KR101811022B1 - Method for authenticating vehicul communication - Google Patents

Abstract

The vehicle communication authentication system performs a mutual authentication with a principal by performing an authentication protocol based on a USIM (User Subscriber Identify Module) in a wireless network, and provides a vehicle service after installing a USIM card, And carries out authentication for communication between the server and the vehicle.

Description

[0001] METHOD FOR AUTHENTICATING VEHICULUM COMMUNICATION [0002]

The present invention relates to a vehicle communication authentication method, and more particularly, to an authentication method between a vehicle-mounted terminal performing vehicle communication with a roadside base station and a server providing a vehicle service.

Vehicle communication technologies such as DSRC (Dedicated Short Range Communication) and WAVE (Wireless Access for Vehicular Environment) can be used for communication between roadside equipment and onboard equipment through short distance wireless communication. .

In order to safely protect personal information and the like in using vehicle communication technology and securely provide various services using vehicle communication technology, a technology for authenticating a legitimate user is needed. However, the standards for security and authentication of DSRC and WAVE are inadequate.

SUMMARY OF THE INVENTION It is an object of the present invention to provide a vehicle communication authentication method capable of providing a secure service through vehicle communication.

According to one embodiment of the present invention, a method for performing authentication in an in-vehicle terminal performing vehicle communication with a roadside base station is provided. The authentication method includes: inserting a user subscriber identity module (USIM) card successfully authenticated with an authentication subject into a card slot; generating authentication information using the session keys generated in the mutual authentication when requesting a vehicle service Transmitting the encrypted data from the roadside base station to the vehicle service server providing the vehicle service through the roadside base station, and when the authentication information transmitted by the vehicle-mounted terminal is successfully verified, And receiving the data.

According to another embodiment of the present invention, there is provided a method of authenticating a vehicle-mounted terminal performing vehicle communication with a roadside base station in a server providing vehicle service. The authentication method includes the steps of receiving a vehicle service request including authentication information from a vehicle-mounted terminal inserted in a card slot with a USIM (User Subscriber Identify Module) card succeeding mutual authentication with an authentication subject, And verifying the vehicle-mounted terminal by transmitting information to the authentication subject.

According to the embodiment of the present invention, it is possible to provide an authentication method in vehicle communication such as DSRC or WAVE using an authentication method of an existing wireless network such as WCDMA or WLAN, generate mutual authentication information and a key through authentication, Data in the interval can be seen.

In addition, since it is linked with the authentication server of the existing wireless network, it is possible to reduce the cost of constructing a separate authentication server for authentication in the vehicle communication, so that authentication of the vehicle communication can be performed with a minimum cost.

1 is a diagram showing a vehicle communication authentication system according to an embodiment of the present invention.
2 is a flowchart illustrating an authentication method performed in a vehicle communication authentication system according to an embodiment of the present invention.
3 is a schematic view of a USIM card according to an embodiment of the present invention.
4 is a diagram illustrating an AKA authentication protocol applied to the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily carry out the present invention. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. In order to clearly illustrate the present invention, parts not related to the description are omitted, and similar parts are denoted by like reference characters throughout the specification.

Throughout the specification and claims, when a section is referred to as "including " an element, it is understood that it does not exclude other elements, but may include other elements, unless specifically stated otherwise.

Now, a vehicle communication authentication method according to an embodiment of the present invention will be described in detail with reference to the drawings.

1 is a diagram showing a vehicle communication authentication system according to an embodiment of the present invention.

1, the vehicle communication authentication system includes a road side equipment (RSE) 100, an onboard equipment (OBE) 200, a vehicle service server 300, an authentication authorization / Accounting server 400, a home location register and authentication center (HLR / AUC) 500, and a user terminal 600.

The OBE 200 is a terminal mounted on a vehicle, and has a communication module (not shown) for vehicle communication in the wireless section with the RSE 100.

The RSE 100 has a communication module for vehicle communication in the wireless section with the OBE 200 and provides the vehicle service from the vehicle service server 300 to the OBE 200 through vehicle communication with the OBE 200 do.

Also, the RSE 100 and the OBE 200 transmit / receive various information through vehicle communication. For example, the OBE 200 may collect the driving information of the vehicle and the information of the surrounding vehicles, and may transmit the information to the RSE 100 through the vehicle communication, and the RSE 100 may transmit the information received from the OBE 200 to the vehicle service To the server 300 or another server.

Communication technologies such as DSRC (Dedicated Short Range Communication) or WAVE (Wireless Access for Vehicular Environment) may be used for the communication module for vehicle communication.

The vehicle service server 300 is connected to the RSE 100 and provides the vehicle service to the OBE 200 through the RSE 100.

In accordance with an embodiment of the present invention, the OBE 200 and the vehicle service server 300 perform authentication in order to provide secure vehicle service to the OBE 200. The authentication in the vehicle communication is performed through interlocking with the wireless network 10. [

The OBE 200 uses a User Subscriber Identity Module (USIM) used as an authentication means of the user terminal 600 in the wireless network 10 for authentication of vehicle communication. Accordingly, the OBE 200 has a card slot (not shown) in which a USIM card can be mounted.

Information used for authentication of vehicle communication and information used for mutual authentication in the wireless network 10 are stored in advance in the USIM card. The information used for the authentication of the vehicle communication may include vehicle user information such as a vehicle identifier and vehicle user information. The information used for the mutual authentication in the wireless network 10 may include a secret key or the like.

In addition, the AAA server 400 and the HLR / AUC 500 store information stored in the USIM card in advance for authentication.

The USIM card is first installed in the user terminal 600 using the wireless communication in the wireless network 10 and then transmitted to the AAA server 400 or the HLR / AUC 500 Mutual authentication is performed. In this case, an authentication and key agreement (AKA) or an extended authentication protocol-AKA (Extensible Authentication Protocol-AKA) may be used for the mutual authentication in the wireless network 10. If the wireless network 10 is a WCDMA network, an AKA authentication protocol may be used as the authentication protocol, and the authentication subject may be the HLR / AUC 500. In the case where the wireless network 10 is a WLAN (Wireless Local Area Network) network, an EAP-AKA authentication protocol may be used as an authentication protocol, and the authentication subject may be an AAA server 400.

If the mutual authentication is successful in the wireless network 10, the USIM card and the AAA server 400 or the HLR / AUC 500 store the session key generated in mutual authentication.

Then, the USIM card is inserted into the card slot of the OBE 200 to perform authentication with the vehicle service server 300 for vehicle communication. The vehicle service server 300 can authenticate the user terminal 600 using the AAA server 400 or the HLR / AUC 500. The session key stored in the USIM card can be used for encryption / decryption of data using vehicle communication. Also, the session key stored in the AAA server 400 or the HLR / AUC 500 may be transmitted to the RSE 100 and used for encryption / decryption of data using vehicle communication.

2 is a flowchart illustrating an authentication method performed in a vehicle communication authentication system according to an embodiment of the present invention.

Referring to FIG. 2, the user registers vehicle user information in the AAA server 400 or the HLR / AUC 500 before performing authentication in the vehicle communication authentication system, and stores the vehicle user information in the USIM card. The vehicle user information is an identifier indicating the vehicle user, and may include a vehicle identifier, a registration number of the vehicle, and a driving license number of the vehicle user. Alternatively, a separate user registration number that can represent the vehicle user may be issued and used as the vehicle user information.

The vehicle service server 300 stores vehicle user information registered in the AAA server 400 or the HLR / AUC 500 (S200). That is, the vehicle service server 300 shares the vehicle user information registered in the AAA server 400 or the HLR / AUC 500 with the AAA server 400 or the HLR / AUC 500.

In addition, the user stores the secret key in the AAA server 400, the HLR / AUC 500 and the USIM card (S210).

The USIM card storing the information is first installed in the user terminal 600 and performs mutual authentication with the AAA server 400 or the HLR / AUC 500 through the authentication protocol in the wireless network 10 at step S220.

The USIM card and the AAA server 400 or the HLR / AUC 500 generate and store the authentication information using the session key, for example, the encryption key and the integrity key generated in the mutual authentication process (S230). As the authentication information, it is possible to use a value obtained by encrypting the authentication data obtained by combining mutual promised vehicle user information by using the key generated in the mutual authentication process.

The AAA server 400 or the HLR / AUC 500 stores the authentication data in association with the vehicle identifier, the vehicle user information, and the key generated in the mutual authentication process. When the authentication information of the vehicle user information is later verified, Verification is performed by checking the authentication data associated with the user information and the decrypted authentication information.

If the mutual authentication in the wireless network 10 is successful, the user inserts the USIM card into the OBE 200.

Next, the user executes the vehicle service through the vehicle communication. Then, the OBE 200 in which the USIM card is inserted requests a vehicle service to the vehicle service server 300 through the RSE 100 (S240). At this time, the request for the vehicle service may include the authentication information generated by the USIM card and the vehicle identifier requesting the vehicle service.

The vehicle service server 300 providing the vehicle service receives the request for the vehicle service and confirms the vehicle identifier and the authentication information (S250).

The vehicle service server 300 requests the AAA server 400 or the HLR / AUC 500 to confirm the authentication information corresponding to the vehicle identifier in step S260. The AAA server 400 and the HLR / The authentication information corresponding to the identifier is searched to determine whether the authentication information is legitimate by decrypting the authentication information or the like (S270). That is, the AAA server 400 and the HLR / AUC 500 store the key, vehicle user information, and authentication data corresponding to the corresponding USIM card generated in the mutual authentication process in the wireless network 10. Therefore, the AAA server 400 or the HLR / AUC 500 checks whether the authentication data corresponding to the stored vehicle identifier matches the authentication information requested to be confirmed from the vehicle service server 300, And transmits the session keys generated in the mutual authentication process in the network (10) to the vehicle service server (300).

The vehicle service server 300 transmits the session keys received from the AAA server 400 or the HLR / AUC 500 to the RSE 100 (S280).

The RSE 100 performs encryption / decryption communication with the OBE 200 in the wireless section using the session keys received from the vehicle service server 300. In addition, the OBE 100 performs encryption / decryption communication with the RSE 100 in the radio section using the session key stored in the USIM card in the mutual authentication process. At this time, the data encryption / decryption in the OBE 200 can be performed in the USIM card.

That is, the RSE 100 may encrypt the vehicle service data using the session keys received from the vehicle service server 300 and transmit the encrypted vehicle service data to the OBE 200. The OBE 200 can decrypt the encrypted data using the session keys stored in the USIM card in the mutual authentication process in the wireless network 10. [ In addition, the OBE 200 can encrypt various data collected using the session keys stored in the USIM card during the mutual authentication process in the wireless network 10, and transmit the encrypted data to the RSE 100 in the wireless section, May decrypt the corresponding data using the session keys received from the vehicle service server 300. [

3 is a schematic view of a USIM card according to an embodiment of the present invention.

Referring to FIG. 3, the USIM card stores wireless communication authentication information used for an authentication protocol in the wireless network and vehicle communication authentication information used for authentication in vehicle communication. The vehicle communication authentication information may include vehicle user information.

For example, the USIM card is a wireless communication authentication information used in an authentication protocol in a corresponding wireless network, and is used for WCDMA authentication information used in an AKA authentication protocol in a WCDMA network and / or in an EAP-AKA authentication protocol in a WLAN network WLAN authentication information can be stored.

4 is a diagram illustrating an AKA authentication protocol applied to the present invention.

AKA authentication protocol can be used in WCDMA network. The AKA authentication protocol establishes mutual authentication between the user and the network using the information of the USIM card and the secret key (K) available only to the HLR / AUC 500.

Referring to FIG. 4, the AKA authentication protocol starts when the VLR / SGSN (Visitor Location Register / Serve GPRS Supporting Node) 11 of the WCDMA network requests a user identifier to the user terminal 600 (S402).

The USIM card of the user terminal 600 transmits an International Mobile Subscriber Identifier (IMSI), which is a user identifier, to the VLR / SGSN 11 via a Radio Network Controller (RNC) (S404).

The VLR / SGSN 11 requests authentication information corresponding to the user identifier to the HLR / AUC 500 which is the authentication server (S406).

The HLR / AUC 500 which has requested the authentication information corresponding to the user identifier generates a plurality of authentication vectors AV and transmits them to the VLR / SGSN 11 (S408). The HLR / AUC 500 generates a random number RAND and a sequence number SQuence Nymber SQN and generates a message authentication code with a random number RAND, a sequence number SQN, (MAC), an expected response (XRES), an encryption key (Cipher Key, CK), an integrity key (IK) and an authentication token (AUTN) Can be generated.

The VLR / SGSN 11 transmits a random number RAND and an authentication token AUTN among the authentication vectors AV received from the HLR / AUC 500 to the user terminal 600 via the RNC (S410).

The USIM card of the user terminal 600 uses the received random number RAND, the authentication token AUTN and the secret key K to generate an expected message authentication code eXpected MAC, XMAC, a response RES, an encryption key CK And authenticates the network by comparing the calculated expected message authentication code XMAC with the message authentication code MAC value in the received authentication token AUTN at step S414.

The user terminal 600 transmits the calculated RES response value to the VLR / SGSN 11 via the RNC when the expected message authentication code (XMAC) matches the message authentication code (MAC) (S414).

The VLR / SGSN 11 verifies the user terminal 600 by comparing the response value (RES) transmitted from the user terminal 600 with the calculated expected response (XPES) value (S416).

The VLR / SGSN 11 transmits an authentication success message to the user terminal 600 via the RNC (S418) when the response value (RES) and the calculated expected response (XPES) value match And is terminated.

If the AKA authentication protocol is successfully completed, the VLR / SGSN 11 transmits the encryption key (CK) and the integrity key (IK) to the RNC.

The RNC stores the encryption key (CK) and the integrity key (IK) received from the VLR / SGSN 11 and encrypts and verifies integrity in data communication with the user terminal (600) Integrity key (IK) is used.

Meanwhile, in the WLAN network or the like, the EAP-AKA authentication protocol can be used as the authentication protocol, and the EAP-AKA authentication protocol can be used in conjunction with the authentication information of the 3G network. The EAP-AKA authentication protocol is an EAP mechanism that uses AKA as an authentication and key distribution protocol, and performs AKA protocol after recognizing the user identifier.

In the EAP-AKA authentication protocol, the AAA server 400 requests the HLR / AUC 500 to generate an authentication vector, and the HLR / AUC 500 generates and transmits the authentication vectors to the AAA server 400. The AAA server 400 performs mutual authentication with the user terminal 600 by performing an AKA authentication protocol, and generates and shares an encryption key (CK) and an integrity key (IK).

In the EAP-AKA authentication protocol, the encryption key (CK) and the integrity key (IK) are not used for data communication but the master key (MK) and the integrity key A master session key (MSK), and the like. When the key generation is completed, the AAA server 400 transmits the master session key (MSK) to an access point (AP) or an access control router (ACR) as a control station, and the AP or ACR stores a master session key do. A part of the shared master session key (MSK) is used as an encryption key or an integrity key used for encryption / decryption of data communication.

The embodiments of the present invention are not limited to the above-described apparatuses and / or methods, but may be implemented through a program for realizing functions corresponding to the configuration of the embodiment of the present invention or a recording medium on which the program is recorded, Such an embodiment can be readily implemented by those skilled in the art from the description of the embodiments described above.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, It belongs to the scope of right.

Claims (12)

A method of performing authentication in a vehicle-mounted terminal performing vehicle communication with a roadside base station,
Inserting a User Subscriber Identify Module (USIM) card successfully authenticated with the authentication subject into the card slot,
Collecting driving information of the vehicle equipped with the vehicle-mounted terminal and information of the surrounding vehicle;
Generating authentication information using the session keys generated in the mutual authentication when requesting the vehicle service,
Transmitting the authentication information, the running information of the vehicle and the information of the neighboring vehicle to the vehicle service server providing the vehicle service through the roadside base station, and
Receiving encrypted data from the roadside base station when the authentication information transmitted from the vehicle-mounted terminal is successfully verified in the vehicle service server
/ RTI >
Wherein the encrypted communication is performed between the vehicle-mounted terminal and the roadside base station using the session key,
Wherein the authentication information includes a value obtained by encrypting vehicle user information using the session key, and the vehicle user information includes at least one of a vehicle identifier, a vehicle registration number, and a driver's license number of the vehicle user. The method according to claim 1,
Decrypting the encrypted data using the session keys
Further comprising: The method according to claim 1,
Performing a mutual authentication by attaching to a user terminal equipped with a wireless communication module before the USIM card is inserted into the card slot
Further comprising: The method of claim 3,
Wherein the performing mutual authentication comprises:
And performing an authentication and key agreement (AKA) authentication protocol between the user terminal and the authentication subject. The method of claim 3,
Wherein the performing mutual authentication comprises:
And performing an Extensible Authentication Protocol-Authentication and Key Agreement (EAP-AKA) authentication protocol between the user terminal and the authentication entity. The method according to claim 1,
Wherein the USIM card and the authentication subject store vehicle user information used for verifying a vehicle-mounted terminal performing the vehicle communication. A method for authenticating a vehicle-mounted terminal performing vehicle communication with a roadside base station in a server providing vehicle service,
Receiving from a vehicle-mounted terminal through the roadside base station, travel information of the vehicle on which the vehicle-mounted terminal is installed and information of the surrounding vehicle;
Receiving a vehicle service request including authentication information from a vehicle-mounted terminal that inserts a User Subscriber Identity Module (USIM) card successfully authenticated with an authentication subject into a card slot and performs vehicle communication with the roadside base station,
Requesting the authentication subject to verify the authentication information, and
Receiving the session key generated at the mutual authentication from the authentication subject and transmitting the same to the roadside base station when the authentication entity verifies the authentication information
Lt; / RTI >
Wherein the encrypted communication is performed between the vehicle-mounted terminal and the roadside base station using the session key,
Wherein the authentication information includes a value obtained by encrypting vehicle user information using the session key, and the vehicle user information includes at least one of a vehicle identifier, a vehicle registration number, and a driver's license number of the vehicle user. delete delete 8. The method of claim 7,
Wherein the mutual authentication is performed by being inserted into a user terminal equipped with a wireless communication module before the USIM card is inserted into the card slot. 11. The method of claim 10,
The mutual authentication includes an authentication and key agreement (AKA) authentication protocol or an extended authentication protocol-authentication and an AKA (EAP-AKA) authentication protocol according to the wireless communication module. This is the authentication method used. 8. The method of claim 7,
Storing the vehicle user information,
Wherein the vehicle user information is also stored in the authentication subject and used to confirm whether the authentication information transmitted by the vehicle-mounted terminal is legitimate.

Images