JPH1125301A - Automatic charge collecting/receiving system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To quickly attain charge collecting/receiving processing by electronically concluding a secured proxy contract between an IC card and an on-vehicle equipment by proxy and reception messages, and when a trouble of charge collection/reception occurs between a road side machine and an out- vehicle equipment or between the on-vehicle equipment and an IC card, safely solving the trouble by the security. SOLUTION: When the IC card 30 is inserted into the on-vehicle equipment 20, mutual verification is executed between the equipment 20 and the card 30. Then certification of an owner of the card 30 is executed and a proxy message is sent from the card 30 to the equipment 20, which sends a reception message to the card 30. At the time of receiving the reception message, the card 30 inspects an on-vehicle equipment name in the reception message by using a disclosure key of the equipment 20 and the card 30 and the equipment 20 electrically conclude a secured proxy contract by the proxy and reception messages. When a trouble of charge collection/reception occurs between the road side equipments 11a to 11c and the equipment 20 or between the equipment 20 and the card 30, the charge collection/reception is compensated based on the security.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an automatic toll collection system, and more particularly to an automatic toll collection system for receiving a toll at high speed by wireless communication between a vehicle-mounted device mounted on a vehicle and a roadside device installed on a roadside. It is about.

[0002]

2. Description of the Related Art Face-to-face collection of tolls on toll roads contributes to traffic congestion. In recent years, research has been actively conducted on an automatic toll collection system capable of automatically processing toll collection in order to alleviate the traffic congestion and save labor in toll collection. In the automatic toll collection system, toll collection is automatically performed by wireless communication between a roadside device installed on a roadside such as a tollgate and an on-vehicle device mounted on a passing vehicle. When the vehicle equipped with the vehicle-mounted device enters the exit tollgate where the roadside device is installed, an inquiry message is transmitted from the roadside device to the vehicle-mounted device. In response to the inquiry message, the on-vehicle device returns data such as the vehicle classification and the entrance tollgate to the roadside device.
The roadside device calculates the toll based on this data, and transmits the toll data again to the vehicle-mounted device. When the onboard unit receives the toll data, it subtracts the toll from the balance recorded by the IC card inserted inside the onboard unit,
The balance is updated as a new balance of the IC card.

[0003]

By the way, in the automatic toll collection system, the toll payment is not normally performed due to the failure of any of the roadside device, the in-vehicle device and the IC card, and the IC card owner is unduly expensive. There may be cases where a toll is paid or, conversely, a toll road can be traveled with a small toll. Alternatively, a case may be considered in which a toll or the like is intentionally falsified by a criminal and a manager or an IC card owner who manages the roadside device is damaged. However, in the conventional automatic toll collection system,
Due to the necessity of high-speed toll collection, the administrator of the roadside device and the IC card owner have not been given sufficient means to counter such a situation. For this reason, the administrator of the roadside device and the IC card owner could not recover the damage suffered.

The present invention has been made to solve such a problem, and an object of the present invention is to ensure the safety of money transactions in an automatic toll collection system that processes toll collection at a high speed.

[0005]

In order to achieve the above object, according to the present invention, an IC card is a unique first card which cannot be denied by the IC card itself based on the first information sent from the IC card to the vehicle-mounted device. A first signature generating means for generating a signature of the first and second signatures, and combining the first information and the first signature and transmitting the combined information as a delegation message to the vehicle-mounted device.
A second signature generating means for generating a unique second signature which cannot be denied by the on-vehicle device itself based on the second information sent to the C card; an acceptance message combining the second information and the second signature; To the IC card, and the IC card and the in-vehicle device electronically conclude a secured delegation contract with the delegation message and the acceptance message.

[0006] As a result, when a problem regarding toll collection occurs between the roadside device and the vehicle-mounted device and between the vehicle-mounted device and the IC card, the administrator of the roadside device and the IC card owner can use the collateral accompanying the commission contract. Compensated. Therefore, even if the toll collection is processed at a high speed, the problem that has occurred can be solved safely.

[0007]

DESCRIPTION OF THE PREFERRED EMBODIMENTS One embodiment of the present invention will be described below in detail with reference to the drawings. FIG. 1 is a block diagram showing the configuration of an embodiment of an automatic toll collection system according to the present invention. As shown in FIG. 1, roadside machines 11a, 11b, and 11c are provided at an entrance gate, an intermediate route such as a branch point, and an exit gate of a toll road, respectively. Each of the roadside devices 11a, 11b, 11c is connected to the antenna 13a, 13b, 13c and the control device 12a,
The antennas 13a to 13c are connected to control devices 12a to 12c, respectively, and the control devices 12a to 12c are connected to a central computer (administrator) 10. The vehicle 40 has the vehicle-mounted device 20 mounted therein, and the IC card 30 is inserted into the vehicle-mounted device 20.

[0008] The control device 12a included in the roadside device 11a installed at the entrance gate transmits toll road entrance gate information via the antenna 13a, and the vehicle-mounted device 2a.
The message from 0 is received. The control device 12b included in the roadside device 11b installed on the route on the way includes the antenna 1
Via 3b, route passing information indicating what route the vehicle 40 has traveled on the toll road is transmitted to the vehicle-mounted device 20. The control device 12c included in the roadside device 11c installed at the exit gate calculates a toll on a toll road based on a message from the vehicle-mounted device 20 via the antenna 13c, and transmits toll data.

The administrator 10 manages the hot list in which the abnormal on-board unit 20 and the IC card 30 are recorded, and uses a common public key (second public key) for all the on-board units 20 used in the asymmetric encryption method. Key) KP _SM and IC card 30
(A first public key) KP _ICC .

FIG. 2 is a block diagram showing the configuration of the vehicle-mounted device 20 shown in FIG. As shown in FIG. 2, the in-vehicle device 20 includes an IC card read / write unit 2 in a CPU 21.
2, a transmission / reception unit 23, an input unit 24, and a display unit 25 are connected. Further, the CPU 21 includes a security module 21a. The IC card read / write unit 22 has an insertable / removable IC card 30.
Is inserted.

The CPU 21 controls the operation of the vehicle-mounted device 20. The security module 21a uses a common secret key (second secret key) K common to all the vehicle-mounted devices 20 used in the asymmetric encryption method.
_Stores information that must be kept secret, such as SSM. Also,
The security module 21a is designed so that it cannot be reproduced if it is to be disassembled in order to ensure confidentiality. The IC card read / write unit 22 is an interface between the vehicle-mounted device 20 and the IC card 30. Transceiver 2
3 performs wireless communication with each of the roadside devices 11a to 11c. The input unit 24 is an input unit for inputting a password or the like of the IC card 30, and uses a numeric keypad or the like. Display 2
Reference numeral 5 denotes a display for displaying a charge or the like, and an LCD or the like is used.

The IC card 30 has a CPU. The IC card 30 has a unique ID of the IC card 30.
_ICC , a unique secret key (first secret key) KS _{ICC of} the IC card 30 used in the asymmetric encryption method and the all-vehicle device 20
Information such as a common public key KP _SM is stored.

Next, the operation of the automatic toll collection system shown in FIG. 1 will be described. FIG. 3 is a sequence diagram showing operations of the administrator 10, the on-vehicle device 20, and the IC card 30 shown in FIG. First, the IC card 30
Is inserted into the vehicle-mounted device 20, partner authentication is performed between the vehicle-mounted device 20 and the IC card 30 (step 50). This partner authentication is performed to confirm that the inserted IC card 30 is an IC card for paying a toll.

Next, IC card owner authentication is performed (step 52). The owner of the IC card 30 is the onboard device 2
When the personal identification number of the IC card 30 is input from the input unit 24 of “0” (step 51), the input number is
0 is transferred. Then, the number transferred to the IC card 30 is compared with the personal identification number of the IC card 30 stored in the IC card 30.
Authenticated as the owner of At this time, if the collation result does not match a predetermined number of times, the I
Make the C card 30 unusable, etc.
Measures will be taken to prevent unauthorized use of Zero.

Next, a commission message is sent from the IC card 30 to the vehicle-mounted device 20 (step 53). The delegation message is a message that the IC card 30 delegates toll collection processing with the administrator 10 (hereinafter, referred to as ETC payment) to the vehicle-mounted device 20. The delegation message is a serial number (first serial number), date and time, delegation content, delegate name ID
_ICC , commission amount, etc. (the above is defined as primary information)
And an IC card signature (first signature).

Here, the serial number is a number that increases by one each time a commission message is sent. The date and time are the date and time when the delegation message is sent. The delegation content is “ETC payment”. The commission amount is the upper limit of the commission amount to be paid by ETC payment. In addition,
Here, since the upper limit of the amount of the ETC payment is set, even if an outrageous toll is charged to the IC card 30, it is immediately recognized that the IC card 30 is abnormal.
The owner of the card 30 does not suffer any damage.

The signature of the IC card is the IC card 30.
Using the secret key KS _ICC of the IC card 30, the first information, that is, the serial number, date and time, delegation contents, delegator name ID _ICC , delegation amount, etc. It is generated by the CPU (the CPU of the IC card 30 at this time is defined as first signature generation means). Since the private key KS _ICC is unique, the IC card signature is I
The C card 30 is unique to the IC card 30 and cannot be denied.

Incidentally, the first information except for the serial number and the date and time may have exactly the same contents. If the plaintexts are the same, the same IC card signature is created from the secret key KS _ICC . However, if the exact same IC card signature is created, the possibility of misuse by a third party increases. Therefore, by adding a serial number and a date and time to the first information,
Avoid the first information to be the same, always different IC
The card signature is generated.

Next, when the in-vehicle device 20 receives the delegation message from the IC card 30, the in-vehicle device 20
0, and sends an acceptance message (step 54). The acceptance message is a message indicating that the in-vehicle device 20 accepts the ETC payment on behalf of the IC card 30. However, when the in-vehicle device 20 receives the delegation message, the in-vehicle device 20 uses the public key KP of the IC card 30.
_Since there is no _ICC , the on-vehicle device 20 cannot check whether the IC card signature in the commission message is genuine. Therefore, the acceptance message transmitted in step 54 is a temporary acceptance message.

The acceptance message includes a serial number (second serial number),
The date and time, the contents of the commission, the person ID ID _SM , the commission amount, etc. (the above are defined as the second information), and the signature of the vehicle-mounted device (second
Signature). Here, the serial number is a number that increases by one each time the acceptance message is sent. The date and time are the date and time when the acceptance message is sent. In addition, the content of the commission is "ETC payment"
It is. The ID _SM is a unique ID of the vehicle-mounted device 20. In addition, the commission amount is the upper limit of the amount accepted by ETC payment.

The in-vehicle device signature is an authentication statement obtained by performing an encryption operation on the second information using the secret key KS _SM of the in-vehicle device 20, and is generated by the CPU 21 of the in-vehicle device 20 (this The CPU 21 at that time is defined as a second signature generation unit). The onboard device signature has the same effect as the IC card signature. When receiving the acceptance message from the in-vehicle device 20, the IC card 30 checks the in-vehicle device signature included in the acceptance message using the public key KP _SM of the in-vehicle device 20. Inspection of the terminal signature is performed by comparing to that obtained by performing a cryptographic operation on the vehicle-mounted device signature based on the public key KP _SM vehicle-mounted apparatus 20, the first information. Then, based on the commission message and the commission message, the IC card 30 and the vehicle
, A secured delegation agreement is signed electronically.

Next, when the vehicle 40 equipped with the on-vehicle device 20 passes through the entrance gate of the toll road, the manager 10 transmits the information to the on-vehicle device 2 via the roadside device 11a provided at the entrance gate.
0 and the IC card 30 are authenticated. At this time, the manager 10 receives the ID _{SM of the} vehicle-mounted device 20 and the ID _{ICC of the} IC card 30. Then, the on-vehicle device 20 performs partner authentication with respect to the manager 10 (step 55). Next, the vehicle-mounted device 20 transmits the previous transaction report to the manager 10 (step 56). The previous transaction report is created by the in-vehicle device 20 in step 66, as will be described later. Whether the process between the in-vehicle device 20 and the IC card 30 based on the commissioned transaction process in step 63 has been performed normally. Whether or not is recorded.

Then, in the previous transaction report, the
When it is reported that the process between the IC card 30 and the IC card 30 has not been performed normally and the acceptance process has not been completed normally, the administrator 10 posts the IC card 30 as an abnormal IC card on the hot list. Further, the administrator 10 checks the IC card 30 later and performs a billing process for the owner of the IC card 30.

On the other hand, if there is any objection to the result of the delegation process notified in step 64, the owner of the IC card 30 makes an in-vehicle device abnormality report to the manager 10 and Request for cancellation of delegation and return to the status quo. The in-vehicle device abnormality report is transmitted to the manager 1 by the owner of the IC card 30 by writing the commission message, the acceptance message, and the content of the detected abnormality stored in the IC card 30 to the manager 1.
This is done by presenting for 0. In response to the in-vehicle device abnormality report, the administrator performs the current state restoration process of the IC card 30 and the manual process of toll payment, and also posts the in-vehicle device 20 as an abnormal in-vehicle device in a hot list. Further, the administrator carries out a survey of the vehicle-mounted device 20 later.

As described above, when the manager 10 and the owner of the IC card 30 suffer damage due to the abnormality of the vehicle-mounted device 20 and the IC card 30, the damage is compensated by the above-mentioned security.

Next, when it is reported in the previous transaction report that the acceptance process has been completed normally, the manager 10 determines based on the ID _{SM of the} vehicle-mounted device 20 and the ID _ICC of the IC card 30 received in step 55. And the in-vehicle device 20 and the IC
It is checked whether the card 30 is on the hot list (step 57). As a result, the in-vehicle device 20
Alternatively, if the IC card 30 is listed in the hot list, the manager 10 judges that the transaction is abnormal and rejects the transaction with the vehicle-mounted device 20 (step 58).

On the other hand, if the in-vehicle device 20 and the IC card 30 are not listed in the hot list, the administrator 10 determines that the information is normal, and sends the public key K of the IC card 30 to the in-vehicle device 20.
To distribute the P _{IC C} (step 59). It should be noted that the in-vehicle device 20
Even if the IC card 30 is listed in the hot list, the transaction with the in-vehicle device 20 is not rejected without rejecting the transaction with the in-vehicle device 20 in order to monitor the behavior of the owner of the in-vehicle device 20 and the IC card 30. Public key KP _{IC C} of IC card 30
Can also be distributed.

Next, the in-vehicle device 20 checks the IC card signature included in the delegation message received in Step 53 using the public key KP _ICC of the IC card 30 received in Step 59 (Step 60). Inspection of the IC card signature is based on the public key KP _ICC of the IC card 30.
The one obtained by performing a cryptographic operation on the C card signature and the first
The information is compared with the information. As a result, if they match, it is determined to be normal, and the IC card signature is correct.
The creation by the card 30 is confirmed. However, if they do not match, it is determined to be abnormal. As a result, the in-vehicle device 20 cancels the acceptance of the IC card 30 (step 61), and reports an abnormality to the manager 10 (step 62).

Next, if the result of the IC card signature check in step 60 is normal, the vehicle-mounted device 2 is turned on when the vehicle 40 passes through the middle route of the toll road and the exit gate.
Delegated transaction processing is performed between 0 and the manager 10 (step 63). After the commission transaction processing, the vehicle-mounted device 20 sends the commission processing result to the IC card 30 (step 64).
The delegation processing result is composed of undecided decision items such as a toll, a notification of completion of the delegation transaction processing, and the like.
At this time, the in-vehicle device signature of the in-vehicle device 20 may be included in the delegation processing result.

Next, if there is no objection to the result of the delegation process, the IC card 30 returns a settlement certificate to the vehicle-mounted device 20 (step 65). The payment certificate includes the payment amount. Also, the proof of settlement is really IC card 3
Since it is necessary to clarify that the information has been created by 0, a serial number and an IC card signature are added together with the date and time when the payment certificate is sent, and then sent.

Next, the vehicle-mounted device 20 creates a previous transaction report and saves it (step 66). The previous transaction report includes information related to the commission transaction processing in step 63, and the vehicle-mounted device 20 and the IC card 30 based on the commission transaction processing.
It is recorded whether or not the process between the steps has been performed normally. That is, if no abnormality is found in the settlement confirmation received in step 65, it is determined that the acceptance processing has been normally completed, and a previous transaction report indicating the previous normal termination is created. The last transaction report at the time of the last successful completion is Step 6.
5 and the payment certificate received from the IC card 30 in I
C signature (including serial number and date and time).

Conversely, when an abnormality is recognized in the settlement certificate received in step 65, or when the settlement certificate is not sent from the IC card 30, it is determined that the acceptance process has not been completed normally, and The machine 20 attempts to create a previous transaction report to the effect of a previous abnormal termination. The previous transaction report at the time of the previous abnormal end is the commission message received from the IC card 30 in step 53,
Is composed of toll fees, in-vehicle device signatures, and the like in the delegated transaction processing of. Even if the in-vehicle device 20 cannot create the previous transaction report indicating the previous abnormal end, the previous transaction report indicating the previous normal end is not generated, indicating that the previous operation was abnormally ended.

The reason why the previous transaction report is created in step 66 is that the acceptance process is completed after the vehicle 40 has passed through the exit gate, so that the result of the acceptance process cannot be reported to the manager 10. is there. Therefore, as described above, the vehicle-mounted device 20 transmits the previous transaction report created in step 66 to the manager 10 the next time the vehicle passes through the entrance gate of the toll road. Note that the manager 10 constantly checks the collection of the previous transaction report (step 67). The collection check in the previous transaction report is effective in detecting unauthorized vehicles.

[0034]

As described above, according to the present invention, the IC
The card and the in-vehicle device electronically conclude a secured delegation contract by using an IC card-specific delegation message and an in-vehicle device-specific acceptance message. As a result, the roadside machine
When a problem regarding toll collection occurs between the vehicle-mounted device and between the vehicle-mounted device and the IC card, the administrator of the roadside device and the IC card owner are compensated based on collateral accompanying the delegation contract. Therefore, even if the toll collection is processed at a high speed, the problem that has occurred can be solved safely.

According to the second aspect of the present invention, in the first signature, the first information including the first serial number and the like is subjected to a cryptographic operation based on a unique first secret key. Generated by Since the first information includes the first serial number and the like, even if the contents other than the first serial number and the like in the first information are the same, the contents of the first serial number and the like are different. The contents of the first information are never the same. Therefore, the same signature cannot be generated from the unique first secret key,
It is difficult to commit fraud, and the IC card cannot deny the first signature. The same applies to the second signature, and it is difficult to commit fraud, and the in-vehicle device itself cannot deny the second signature. Thereby, the IC card and the vehicle-mounted device can conclude a delegation contract based on the delegation message including the first signature and the acceptance message including the second signature.

According to the third aspect of the present invention, when the vehicle-mounted device prepares a previous transaction report and passes through the next-circuit-side device, the process based on toll collection is normally performed between the vehicle-mounted device and the IC card. Report to the roadside machine whether or not it was done. Thereby, the administrator of the roadside device can grasp the process between the vehicle-mounted device and the IC card. Further, based on the previous transaction report from the in-vehicle device and the in-vehicle device abnormality report from the IC card, the administrator of the roadside device can detect an abnormality in the in-vehicle device and the IC card. The roadside manager then conducts an investigation based on this detection and, as a result, takes necessary measures,
The security of the automatic toll collection system that processes toll collection at high speed can be ensured.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a configuration of an embodiment of an automatic toll collection system according to the present invention.

FIG. 2 is a block diagram showing a configuration of the vehicle-mounted device shown in FIG.

FIG. 3 is a sequence diagram showing operations of an administrator, an on-vehicle device, and an IC card shown in FIG. 1;

[Explanation of symbols]

10: Administrator, 11a to 11c: Roadside machine, 12a to 12
c: control device, 13a to 13c: antenna, 20: in-vehicle device, 21: CPU, 21a: security module,
22: IC card read / write unit, 23: transmitting / receiving unit,
24 input unit, 25 display unit, 30 IC card, 40
…vehicle.

──────────────────────────────────────────────────続 き Continued on the front page (51) Int.Cl. ⁶ Identification code FIG06F 15/21 340B

Claims (3)

[Claims] An automatic toll collection system for collecting a toll by wireless communication between an in-vehicle device mounted on a vehicle and operating based on various information recorded on an IC card and a roadside device installed on a roadside. The IC card includes first signature generation means for generating a unique first signature which cannot be denied by the IC card itself based on first information transmitted by the IC card to the on-vehicle device; 1 and the first signature are combined and sent to the in-vehicle device as a delegation message. The in-vehicle device receives the in-vehicle device itself based on the second information sent by the in-vehicle device to the IC card. A second signature generating means for generating a unique second signature that cannot be denied;
The combination of the second information and the second signature is sent to the IC card as an acceptance message, and the IC card and the in-vehicle device electronically execute a secured agreement based on the authorization message and the acceptance message. Between the roadside device and the vehicle-mounted device and between the vehicle-mounted device and the IC
An automatic toll collection system characterized in that when a problem regarding toll collection occurs between cards, the collateral can safely solve the problem. 2. The method according to claim 1, wherein the first signature is a unique first signature in asymmetric cryptography.
Is generated by performing a cryptographic operation on a first serial number or a date and time at which the delegation message is sent based on a secret key of the asymmetric encryption method. A second information including a second serial number or a date and time at which the acceptance message is sent is generated by performing a cryptographic operation based on a second secret key. Performing a cryptographic operation on the first signature based on a first public key in an asymmetric cryptosystem corresponding to one secret key to confirm that the first signature has been generated by the IC card; The card performs a cryptographic operation on the second signature based on a second public key in the asymmetric cryptography corresponding to the second secret key, and confirms that the second signature is generated by the vehicle-mounted device. Check that Thereafter, the IC card and the on-vehicle device electronically conclude the secured delegation contract, wherein the automatic toll collection system is characterized in that: 3. The vehicle-mounted device according to claim 1, wherein after the toll collection is performed between the in-vehicle device and the roadside device, a process based on the toll collection between the in-vehicle device and the IC card is normal. Creates a previous transaction report that records whether or not the transaction has been performed on the roadside machine, and sends the previous transaction report to the roadside machine the next time the vehicle passes the roadside machine. Based on the previous transaction report, the administrator of the device lists the IC card as an abnormal IC card in the list and refuses subsequent transactions with the IC card. The administrator of the roadside device receives the report of the in-vehicle device abnormality directly from the IC card, thereby listing the in-vehicle device as an abnormal in-vehicle device in the list, and performing a subsequent transaction with the in-vehicle device. Reject An automatic toll collection system characterized by the following.