JP6860464B2 - System and management method - Google Patents

Description

The present invention relates to a system and a management method.

In recent years, automobiles have an ECU (Electronic Control Unit), and the ECU realizes functions such as engine control. The ECU is a kind of computer, and realizes a desired function by a computer program. For automobiles that are already in use, the computer program of the ECU is usually updated at a general automobile maintenance shop at the time of automobile inspection or periodic inspection.

Conventionally, when updating an ECU computer program, an operator connects a diagnostic terminal dedicated to maintenance to a diagnostic port called an OBD (On-board Diagnostics) port of an automobile, and installs the update program and sets data from the diagnostic terminal. Make changes, etc. Regarding this, for example, Non-Patent Documents 1 and 2 describe security.

C. Miller, C. Valasek, “Adventures in Automotive Networks and Control Units”, DEF CON 21, August 2013 Hiroaki Takada, Tsutomu Matsumoto, "Proposals for Strengthening Information Security for Embedded Embedded Systems", September 2013, Internet <URL: https://www.ipa.go.jp/files/000034668.pdf> Trusted Computing Group, Internet <URL: http://www.trustedcomputinggroup.org/> Keisuke Takemori, "Secure Boot with Android + TPM", Nikkei Electronics, August 6, 2012 issue. Keisuke Takemori, Hideaki Kawabata, Takamasa Isohara, Ayumu Kubota, "Secure Boot by Android (ARM) + TPM", Institute of Electronics, Information and Communication Engineers, SCIS2013 Symposium, January 2013. Keisuke Takemori, Hideaki Kawabata, Ayumu Kubota, "Secure Boot by ARM + SIM / UIM", Institute of Electronics, Information and Communication Engineers, SCIS2014 Symposium, January 2014.

The above-mentioned Non-Patent Documents 1 and 2 do not describe the means for improving security. Therefore, it is an issue to improve the reliability of applying data such as a computer program used for an in-vehicle computer such as an ECU provided in a vehicle such as an automobile.

The present invention has been made in consideration of such circumstances, and an object of the present invention is to provide a system and a management method capable of improving reliability in applying data used in an in-vehicle computer.

(1) One aspect of the present invention includes a management device mounted on a vehicle and a terminal for exchanging data between the management device by communication, and the management device exchanges data with the terminal. An input / output interface, a key holding unit that holds an authentication verification key, a terminal authentication unit that authenticates the terminal using the authentication verification key, an execution unit, and a communication network inside the vehicle. It is provided with an in-vehicle network interface for exchanging data with an in-vehicle computer mounted on the vehicle, and the terminal holds an authentication key corresponding to the authentication verification key and responds to an authentication request from the terminal authentication unit. said terminal when using said authentication key with the information processing unit to respond, transmit the data used in the vehicle computer to the management device, the execution unit for the authentication of the terminal is successful The data received from the in-vehicle computer is used for the in-vehicle computer, and the data received from the terminal is not used when the authentication of the terminal fails. The data used in the in-vehicle computer is processed. The execution unit includes the in-vehicle computer identifier that identifies the in-vehicle computer to be executed and the authority information that specifies the processing content for the in-vehicle computer, and the execution unit uses the authority information only for the in-vehicle computer specified by the in-vehicle computer identifier. The data that is a system that executes the specified processing content and is used by the in-vehicle computer is the processing execution target data that is the data to be executed for the in-vehicle computer, and is the type of the processing execution target data. The processing execution target data including the above, and the in-vehicle computer identifier and the in-vehicle computer that are provided independently of the type and indicate the authority to execute the processing on the in-vehicle computer and specify the in-vehicle computer to execute the processing. It is an authority certificate composed of authority information that specifies the processing content for the computer, and the execution unit executes processing according to the type of processing execution target data within the range of the authority indicated in the authority certificate. It is a system.
(2) In one aspect of the present invention, in the system of the above (1), the processing execution target data is the update program or setting change data of the in-vehicle computer, and the processing content specified by the authority information is sent to the in-vehicle computer. Is at least one of writing data and reading data from the in-vehicle computer, and the execution unit is a processing execution target when the processing content specified by the authority information is writing data to the in-vehicle computer. When the data type is an update program, the update program of the processing execution target data is installed only on the in-vehicle computer specified by the in-vehicle computer identifier, and the execution unit has the processing content specified by the authority information. When the data is written to the in-vehicle computer and the type of the processing execution target data is the setting change data, the corresponding data is used as the setting change data of the processing execution target data only for the in-vehicle computer specified by the in-vehicle computer identifier. It is a system to rewrite.
(3) One aspect of the present invention is that in the system according to any one of (1) and (2) above, the execution unit reads data whose processing content specified by the authority information is from an in-vehicle computer. In this case, it is a system that reads data only to the in-vehicle computer specified by the in-vehicle computer identifier.

(4) One aspect of the present invention is an in-vehicle network interface in which a management device mounted on a vehicle exchanges data with an in-vehicle computer mounted on the vehicle via a communication network inside the vehicle. A terminal authentication step in which the management device authenticates the terminal using the authentication verification key to the terminal that exchanges data with the management device by communication, and the terminal uses the authentication verification key. holding the corresponding authentication key, and the step of responding using the authentication key to the authentication request from the management apparatus, the terminal transmits the data to be used for the vehicle computer to the management device The step and the management device use the data received from the terminal when the authentication of the terminal is successful for the in-vehicle computer, and the data received from the terminal when the authentication of the terminal is unsuccessful. The data used in the in-vehicle computer is a management method including an execution step that is not used, and includes an in-vehicle computer identifier that identifies the in-vehicle computer to which the processing is executed and authority information that specifies the processing content for the in-vehicle computer. The management device is a management method for executing the processing content specified by the authority information only for the vehicle-mounted computer specified by the vehicle-mounted computer identifier in the execution step. The data used is the processing execution target data which is the data to be executed for the in-vehicle computer, and the processing execution target data including the type of the processing execution target data and the processing execution target data provided independently of the type. An authority certificate that indicates the authority to execute processing on the in-vehicle computer and consists of an in-vehicle computer identifier that identifies the in-vehicle computer to which the processing is executed and authority information that specifies the processing content for the in-vehicle computer. The execution unit is a management method that executes processing according to the type of processing execution target data within the scope of the authority indicated in the authority certificate.

According to the present invention, there is an effect that the reliability of the application of data used in an in-vehicle computer can be improved.

It is a block diagram which shows the structure of the management gateway 1 which concerns on 1st Embodiment of this invention. It is a schematic block diagram of the automobile 100 which concerns on 1st Embodiment of this invention. It is a block diagram which shows the structure of the center station 200 which concerns on 1st Embodiment of this invention. It is a schematic block diagram of the wireless communication system which concerns on 1st Embodiment of this invention. It is a flowchart which shows the procedure of the management method which concerns on 1st Embodiment of this invention. It is a schematic block diagram of the automobile 100 which concerns on modification 1 of 1st Embodiment of this invention. It is a schematic block diagram of the automobile 100 which concerns on modification 2 of 1st Embodiment of this invention. It is a schematic block diagram of the automobile 100 which concerns on 2nd Embodiment of this invention. It is a block diagram which shows the structure of the management gateway 1 which concerns on 3rd Embodiment of this invention. It is a schematic block diagram of the automobile 100 which concerns on 3rd Embodiment of this invention.

Hereinafter, embodiments of the present invention will be described with reference to the drawings. In the embodiment shown below, an automobile will be described as an example of the vehicle.

[First Embodiment]
FIG. 1 is a block diagram showing a configuration of a management gateway 1 according to a first embodiment of the present invention. The management gateway 1 is a management device. In FIG. 1, the management gateway 1 includes an eSIM (Embedded Subscriber Identity Module) _10, a CAN (Controller Area Network) interface 31, an execution unit 32, a wireless communication unit 33, and an input / output interface 34. Each of these parts is configured so that data can be exchanged. The eSIM_10 includes a decryption unit 11, a key holding unit 12, a signature verification unit 13, and a terminal authentication unit 14.

eSIM_10 is a secure element. The secure element includes a secure area that cannot be accessed from the outside of the secure element. In the eSIM_10, the key holding unit 12 is in the secure area. As a secure element, SIM (Subscriber Identity Module) may be used instead of eSIM_10. eSIM and SIM are a kind of computer, and realize desired functions by a computer program.

FIG. 2 is a schematic configuration diagram of an automobile 100 according to the first embodiment of the present invention. In FIG. 2, the automobile 100 includes a management gateway 1, a control in-vehicle network 110, a drive system ECU group 120, a vehicle body system ECU group 121, a safety control system ECU group 122, and a diagnostic port 130. The management gateway 1 is connected to the control vehicle-mounted network 110. In the present embodiment, the control vehicle-mounted network 110 is a CAN (Controller Area Network). The drive system ECU group 120, the vehicle body system ECU group 121, and the safety control system ECU group 122 are connected to the control vehicle-mounted network 110. The management gateway 1 exchanges data between the drive system ECU group 120, the vehicle body system ECU group 121, and the safety control system ECU group 122 via the control vehicle-mounted network 110.

Each of the drive system ECU group 120, the vehicle body system ECU group 121, and the safety control system ECU group 122 includes an ECU that realizes a function such as engine control. Hereinafter, when each ECU included in the drive system ECU group 120, the vehicle body system ECU group 121, and the safety control system ECU group 122 is not particularly distinguished, each ECU is referred to as an "vehicle-mounted ECU". The in-vehicle ECU is an in-vehicle computer. The management gateway 1 exchanges data with each vehicle-mounted ECU via the control vehicle-mounted network 110.

The diagnostic port 130 is a conventional OBD port. The diagnostic port 130 connects the diagnostic terminal 140. The diagnostic port 130 is connected to the management gateway 1. The diagnostic terminal 140 and the management gateway 1 exchange data via the diagnostic port 130.

In the management gateway 1, the CAN interface 31 connects to the control vehicle-mounted network 110 and exchanges data with the vehicle-mounted ECU via the control vehicle-mounted network 110. The execution unit 32 executes processing for the vehicle-mounted ECU. The wireless communication unit 33 transmits / receives data by wireless communication. The input / output interface 34 connects to the diagnostic port 130 and exchanges data with the diagnostic terminal 140 via the diagnostic port 130.

FIG. 3 is a block diagram showing the configuration of the center station 200 according to the first embodiment of the present invention. In FIG. 3, the center station 200 includes an authentication key holding unit 210, a signature key holding unit 220, an ECU code signing processing unit 222, an authority certificate signing processing unit 224, a wireless communication unit 230, and eSIM_232. The authentication key holding unit 210 holds an authentication key (Ks_1) and an authentication verification key (Kp_1). In the present embodiment, the authentication key (Ks_1) is a private key, and the authentication verification key (Kp_1) is a public key corresponding to the authentication key (Ks_1). The signature key holding unit 220 holds the signature key (Ks_2) and the signature verification key (Kp_2). In the present embodiment, the signature key (Ks_2) is a private key, and the signature verification key (Kp_2) is a public key corresponding to the signature key (Ks_2).

The ECU code signing processing unit 222 digitally signs the ECU code using the signature key (Ks_2) held in the signature key holding unit 220. The ECU code is data used for an in-vehicle ECU. Examples of the ECU code include an update program or setting change data related to a computer program of an in-vehicle ECU.

The authority certificate signature processing unit 224 digitally signs the authority certificate using the signature key (Ks_2) held in the signature key holding unit 220. The authority certificate indicates the authority to execute the process on the in-vehicle ECU. The authority certificate includes an ECU identifier (ECU ID) that identifies an in-vehicle ECU or an in-vehicle ECU group to execute processing, and authority information that specifies the processing content. The processing contents include, for example, reading data from the in-vehicle ECU (read: R) and writing data to the in-vehicle ECU (write: W). Hereinafter, the electronic signature is simply referred to as a "signature".

The wireless communication unit 230 transmits / receives data by wireless communication. The eSIM_232 is used by the wireless communication unit 230.

FIG. 4 is a schematic configuration diagram of a wireless communication system according to the first embodiment of the present invention. In FIG. 4, the wireless communication network 300 is operated by a telecommunications carrier. In order to use the wireless communication network 300, an eSIM or SIM in which the contractor information of the wireless communication network 300 is written is required. The eSIM_10 of the management gateway 1 is an eSIM in which the contractor information of the wireless communication network 300 is written. Therefore, the wireless communication unit 33 of the management gateway 1 can use the wireless communication network 300 by using the eSIM_10. The eSIM_232 of the center station 200 is an eSIM in which the contractor information of the wireless communication network 300 is written. Therefore, the wireless communication unit 230 of the center station 200 can use the wireless communication network 300 by using eSIM_232. The diagnostic terminal 140 includes a wireless communication unit 1410 and an eSIM_1420. The eSIM_1420 of the diagnostic terminal 140 is an eSIM in which the contractor information of the wireless communication network 300 is written. Therefore, the wireless communication unit 1410 of the diagnostic terminal 140 can use the wireless communication network 300 by using the eSIM_1420. The wireless communication unit 1410 sends and receives data by wireless communication.

In the management gateway 1, the center station 200, and the diagnostic terminal 140, the wireless communication units 33, 230, and 1410 connect to and communicate with the wireless communication network 300 by using the eSIM_10, 232, and 1420. The wireless communication unit 230 of the center station 200 communicates with the wireless communication unit 33 of the management gateway 1 via the wireless communication network 300. The wireless communication unit 230 of the center station 200 communicates with the wireless communication unit 1410 of the diagnostic terminal 140 via the wireless communication network 300.

Next, the operation of the management gateway 1 according to the first embodiment will be described with reference to FIG. FIG. 5 is a flowchart showing the procedure of the management method according to the first embodiment of the present invention.

(Step S1) The wireless communication unit 230 of the center station 200 communicates with the wireless communication unit 33 of the management gateway 1 via the wireless communication network 300. The center station 200 and the management gateway 1 authenticate by using each eSIM_232,10, and the authentication verification key (Kp_1) and the signature verification key (Kp_2) are encrypted and distributed from the center station 200 to the management gateway 1. .. Each eSIM_232,10 holds the same common key in advance. Authentication between the center station 200 and the management gateway 1 is performed using the common key held in each eSIM_232,10. The encryption of the authentication verification key (Kp_1) and the signature verification key (Kp_2) is performed using the common key held in eSIM_232. The decryption unit 11 of the eSIM_10 of the management gateway 1 decrypts the encryption authentication verification key (Kp_1) and the encryption signature verification key (Kp_2) received from the center station 200. Decryption of the encryption authentication verification key (Kp_1) and the encryption signature verification key (Kp_2) is executed using the common key held in the eSIM_10. The authentication verification key (Kp_1) and the signature verification key (Kp_2) obtained by this decryption are held in the key holding unit 12 of the eSIM_10.

The wireless communication unit 230 of the center station 200 communicates with the wireless communication unit 1410 of the diagnostic terminal 140 via the wireless communication network 300. The center station 200 and the diagnostic terminal 140 perform authentication by using each eSIM_232, 1420, and the authentication key (Ks_1) is encrypted and distributed from the center station 200 to the diagnostic terminal 140. Each eSIM_232,1420 holds the same common key in advance. Authentication between the center station 200 and the diagnostic terminal 140 is performed using the common key held in each eSIM_232,1420. The encryption of the authentication key (Ks_1) is performed using the common key held in eSIM_232. The eSIM_1420 of the diagnostic terminal 140 decrypts the encryption authentication key (Ks_1) received from the center station 200. Decryption of the encryption authentication key (Ks_1) is performed using the common key held in eSIM_1420. The authentication key (Ks_1) obtained by this decryption is held in the secure area of eSIM_1420.

(Step S2) The terminal authentication unit 14 of the eSIM_10 of the management gateway 1 uses the authentication verification key (Kp_1) held in the key holding unit 12 to authenticate the diagnostic terminal 140 connected to the diagnostic port 130 of the automobile 100. I do. As this authentication method, the challenge-response authentication method is used in this embodiment. This challenge-response authentication method will be described. First, the terminal authentication unit 14 generates a challenge value and outputs the challenge value from the input / output interface 34. The challenge value output from the input / output interface 34 is input to the diagnostic terminal 140 via the diagnostic port 130. The eSIM_1420 of the diagnostic terminal 140 encrypts the input challenge value using the authentication key (Ks_1) held in its own secure area. This encryption challenge value is a response value. This response value is output from the diagnostic terminal 140 to the diagnostic port 130, and is input to the management gateway 1 via the diagnostic port 130. The input / output interface 34 of the management gateway 1 outputs the input response value to the eSIM_10. The terminal authentication unit 14 decrypts the input response value with the authentication verification key (Kp_1) held in the key holding unit 12. The terminal authentication unit 14 determines whether the decryption result value obtained by decoding the response value matches the challenge value. As a result of this determination, if there is a match, the authentication of the diagnostic terminal 140 is successful, and if there is a mismatch, the authentication of the diagnostic terminal 140 is unsuccessful.

(Step S3) The center station 200 transmits the authority certificate 250 to the diagnostic terminal 140. The authority certificate 250 is signed 252 by the authority certificate signature processing unit 224 (see FIG. 2). The diagnostic terminal 140 outputs the authority certificate 250 to the diagnostic port 130. The output authority certificate 250 is input to the management gateway 1 via the diagnostic port 130. The input / output interface 34 of the management gateway 1 outputs the input authority certificate 250 to the eSIM_10. The signature verification unit 13 of the eSIM_10 verifies the signature 252 of the input authority certificate 250 by using the signature verification key (Kp_2) held by the key holding unit 12.

(Step S4) The center station 200 transmits the ECU code 240 to the diagnostic terminal 140. The ECU code 240 is signed by the ECU code signing processing unit 222 (see FIG. 2). The diagnostic terminal 140 outputs the ECU code 240 to the diagnostic port 130. The output ECU code 240 is input to the management gateway 1 via the diagnostic port 130. The input / output interface 34 of the management gateway 1 outputs the input ECU code 240 to the eSIM_10. The signature verification unit 13 of the eSIM_10 verifies the signature 242 of the input ECU code 240 by using the signature verification key (Kp_2) held by the key holding unit 12.

(Step S5) The execution unit 32 of the management gateway 1 executes a process for the vehicle-mounted ECU. An example of executing processing for the vehicle-mounted ECU by the execution unit 32 will be described below.

<Process execution example 1: Application of ECU code>
When the verification of the signature 242 of the ECU code 240 is successful, the execution unit 32 of the management gateway 1 uses the ECU code 240 for the vehicle-mounted ECU. On the other hand, the execution unit 32 of the management gateway 1 does not use the ECU code 240 when the verification of the signature 242 of the ECU code 240 fails. An example of using the ECU code is given below.
(Example of using the ECU code 1)
When the ECU code 240 whose signature 242 is successfully verified is an update program, the execution unit 32 installs the update program in the vehicle-mounted ECU.
(Usage example 2 of ECU code)
When the ECU code 240 for which the verification of the signature 242 is successful is the setting change data, the execution unit 32 rewrites the corresponding data of the vehicle-mounted ECU with the setting change data.

<Process execution example 2: Applying authority certificate>
When the verification of the signature 252 of the authority certificate 250 is successful, the execution unit 32 of the management gateway 1 executes the authority indicated by the authority certificate 250 to the vehicle-mounted ECU. On the other hand, the execution unit 32 of the management gateway 1 does not execute the authority indicated by the authority certificate 250 when the verification of the signature 252 of the authority certificate 250 fails.
(Execution example of authority 1)
When the authority indicated by the authority certificate 250 in which the verification of the signature 252 is successful is "ECU ID: 3, write", the execution unit 32 requests data for the in-vehicle ECU whose "ECU ID" is 3. Write to. When only the authority "ECU ID: 3, write" is shown in the authority certificate 250 in which the verification of the signature 252 is successful, the execution unit 32 only writes data to the in-vehicle ECU whose "ECU ID" is 3. To execute. In this case, for example, in the above-mentioned use example 1 of the ECU code, the update program is installed only in the in-vehicle ECU whose "ECU ID" is 3. In the usage example 2 of the ECU code, the corresponding data is rewritten with the setting change data only for the in-vehicle ECU whose "ECU ID" is 3.
(Execution example 2 of authority)
When the authority indicated by the authority certificate 250 in which the verification of the signature 252 is successful is "ECU ID: all, read", the execution unit 32 applies data to all the "ECU ID" in-vehicle ECUs. Perform a read.

<Process execution example 3: Application of diagnostic terminal>
If the authentication of the diagnostic terminal 140 is successful, the execution unit 32 of the management gateway 1 executes the request from the diagnostic terminal 140. On the other hand, the execution unit 32 of the management gateway 1 does not execute the request from the diagnostic terminal 140 when the authentication of the diagnostic terminal 140 fails.
(Execution example of request of diagnostic terminal)
When the request from the diagnostic terminal 140 for which the authentication is successful is to read the data from the vehicle-mounted ECU, the execution unit 32 reads the data from the vehicle-mounted ECU and outputs the data to the diagnostic terminal 140. When the request from the diagnostic terminal 140 for which the authentication is successful is to write the data to the vehicle-mounted ECU, the execution unit 32 writes the data input from the diagnostic terminal 140 to the vehicle-mounted ECU.

Execution examples 1, 2, and 3 of the above-described processing may be combined. For example, the execution unit 32 uses only the ECU code 240 and the authority certificate 250 input from the diagnostic terminal 140 for which authentication is successful. Therefore, the execution unit 32 does not use the ECU code 240 and the authority certificate 250 input from the diagnostic terminal 140 whose authentication has failed. For example, the execution unit 32 uses the ECU code 240 only within the range of the authority indicated by the authority certificate 250 in which the verification of the signature 252 is successful. Therefore, the execution unit 32 does not use the ECU code 240 outside the scope of the authority indicated by the authority certificate 250 in which the verification of the signature 252 is successful. For example, the execution unit 32 executes the request from the diagnostic terminal 140 in which the authentication is successful only within the range of the authority indicated by the authority certificate 250 in which the verification of the signature 252 is successful. Therefore, the execution unit 32 does not execute the request from the diagnostic terminal 140 in which the authentication is successful, outside the range of the authority indicated by the authority certificate 250 in which the verification of the signature 252 is successful.

According to the first embodiment described above, it is possible to improve the reliability of applying the data used in the in-vehicle ECU. By using only the ECU code 240 for which the verification of the signature 242 is successful in the vehicle-mounted ECU, the reliability of the ECU code 240 applied to the vehicle-mounted ECU is improved. Further, the reliability of the processing execution for the in-vehicle ECU is obtained by using the ECU code 240 in which the signature 242 is successfully verified only within the range of the authority indicated by the authority certificate 250 in which the signature 252 is successfully verified. Is improved. Further, by making only the request from the diagnostic terminal 140 for which the authentication is successful, the reliability of the actor who executes the process for the in-vehicle ECU is improved. For example, the management gateway 1 can identify the diagnostic terminal 140 used to execute the processing for the in-vehicle ECU by recording the terminal identification information of the diagnostic terminal 140 whose authentication is successful. By identifying the diagnostic terminal 140, it becomes possible to identify the person who executes the process for the in-vehicle ECU.

[Modification 1 of the first embodiment]
FIG. 6 is a schematic configuration diagram of the automobile 100 according to the first modification of the first embodiment of the present invention. In FIG. 6, the parts corresponding to the respective parts of FIG. 2 are designated by the same reference numerals, and the description thereof will be omitted. In the first modification of the first embodiment, the terminal 142 is used instead of the diagnostic terminal 140.

The terminal 142 is a wireless communication terminal including an eSIM in which the contractor information of the wireless communication network 300 shown in FIG. 4 is written. The terminal 142 is, for example, a mobile communication terminal such as a smartphone or a tablet-type computer (tablet PC). The terminal 142 can use the wireless communication network 300 by using its own eSIM. The terminal 142 may be a wireless communication terminal including a SIM in which the contractor information of the wireless communication network 300 is written instead of the eSIM.

The terminal 142 is connected to the management gateway 1 of the automobile 100. The input / output interface 34 of the management gateway 1 connects to the terminal 142 and exchanges data with the terminal 142. In the example of FIG. 6, the input / output interface 34 of the management gateway 1 is also connected to the infotainment device 150 provided in the automobile 100 to exchange data with the infotainment device 150. The terminal 142 connects to the infotainment device 150 and exchanges data with the infotainment device 150. The terminal 142 outputs the information acquired via the wireless communication network 300 to the infotainment device 150. The management gateway 1 outputs the information input from the infotainment device 150 to the vehicle-mounted ECU.

The terminal 142 has the same function as the diagnostic terminal 140 of the first embodiment described above. This is realized by installing a computer program that realizes the function of the diagnostic terminal 140 on the terminal 142 and executing the computer program on the terminal 142. As a result, in the modified example 1 of the first embodiment, the same procedure as the management method of FIG. 5 described above is performed. In the first modification of the first embodiment, in the management method of FIG. 5, the terminal 142 performs the process performed by the diagnostic terminal 140 in the above-described first embodiment. The management gateway 1 authenticates with the terminal 142 instead of the diagnostic terminal 140. The management gateway 1 inputs the ECU code 240 and the authority certificate 250 from the terminal 142 instead of the diagnostic terminal 140.

According to the first modification of the first embodiment, it is not necessary to use the diagnostic terminal 140 dedicated to maintenance. As a result, the owner of the automobile 100 can maintain the in-vehicle ECU by using his / her own terminal 142.

[Modification 2 of the first embodiment]
FIG. 7 is a schematic configuration diagram of the automobile 100 according to the second modification of the first embodiment of the present invention. In FIG. 7, the parts corresponding to the parts of FIGS. 2 and 6 are designated by the same reference numerals, and the description thereof will be omitted. In the second modification of the first embodiment, the configuration can be used by either the diagnostic terminal 140 or the terminal 142. In the second modification of the first embodiment, the same procedure as the management method of FIG. 5 described above is performed. The management gateway 1 authenticates with either the diagnostic terminal 140 or the terminal 142. The management gateway 1 inputs the ECU code 240 and the authority certificate 250 from either the diagnostic terminal 140 or the terminal 142 of the authentication partner.

According to the second modification of the first embodiment, the maintenance of the in-vehicle ECU can be performed by using the diagnostic terminal 140 dedicated to maintenance at the automobile maintenance shop, or the owner of the automobile 100 uses his / her own terminal 142. It is also possible to maintain the in-vehicle ECU.

[Second Embodiment]
FIG. 8 is a schematic configuration diagram of an automobile 100 according to a second embodiment of the present invention. In FIG. 8, the parts corresponding to the parts of FIG. 2 are designated by the same reference numerals, and the description thereof will be omitted. In the second embodiment, the diagnostic terminal 140 and the terminal 142 are not used. In the second embodiment, the management gateway 1 receives the ECU code 240 and the authority certificate 250 directly from the center station 200 via the wireless communication network 300. Therefore, in the second embodiment, the management gateway 1 does not require the terminal authentication unit 14.

Also in the second embodiment, the same procedure as the management method of FIG. 5 described above is performed. However, in the second embodiment, in the management method of FIG. 5, the management gateway 1 receives the ECU code 240 and the authority certificate 250 directly from the center station 200. Therefore, the center station 200 transmits the ECU code 240 and the authority certificate 250 to the management gateway 1. The management gateway 1 verifies each signature 242,252 of the ECU code 240 and the authority certificate 250 received from the center station 200.

According to the second modification of the second embodiment, the ECU code 240 and the authority certificate 250 are sent directly from the center station 200 to the management gateway 1, so that the vehicle-mounted ECU can be automatically maintained.

[Third Embodiment]
FIG. 9 is a block diagram showing a configuration of the management gateway 1 according to the third embodiment of the present invention. FIG. 10 is a schematic configuration diagram of an automobile 100 according to a third embodiment of the present invention. In FIGS. 9 and 10, the parts corresponding to the parts of FIGS. 1 and 2 are designated by the same reference numerals, and the description thereof will be omitted. In the third embodiment, the diagnostic port 500 is the management device. In FIG. 9, the diagnostic port 500 includes the same eSIM_10, CAN interface 31, execution unit 32, wireless communication unit 33, and input / output interface 34 as the management gateway 1 shown in FIG. The eSIM_10 of the diagnostic port 500 includes the same decryption unit 11, key holding unit 12, signature verification unit 13, and terminal authentication unit 14 as the eSIM_10 of the management gateway 1.

In FIG. 10, the diagnostic port 500 exchanges data with the vehicle-mounted ECU via the control vehicle-mounted network 110 by the CAN interface 31. The input / output interface 34 of the diagnostic port 500 connects the diagnostic terminal 140. The diagnostic port 500 and the diagnostic terminal 140 can be connected to or disconnected from each other. For example, the diagnostic port 500 and the diagnostic terminal 140 may be connected by a communication cable or by short-range wireless communication. The diagnostic port 500 exchanges data with the diagnostic terminal 140 by means of the input / output interface 34.

Also in the third embodiment, the same procedure as the management method of FIG. 5 described above is performed. In the third embodiment, in the management method of FIG. 5, the diagnostic port 500 performs the processing performed by the management gateway 1 in the above-described first embodiment. The diagnostic port 500 authenticates with the diagnostic terminal 140. The diagnostic port 500 inputs the ECU code 240 and the authority certificate 250 from the diagnostic terminal 140, and verifies the signatures 242 and 252 of the input ECU code 240 and the authority certificate 250. The diagnostic port 500 executes processing for the vehicle-mounted ECU.

According to the third embodiment, the configuration can be simplified by providing the diagnostic port 500 with the function of the management device. Since the diagnostic port provided in the conventional automobile 100 is provided with the function of the management device, it is not necessary to separately provide the management gateway 1 in the automobile 100.

In the third embodiment, the infotainment device 150 is not connected to the control vehicle-mounted network 110. This is to avoid connecting the infotainment device 150 to the control in-vehicle network 110 without going through the management gateway 1 from the viewpoint of security.

Although the embodiments of the present invention have been described in detail with reference to the drawings, the specific configuration is not limited to this embodiment, and design changes and the like within a range not deviating from the gist of the present invention are also included.

For example, either eSIM or SIM may be used as the secure element. The eSIM is usually soldered (hardware bound (H / W bound)) to an electronic board. The SIM is usually programmatically associated with an electronic board (software bind (S / W bind)).

In the above-described embodiment, the authentication method using the public key and the private key is used, but the authentication method using the common key may be used. When using a common key, it is preferable from the viewpoint of security that the key is held only in the secure area in the secure element.

It is also preferable to perform Secure Boot in the management gateway 1, the diagnostic terminal 140, the diagnostic port 500, and the in-vehicle ECU. According to secure boot, the validity of the operating system (OS) of the computer can be verified when the computer is started. Secure boot is described, for example, in Non-Patent Documents 3, 4, 5, and 6.

In the above-described embodiment, an automobile is taken as an example of the vehicle, but the present invention can be applied to other vehicles other than automobiles such as motorized bicycles and railway vehicles.

Further, a computer program for realizing the function of the management gateway 1 or the diagnostic port 500 described above is recorded on a computer-readable recording medium, and the program recorded on the recording medium is read into the computer system and executed. You may do it. The "computer system" referred to here may include hardware such as an OS and peripheral devices.
The "computer-readable recording medium" is a writable non-volatile memory such as a flexible disk, a magneto-optical disk, a ROM, or a flash memory, a portable medium such as a DVD (Digital Versatile Disk), or a built-in computer system. A storage device such as a hard disk.

Furthermore, the "computer-readable recording medium" is a volatile memory inside a computer system that serves as a server or client when a program is transmitted via a network such as the Internet or a communication line such as a telephone line (for example, DRAM (Dynamic)). It also includes those that hold the program for a certain period of time, such as Random Access Memory)).
Further, the program may be transmitted from a computer system in which this program is stored in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the "transmission medium" for transmitting a program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line.
Further, the above program may be for realizing a part of the above-mentioned functions. Further, a so-called difference file (difference program) may be used, which can realize the above-mentioned functions in combination with a program already recorded in the computer system.

1 ... Management gateway (management device), 10,232,1420 ... eSIM (secure element), 31 ... CAN interface, 32 ... Execution unit, 33,230,1410 ... Wireless communication unit, 34 ... Input / output interface, 11 ... Decryption Unit, 12 ... Key holding unit, 13 ... Signature verification unit, 14 ... Terminal authentication unit, 100 ... Automobile, 110 ... In-vehicle network for control, 120 ... Drive system ECU group, 121 ... Body system ECU group, 122 ... Safety control system ECU group, 130 ... diagnostic port, 140 ... diagnostic terminal, 200 ... center station, 210 ... authentication key holding unit, 220 ... signature key holding unit, 222 ... ECU code signature processing unit, 224 ... authority certificate signature processing unit, 240 … ECU code, 242,252… electronic signature, 250… authorization certificate

Claims (4)

It is equipped with a management device mounted on the vehicle and a terminal for exchanging data by communication between the management device.
The management device is
An input / output interface that exchanges data with the terminal,
A key holder that holds the authentication verification key,
A terminal authentication unit that authenticates the terminal using the authentication verification key,
Execution part and
It is provided with an in-vehicle network interface for exchanging data with an in-vehicle computer mounted on the vehicle via a communication network inside the vehicle.
The terminal
The authentication corresponding to the verification key holds the authentication key, the comprising information processing unit to respond by using the authentication key to the authentication request from the terminal authentication unit, the management data to be used for the vehicle computer Send to the device,
The execution unit uses the data received from the terminal for the in-vehicle computer when the authentication of the terminal is successful, and does not use the data received from the terminal when the authentication of the terminal is unsuccessful. It ’s a system,
The data used for the in-vehicle computer includes an in-vehicle computer identifier that identifies the in-vehicle computer to which the processing is executed and authority information that specifies the processing content for the in-vehicle computer.
The execution unit is a system that executes the processing content specified by the authority information only for the vehicle-mounted computer specified by the vehicle-mounted computer identifier.
The data used for the in-vehicle computer is the processing execution target data which is the data to be executed for the in-vehicle computer, and the processing execution target data including the type of the processing execution target data is independent of the type. An authority certificate that is provided and indicates the authority to execute processing on the in-vehicle computer, and is composed of an in-vehicle computer identifier that identifies the in-vehicle computer to which the processing is executed and authority information that specifies the processing content for the in-vehicle computer. With a certificate,
The execution unit executes processing according to the type of processing execution target data within the range of authority indicated in the authority certificate.
system. The processing execution target data is update program or setting change data of the in-vehicle computer, and is
The processing content specified by the authority information is at least one of writing data to the in-vehicle computer and reading data from the in-vehicle computer.
The execution unit is limited to the in-vehicle computer specified by the in-vehicle computer identifier when the processing content specified by the authority information is writing data to the in-vehicle computer and the type of data to be processed is an update program. Install the update program of the processing execution target data for
The execution unit is the in-vehicle computer specified by the in-vehicle computer identifier when the processing content specified by the authority information is writing data to the in-vehicle computer and the type of processing execution target data is setting change data. Rewrite the corresponding data with the setting change data of the processing execution target data for only
The system according to claim 1. When the processing content specified by the authority information is reading data from an in-vehicle computer, the execution unit executes data reading only for the in-vehicle computer specified by the in-vehicle computer identifier.
The system according to any one of claims 1 or 2. A management device mounted on the vehicle is provided with an in-vehicle network interface for exchanging data with an in-vehicle computer mounted on the vehicle via a communication network inside the vehicle.
Said management device, to the terminal to exchange data by communication with the management device, a terminal authentication step that uses the authentication verification key to authenticate the terminal,
A step in which the terminal holds an authentication key corresponding to the authentication verification key and responds to an authentication request from the management device by using the authentication key.
A step wherein the terminal is to transmit the data used in the vehicle computer to the management device,
Execution in which the management device uses the data received from the terminal for the in-vehicle computer when the authentication of the terminal is successful, and does not use the data received from the terminal when the authentication of the terminal is unsuccessful. A management method that includes steps and
The data used for the in-vehicle computer includes an in-vehicle computer identifier that identifies the in-vehicle computer to which the processing is executed and authority information that specifies the processing content for the in-vehicle computer.
The management device is a management method that executes the processing content specified by the authority information only for the vehicle-mounted computer specified by the vehicle-mounted computer identifier in the execution step.
The data used for the in-vehicle computer is the processing execution target data which is the data to be executed for the in-vehicle computer, and the processing execution target data including the type of the processing execution target data is independent of the type. An authority certificate that is provided and indicates the authority to execute processing on the in-vehicle computer, and is composed of an in-vehicle computer identifier that identifies the in-vehicle computer to which the processing is executed and authority information that specifies the processing content for the in-vehicle computer. With a certificate,
The execution unit executes processing according to the type of processing execution target data within the range of authority indicated in the authority certificate.
Management method.

Images