable of reliably increasing the security of the system.

  According to the first aspect of the present invention, since the on-board device is notified of the expiration date of the current authentication method from the roadside device when the security vulnerability of the authentication method becomes high, when the expiration date ends. A grace period is set, and during the grace period, authentication by the current authentication method is permitted, so that the user can use an IC card of the current authentication method. The user needs to acquire an IC card corresponding to the new authentication method during this grace period. And since the onboard equipment sets a new authentication system, when a grace period is complete | finished, it can switch forcibly to a new authentication system. As a result, the security of the IC card authentication method can be reliably increased.

Functional block diagram showing the electrical configuration of the ETC on-board unit and the ETC card in one embodiment Flowchart showing ETC card authentication processing by ETC on-board unit The figure which shows the procedure which sends the ETC card corresponding to the new certification method to the user

  Hereinafter, an embodiment in which the present invention is applied to an ETC vehicle-mounted device will be described with reference to the drawings. In addition, the ETC onboard equipment of this embodiment shall be sold during the period when the authentication method at the time of authenticating an ETC card is scheduled to switch from the current authentication method to the new authentication method. That is, the ETC in-vehicle device 100 is configured to support both authentication methods because it is necessary to support the new authentication method while supporting the current authentication method. Further, it is assumed that the ETC card is acquired from the card issuing company when the authentication method is only the current authentication method (before the new authentication method is scheduled). Furthermore, it is assumed that the validity period of the current authentication method has not been determined and is notified from the ETC system (roadside system) as will be described later. The current authentication method is an authentication method based on the current ETC security standard. The new authentication method is an authentication method based on a new ETC security standard to be revised.

  As shown in FIG. 1, the ETC vehicle-mounted device 100 (corresponding to the vehicle-mounted device) includes a radio unit 102 connected to the antenna 101, an overall control unit 103 (corresponding to an expiration date acquisition unit and a request unit), and the overall control unit 103. The IC card control unit 104, the external device connection unit 105, the storage unit 106, the display unit 107 (corresponding to the notification unit), the speaker 108 (corresponding to the notification unit), and the input operation unit 109 are mainly configured. . Furthermore, as a configuration related to the present invention, an IC card connector 110 connected to the IC card control unit 104, a security method storage unit 111 (corresponding to an authentication method setting unit), a security function unit 112 (corresponding to an authentication unit), security An expiration date storage unit 113 (corresponding to a grace period setting unit), a security expiration date notification management unit 114, and a power supply unit 115 are provided.

  The antenna 101 is for performing wireless communication with the roadside device 200 installed in the ETC gate by, for example, DSRC (Dedicated Short Range Communication). The radio unit 102 processes the received signal of the antenna 101 and outputs it to the overall control unit 103, or performs signal processing on the transmission data from the overall control unit 103 to convert it to a transmission signal, and It is for transmitting via.

  The overall control unit 103 performs wireless communication with the roadside device 200 through the wireless unit 102, and transmits and receives information necessary for billing. The overall control unit 103 is a computer means including a CPU, ROM, RAM, I / O and a bus line connecting these, and performs processing such as communication and information acquisition performed by the ETC on-board unit 100. Or perform billing. At this time, the billing information by the billing process is written into the ETC card 300 (corresponding to the IC card) via the IC card control unit 104, and is also written into the storage unit 106 as necessary. It has become.

  The IC card control unit 104 performs transmission / reception processing of necessary information with the roadside device 200 in a state where the ETC card 300 necessary for using the ETC system is inserted into the IC card connector 110. .

  The security method storage unit 111 stores the currently set authentication method, and at the time of selling the ETC on-board device 100 (when the ETC on-board device 100 is a standard product or an option, the current authentication method). Is remembered.

  The security function unit 112 includes a current authentication method processing unit 112a and a new authentication method processing unit 112b, and authenticates the ETC card 300 inserted into the IC card connector 110 using an authentication method stored in the security method storage unit 111. . The security expiration date storage unit 113 stores the expiration date of the current authentication method notified from the ETC system. The security expiration date notification management unit 114 notifies the user of the expiration date of the ETC card 300 from the display unit 107 or the speaker 108.

  The storage unit 106 includes a nonvolatile memory such as an EEPROM or a flash memory. The setup information is written at the time of setup, and necessary information such as setting information of the ETC on-vehicle device 100 and user setting information during normal operation. Information necessary for ETC use such as use history information is stored.

  The display unit 107 is configured by a known LCD (Liquid Crystal Display), LED (Light Emitting Diode), or the like, and is a display device that displays charging information, setting information, and the like. The speaker 108 notifies information by voice. The power supply unit 115 is supplied with power from the vehicle battery 18 serving as a power supply when the ACC switch of the ignition switch is on.

The external device connection unit 105 includes, for example, a communication interface circuit for an in-vehicle LAN (Local Area Network), and transmits and receives data to and from an external device such as a navigation system.
The roadside device 200 includes an antenna 201, a radio unit 202, and a control unit 203. When a predetermined authentication procedure is completed based on information transmitted from the ETC on-board unit 100, the ETC gate is opened and the vehicle side Allow passage. The roadside device 200 is connected to a server 400 (see FIG. 3) of a road operator center that manages the ETC system.

  The ETC card 300 includes a control unit 301 mainly including a CPU, a storage unit 302, and a security function unit 303. The storage unit 302 stores setup information during setup. The setup information includes license plate information (vehicle registration number and vehicle number described in the vehicle inspection certificate), vehicle verification (vehicle inspection certificate) information (vehicle size, weight, etc.), and the like.

  In order to ensure security, the ETC card 300 is personal information recorded in the ETC card 300 unless the ETC on-board unit 100 and the ETC card 300 undergo mutual authentication for confirming that they are authorized parties. Access (reading or writing) is not permitted, and a security function unit 303 is provided as means for mutual authentication. Since the authentication method is only the current authentication method when the user acquires the ETC card 300 from the card issuing company, the security function unit 303 of the ETC card 300 includes only the current authentication method processing unit 303a.

  By the way, when the ETC OBE 100 is scheduled to be transferred from the current authentication method to the new authentication method in the future, both the ETC OBE 100 and the ETC card are newly authenticated in order to support the new authentication method. It is necessary to support the method. Even if the ETC in-vehicle device 100 supports the new authentication method, the ETC card cannot be authenticated by the new authentication method unless the ETC card supports the new authentication method. For this reason, considering that the ETC card exchange period is generally about 5 to 7 years, even if the ETC on-board unit 100 is a new authentication method, the ETC card is only compatible with the current authentication method. It is assumed that the transition to the new authentication method takes time due to card factors.

From such a situation, in this embodiment, the ETC on-board unit 100 performs the transition to the new authentication method in a short period of time.
That is, when the user inserts the ETC card 300 into the card slot of the ETC on-vehicle device 100, the ETC on-vehicle device 100 starts the activation process of the ETC card 300 via the IC card control unit 104. In the activation process, the ETC card 300 is activated by supplying power and releasing the reset.

Next, when it is recognized that the inserted IC card is the ETC card 300, mutual authentication processing with the ETC card 300 is started.
When the authentication of the ETC card 300 is started, the ETC onboard device 100 reads the authentication method of the ETC card 300 from the security method storage unit 111 (S1) and determines whether the new authentication method has been set, as shown in FIG. (S2). Since the current authentication method is stored in the security method storage unit 111 (S2: NO), it is determined whether the grace period flag is 1 (S5). As will be described later, this grace period flag is a flag indicating that it is a period in which authentication is possible even with the current authentication method when the expiration date of the current authentication method has passed. In this case, the grace period flag is 0 (S5: NO), and since the expiration date of the current authentication method has not been acquired from the roadside device 200 (S6: NO), mutual authentication with the ETC card 300 is performed using the current authentication method. (S4).

  If the ETC onboard device 100 normally performs mutual authentication with the ETC card 300 as described above, the ETC on-board device 100 can read the personal information recorded in the ETC card 300 and notify it to the ETC system. .

  When the security vulnerability of the current authentication method increases and the possibility of security breakage increases, a security hole occurs in the ETC on-board unit 100, and personal information is leaked, payment information is falsified, etc. Therefore, it is necessary to switch from the current authentication method to the new authentication method in a short period of time. In such a case, when the vehicle passes through the ETC gate, the server 400 of the road operator center notifies the ETC on-board unit 100 from the roadside device 200 of the expiration date (for example, three months later) of the current authentication method. This expiration date is the same for all the ETC on-board units 100.

When the ETC on-vehicle device 100 receives the expiration date of the current authentication method from the ETC system, the ETC on-vehicle device 100 stores the expiration date in the security expiration date storage unit 113.
When authentication of the ETC card 300 is started when the user inserts the ETC card 300 into the ETC on-board unit 100 with the expiration date of the current authentication method stored in the ETC on-board unit 100 as described above, Since the validity period of the authentication method has been acquired from the roadside device 200 (S6: YES) and is within the validity period of the current authentication method (S7: NO), the validity period of the current authentication method is given to the user from the speaker 108. After speaking and displaying on the display unit 107 (S11), mutual authentication with the ETC card 300 is performed using the current authentication method (S4). Thereby, the user can confirm the expiration date of the current authentication method every time the ETC card 300 is inserted into the ETC on-board device 100. As a result, the user requests the card issuing company to send an ETC card corresponding to the new authentication method.

  When the valid period of the current authentication method is exceeded (S7: YES), the ETC on-vehicle device 100 utters from the speaker 108 or displays on the display unit 107 that it automatically switches to the new authentication method in the remaining xx days. (S8), and after setting a grace period (for example, one month) extending the validity period of the current authentication method (S9), the grace period flag is set to 1 (S8). As a result, a user who has not acquired an ETC card compatible with the new authentication method requests the card issuing company to send an ETC card compatible with the new authentication method.

  When the grace period flag is set to 1 (S5: YES), the ETC on-vehicle device 100 confirms that the grace period has not expired (S12: NO), and then the ETC card 300 and the current authentication method Authenticate with each other.

  The ETC on-board unit 100 performs mutual authentication with the ETC card 300 using the new authentication method during the grace period, but is unable to perform mutual authentication using the new authentication method due to a factor of the ETC card 300. As described above, when the ETC on-board unit 100 is notified that automatic switching to the new authentication method is performed, many users are required to voluntarily send an ETC card corresponding to the new authentication method to the card issuing company. However, depending on the user, the notification from the ETC on-board unit 100 may be ignored. Therefore, as shown in FIG. 3, an ETC card corresponding to the new authentication method is automatically sent from the card issuing company to the user.

(1) When the ETC on-board unit 100 communicates with the ETC system, the ETC system is notified that the ETC card does not support the current authentication method.
(2) The ETC system notifies the road operator center server 400 that the ETC card used by the user is compatible only with the current authentication method.
(3) The road operator requests the card issuing company to issue an ETC card of a new authentication method to the user.
(4) The card issuing company sends an ETC card corresponding to the new authentication method to the user.
(5) The user uses an ETC card corresponding to the new authentication method instead of the ETC card of the current authentication method.
As described above, the ETC card can be changed to a new authentication method with high security.

  As shown in FIG. 1, the security function unit 303 of the ETC card 300A corresponding to the new authentication method includes a new authentication method processing unit 303b in addition to the current authentication method processing unit 303a.

  When the user who has acquired the ETC card 300A corresponding to the new authentication method from the card issuing company as described above inserts the ETC card 300A into the ETC on-vehicle device 100, the ETC on-vehicle device 100 still has the current authentication method set. (S2: NO), mutual authentication is performed using the current authentication method (S4). In this case, since the ETC card 300A corresponding to the new authentication method also supports the current authentication method, mutual authentication by the current authentication method can be performed without any trouble.

  When the grace period expires (S12: YES), the ETC on-vehicle device 100 invalidates the current authentication method by setting (storing) the new authentication method in the security method storage unit 111 (S13) (S14). ) After notifying the user that the new authentication method has been set (S15), the grace period flag is set to 0 (S16).

  After the setting of the new authentication method as described above, when the user inserts the ETC card 300A corresponding to the new authentication method into the ETC on-vehicle device 100, the ETC on-vehicle device 100 has been set to the new authentication method (S2: YES). ) Since the ETC card 300A supports the new authentication method (S3: YES), mutual authentication is performed with the ETC card 300A using the new authentication method (S4).

  On the other hand, when the user inserts the ETC card 300 that supports only the current authentication method into the ETC on-board unit 100 after setting the new authentication method, the ETC card 300 does not support the new authentication method (S3: NO). Then, the user is notified that the authentication of the ETC card 300 is invalid (S17).

  Even if the ETC OBE 100 sold after the grace period is exceeded, there is a possibility that the ETC card 300 corresponding to only the current authentication method may be inserted. It is necessary to support both authentication methods. In addition, even if an ETC card is issued after the grace period is exceeded, it may be inserted into the ETC on-board unit 100 that does not support the new authentication method. It is necessary to support both authentication methods.

According to such an embodiment, the following effects can be produced.
The ETC on-board unit 100 sets a grace period when the expiration date of the current authentication method has been exceeded, performs mutual authentication with the ETC card 300, 300A using the current authentication method during the grace period, and when the grace period ends. Since a new authentication method is set and mutual authentication is performed with the ETC card 300A using the new authentication method, switching to the new authentication method is performed in a short period of time, so that the security of the authentication method of the ETC card can be reliably increased.

Since the expiration date of the current authentication method is acquired from the ETC system, the authentication method can be appropriately switched when the security vulnerability of the authentication method becomes high.
Since the user is notified of the expiration date of the current authentication method, the user can be made aware of the expiration date.

  When the grace period ends, the user is notified of the switch to the new authentication method, so the user can be urged to request the card issuing company for an ETC card corresponding to the new authentication method.

When the new authentication method is set, the user is notified that the new authentication method has been set, so that the user can surely recognize that the switch has been made to the new authentication method.
When the new authentication method is set and the ETC card 300 does not support the new authentication method, the user is notified that the authentication method of the ETC card 300 is invalid. The user can understand the reason for invalidation.

  If the ETC card 300 only supports the current authentication method during the grace period, the card issuing company is notified by notifying that the ETC card 300 only supports the current authentication method when communicating with the roadside device 200. On the other hand, since the ETC card 300 of the new authentication method is requested to be sent to the user, even if the user ignores various messages notified from the ETC on-board unit 100, the user can use the new authentication method. The ETC card 300A can be reliably obtained and used.

(Other embodiments)
The present invention is not limited to the above-described embodiment, and may be modified or expanded as follows, each modified example may be combined with the above-described embodiment, or each modified example may be combined.
Although the expiration date of the current authentication method is acquired from the ETC system, the expiration date may be registered in advance in the ETC on-vehicle device 100.
The timing of notifying the user of various messages is not limited to the time when the authentication of the ETC card is started, but may be notified at regular intervals when the ETC card is removed or when the ETC card is inserted.

  When communicating with the ETC system during the grace period, it is notified that there is an ETC card 300 that supports only the current authentication method, and accordingly, the road operator issues an ETC card that supports the new authentication method to the card issuer. Although the road operator requested to issue, the ETC card 300 corresponding to the new authentication method is given to the user who has only the ETC card 300 corresponding only to the current authentication method when the validity period of the current authentication method expires. May be requested from the card issuing company.

  Although only one type of new authentication method is used, when an authentication method based on the ETC security standard, which is a further improvement of the new authentication method, is planned, it may be configured to support two or more new authentication methods. .

  In the drawing, 100 is an ETC on-vehicle device (on-vehicle device), 103 is an overall control unit (expiration date acquisition means, request means), 107 is a display unit (notification means), 108 is a speaker (notification means), and 111 is a security method storage. Part (authentication method setting means), 112 is a security function part (authentication means), 113 is a security expiration date storage part (grace period setting means), 200 is a roadside device, and 300 and 300A are ETC cards (IC cards).

Claims (7)

An authentication method setting means (111) for setting an authentication method;
When authentication is started with the IC card (300, 300A) and the current authentication method (hereinafter referred to as current authentication method) is set in the authentication method setting means, authentication is performed for mutual authentication using the IC card and the current authentication method. Means (112);
A grace period setting means (113) for setting a grace period when an expiration date of the current authentication method is exceeded,
The authentication method setting means sets a new authentication method (hereinafter, new authentication method) when the grace period ends,
The authentication means performs mutual authentication with the IC card using the current authentication method during the grace period, and performs mutual authentication with the IC card using the new authentication method when a new authentication method is set in the authentication method setting means. In-vehicle device.   The in-vehicle device according to claim 1, further comprising an expiration date acquisition means (103) for acquiring the expiration date of the current authentication method by being notified from the roadside device (200). The vehicle-mounted device according to claim 2, further comprising notification means (107, 108) for notifying a user of an expiration date of the current authentication method acquired by the expiration date acquisition means.   The in-vehicle device according to claim 3, wherein the notification means notifies the user that switching to a new authentication method is performed when the grace period ends.   5. The vehicle-mounted device according to claim 3, wherein, when the authentication method setting unit sets a new authentication method, the notification unit notifies the user that the new authentication method has been set.   The notifying unit notifies the user that the IC card authentication method is invalid when the authentication method setting unit sets the new authentication method and the IC card does not support the new authentication method. The vehicle-mounted device according to any one of claims 3 to 5, wherein:   If the IC card is compatible only with the current authentication method during the grace period, the new authentication method is notified by notifying that the IC card is compatible only with the current authentication method when communicating with the roadside system. The vehicle-mounted device according to any one of claims 1 to 6, further comprising request means (103) for requesting the IC card.

Images