KR101917521B1 - Communication system and security authentication method - Google Patents

Abstract

The present invention provides a communication system which can improve security by inhibiting hacking for a mask algorithm, and a communication security method thereof. According to an embodiment of the present invention, in the communication system providing a communication between a plurality of units, each unit comprises: a communication part connected to a bus unit for the communication; a communication scheduling part executing authentication for communication security based on a message received from the communication part; and an authentication information providing part holding a plurality of different authentication information, and providing any one authentication information according to a request of the communication scheduling part.

Description

[0001] COMMUNICATION SYSTEM AND SECURITY AUTHENTICATION METHOD [0002]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a communication system for data transmission / reception between devices and a communication security method thereof, and more particularly, to a communication system for a vehicle and a communication security method thereof.

2. Description of the Related Art In recent years, various electronic apparatuses generally incorporate a communication system for automatic control.

In particular, recently released vehicles generally include a plurality of electronic control units (ECUs) for implementing various functions for improving the convenience and safety of the driver, and a communication system for transmitting and receiving the data.

Communication protocols used in automotive communication systems include CAN (Controller Area Network), LIN (Local Interconnect Network), FlexRay, and MOST (Media Oriented Systems Transport), among which the CAN protocol is mainly selected.

Since the CAN protocol is based on broadcast communication, there is a problem that network eavesdropping is easy and there is no message authentication means. Since the CAN protocol does not encrypt the message, it is easy to falsify or modulate the message, and there is a problem that it is difficult to prevent an attack of retransmission after eavesdropping.

In order to solve the problem of weak communication security, the security authentication procedure for the electronic control device may be performed before providing the communication channel.

The existing security authentication procedure includes a process in which a plurality of electronic control devices set a mask algorithm for security authentication between a plurality of electronic control devices to transmit a seed value to an electronic control device requesting communication, Receiving a key value corresponding to a seed value and determining whether a key value corresponding to a seed value is valid according to a mask algorithm.

However, there is a problem that it is possible to derive a mask algorithm through a process of tracking back a plurality of key values for a plurality of random seed values. Therefore, there is a need to provide a security authentication method capable of preventing hacking to the mask algorithm.

The present invention is intended to provide a communication system capable of preventing hacking to a mask algorithm and improving security, and a communication security method therefor.

The objects of the present invention are not limited to the above-mentioned objects, and other objects and advantages of the present invention which are not mentioned can be understood by the following description and more clearly understood by the embodiments of the present invention. It will also be readily apparent that the objects and advantages of the invention may be realized and attained by means of the instrumentalities and combinations particularly pointed out in the appended claims.

One example of the present invention is a communication system for providing communication between a plurality of unit units, wherein each unit unit is connected to a bus unit for communication, a communication unit for communication security And an authentication information providing unit that holds a plurality of different authentication information and provides any one of the authentication information according to a request of the communication scheduling unit.

Wherein each of the plurality of pieces of authentication information includes a mask algorithm for calculating a key value corresponding to an arbitrary seed value, a setting period allocated to data transmission / reception between the unit units during each unit connection period and the authentication process, And a communication channel frequency allocated to communication between unit units. At least one of the mask algorithm, the setting period, and the communication channel frequency is different from each other in two different pieces of authentication information among the plurality of pieces of authentication information.

Wherein the communication scheduling unit comprises: an authentication procedure processing unit for selecting any one of the plurality of authentication information for processing the authentication; and an authentication processing unit for selecting any one of the plurality of authentication information in response to the authentication request message received from the request- A key value verifying unit for verifying validity of the key value received from the requesting side unit based on the mask algorithm of the selected authentication information and the seed value, And a verification unit for verifying whether or not a predetermined security authentication period is established based on a setting period and a reception time point of the key value. Here, the security authentication period includes a remaining period after the data transmission / reception is performed during the setup period.

Wherein the authentication procedure processor transmits an authentication success message to the requesting unit, and transmits the communication channel frequency of the selected authentication information to the communication unit based on whether the key value is valid or not, The frequency of the communication unit for communication between the unit units is changed to the communication channel frequency of the selected authentication information and the communication unit performs communication at the changed frequency during the next unit connection period.

The authentication procedure processor selects any one of the plurality of authentication information when the authentication request message is transmitted to the response unit unit, which is any one of the plurality of unit units, through the communication unit. In this case, the communication scheduling unit further includes a key value generation unit for generating a key value corresponding to the seed value of the response unit unit based on the selected authentication information, upon receipt of an arbitrary seed value from the response unit unit.

When the authentication request message is transmitted to the response unit unit through the communication unit or when the authentication request message is received from the request-side unit unit, the authentication procedure processor transmits or receives the authentication request message among the plurality of authentication information items Which is different from the previous authentication information used in the previous authentication information.

In another example of the present invention, the response-side unit unit authenticates the request-side unit unit for communication security between a request-side unit unit requesting communication among a plurality of unit units and a response-side unit unit accepting communication The method comprising: receiving an authentication request message from the requesting unit unit; selecting one of a plurality of different authentication information to process the authentication for the communication security; And transmitting the generated seed value to the requesting unit, receiving a key value corresponding to the seed value from the requesting unit, receiving the seed value and the selected authentication information, Verifying whether or not the key value is valid based on the mask algorithm of the selected authentication information, Transmitting the authentication success message to the requesting side unit unit based on whether the key value is valid or not and whether or not the security authentication period is performed And changing a frequency for communication between the unit units based on the selected authentication information.

In the step of verifying whether or not the security authentication period is performed, the predetermined security authentication period is a remaining period after a period in which data transmission and reception is performed during the setting period of the selected authentication information.

In the step of selecting any one of the plurality of pieces of authentication information, any one piece of authentication information that is different from the previous authentication information used for receiving the authentication request message and corresponding to the predetermined sequence number among the plurality of pieces of authentication information is selected.

Side unit unit transmits the authentication request message to the response-side unit unit, and before the step of receiving the authentication request message from the request-side unit unit, the request-side unit unit uses the authentication request message And selects any one of authentication information that is different from the previous authentication information and corresponds to the predetermined sequence number.

After transmitting the authentication success message to the requesting unit, the requesting unit transmits the authentication success message and changes the frequency for communication between the unit units based on the selected authentication information.

The security authentication method further includes performing the authentication process again if any one of the case where the key value is not valid and the case where the security authentication period is exceeded occurs.

A communication system and a security authentication method according to an embodiment of the present invention may use a plurality of different authentication information to change a mask algorithm based on an authentication request message, Change the frequency. That is, by changing the mask algorithm and the frequency for each unit connection period, the hacking to the mask algorithm and the hacking to the transmission / reception data become more difficult, so that the security can be improved.

Further, the authentication acceptance message is delivered according to whether the key value corresponding to the seed value is valid and received within the predetermined security authentication period. That is, if a valid key value is not received within the security authentication period, the authentication procedure is retried. In this manner, hindering the collection of the seed value and the key value makes it difficult to hack the regularity between the seed value and the key value, so that the hacking to the mask algorithm can be more firmly protected.

1 is a diagram illustrating a communication system according to an embodiment of the present invention.
Fig. 2 is a view showing the unit unit of Fig. 1. Fig.
3 is a diagram illustrating an authentication information providing unit and a communication scheduling unit of FIG.
4 is a diagram illustrating a security authentication method of a communication system according to an embodiment of the present invention.
5 is a diagram illustrating an arbitrary unit connection period in the security authentication method of FIG.
FIG. 6 is a diagram showing a period during which the authentication process is retried in the security authentication method of FIG. 4;

Hereinafter, a communication system and a security authentication method according to each embodiment of the present invention will be described in detail with reference to the accompanying drawings.

First, a communication system according to an embodiment of the present invention will be described with reference to FIGS. 1 to 3. FIG.

1 is a diagram illustrating a communication system according to an embodiment of the present invention. Fig. 2 is a view showing the unit unit of Fig. 1. Fig. 3 is a diagram showing the authentication information providing unit and the communication scheduling unit of FIG.

As shown in Fig. 1, the communication system 10 includes a plurality of unit units 11 and a bus unit 12 for providing communication paths between them.

The bus unit 12 provides a path for data transmission / reception between the unit units 11. For example, when the communication system 10 is provided in the vehicle, the data transmission / reception using the bus unit 12 can be selected from among CAN (Controller Area Network), LIN (Local Interconnect Network), FlexRay and MOST (Media Oriented Systems Transport) Lt; / RTI > communication protocol.

2, each unit unit 11 includes a communication unit 111 connected to the bus unit 12, a communication scheduling unit 12 for performing authentication for communication security, and a plurality of different authentication information And an authentication information providing unit 13 that holds the authentication information.

Although not shown in detail in FIG. 2, each unit unit 11 may further include calculation means and memory means for implementing various functions.

The plurality of unit units 11 may be an electronic control unit (ECU) for implementing various functions for improving convenience and safety of the driver provided in the vehicle.

The communication unit 111 is connected to the bus unit 12 for communication with another unit unit 11 or an external device (not shown).

The communication unit 111 communicates with another unit unit 11 or an external device via the bus unit 12 by using the frequency designated by the communication scheduling unit 112. [

The communication scheduling unit 112 performs authentication for communication security based on the message received through the communication unit 111. [ That is, when the communication scheduling unit 112 receives the authentication request message through the communication unit 111, the communication scheduling unit 112 performs an authentication process corresponding to the authentication request message. The communication scheduling unit 112 may transmit an authentication request message for requesting communication with another unit unit 11 to the communication unit 111.

The authentication information providing unit 113 includes a plurality of different authentication information and provides any one of the authentication information at the request of the communication scheduling unit 112. [

3, each of the plurality of pieces of authentication information AD1, AD2, and AD3 stored in the authentication information providing unit 113 includes masking algorithms MA1, MA2, and MA3 for calculating key values corresponding to arbitrary seed values, (SPP1, SPP2, SPP3; Set Point Period) allocated to data transmission and reception and authentication processing between the unit units 11 during each unit connection period and communication between the unit units 11 during each unit connection period (CF1, CF2, CF3; Channel Frequency) assigned to the mobile station.

At least two of the mask algorithm, the setting period, and the communication channel frequency are different from each other in any two of the plurality of different pieces of authentication information.

The Unit Connection Period (UCP in FIG. 5) refers to a period during which the frequency used for communication is maintained. Each of the unit connection periods UCP includes a frequency changing period (CFP (Changing Frequency Period) in FIG. 5) for changing the communication frequency to the communication channel frequency of the authentication information selected during the security authentication period of the previous unit connection period, (SPP) for communicating with the base station. Since the frequency change period (SFP) is started based on the authentication success message, each unit connection period (UCP) can be classified based on the authentication success message.

5) and a security authentication period (SAP: Security Authority Period for security authentication processing) for the data transmission and reception for data transmission and reception between the unit units 11, .

When the communication scheduling unit 112 transmits or receives an authentication request message, the communication scheduling unit 112 performs authentication processing for security.

That is, when the communication scheduling unit 112 receives an authentication request message from a requesting unit unit requesting communication, the communication scheduling unit 112 can perform an authentication procedure for communication security.

Alternatively, the communication scheduling unit 112 may perform an authentication procedure for communication security by transmitting an authentication request message for requesting communication to a response-side unit unit that is any one of the plurality of unit units 11 and is set as a communication target .

Specifically, the communication scheduling unit 112 includes an authentication procedure processing unit 201 for selecting one of a plurality of pieces of authentication information AD1, AD2 and AD3 for processing authentication, A key value verifying unit 203 for verifying the validity of the key value received from the request side unit based on the mask algorithm and the seed value of the selected authentication information, A verification unit 204 for verifying whether or not a predetermined security authentication period has passed based on the setting period of the selected authentication information and a received key value and a key value corresponding to an arbitrary seed value received from the response side unit And a key value generator 205 for generating a key value.

The authentication procedure processing unit 201 selects any one of the plurality of pieces of authentication information AD1, AD2, and AD3 when receiving the authentication request message from the requesting unit unit or transmitting the authentication request message to the response unit unit.

At this time, the authentication procedure processing unit 201 generates authentication information corresponding to the predetermined order, which is different from the previous authentication information used at the time of transmitting or receiving the authentication request message among the plurality of pieces of authentication information AD1, AD2, and AD3 Select. That is, the authentication procedure processing unit 201 selects authentication information different from the previous authentication information selected in the previous unit connection period according to the predetermined order.

In addition, upon receiving the authentication request message from the requesting unit unit, the authentication procedure processing unit 201 requests the seed value generator 202 for the seed value.

The seed value generation unit 202 generates an arbitrary seed value corresponding to the authentication request message of the requesting unit unit and transmits the generated seed value to the authentication procedure processing unit 201 and the key value verification unit 203 .

The authentication procedure processing unit 201 transfers an arbitrary seed value by the seed value generation unit 202 to the request side unit.

Subsequently, upon receiving the key value from the request side unit, the authentication procedure processing unit 201 requests the key value verification unit 203 to verify the key value, and requests the periodicity verification unit 204 to check whether or not the security authentication period is in effect .

The key value verifier 203 verifies whether the key value is valid based on the mask algorithm MA of the authentication information AD selected by the authentication procedure processing unit 201 and the seed value transmitted to the request side unit.

Then, the periodicity verification unit 204 verifies whether or not a predetermined security authentication period (SAP) is established based on the setting period of the selected authentication information and the reception time point of the key value.

Here, the security authentication period (SAP in Fig. 5) is made up of the remaining period after the period (DEP in Fig. 5) during which data transmission and reception is performed in the set period SPP of the selected authentication information. Accordingly, the security authentication period (SAP) corresponds to the setting period (SPP) and the data transmission / reception period (DEP) of the selected authentication information.

If the reception time of the key value is included within the security authentication period (SAP), the periodicity verification unit 204 verifies that the security authentication period (SAP) has not been exceeded. On the other hand, if the reception time of the key value is found after the end of the security authentication period (SAP), the periodicity verification unit 204 verifies that the security authentication period (SAP) has passed.

The authentication procedure processing unit 201 sends an authentication success message to the requesting side unit unit based on whether the key value is validated by the key value verifying unit 203 and whether or not the period of the security authentication period (SAP) . That is, when the key value received from the request side unit unit is valid and the reception time of the key value is included within the security authentication period (SAP), the authentication procedure processing unit 201 transmits an authentication success message to the request side unit unit.

At this time, the authentication procedure processing unit 201 transmits the communication channel frequency of the selected authentication information to the communication unit 111. Thereby, the frequency of the communication unit 111 for communication between the unit units 11 is changed to the communication channel frequency of the authentication information selected by the authentication procedure processing unit 201. During the next unit connection period, the communication unit 111 performs communication at the changed frequency.

In addition, when any one of the case where the key value is not valid and the time when the key value is received exceeds the security authentication period (SAP) occurs, the authentication procedure processing unit 201 can retry the authentication process. Then, even when a communication error is detected during the data transmission / reception period (DEP in FIG. 5), the authentication procedure processing unit 201 can retry the authentication process.

For example, the authentication procedure processing unit 201 can perform authentication processing again by transmitting an authentication failure message to the requesting unit unit or receiving an authentication failure message from the response unit unit.

At this time, when the authentication procedure processing unit 201 of the response side unit transmits the authentication failure message, it can generate an arbitrary seed value and transmit it to the request side unit unit.

Alternatively, the authentication procedure processing unit 201 of the response-side unit unit may select another authentication information before generating the seed value again. In this case, based on the newly selected authentication information, whether or not the key value is valid, Can be verified. Upon receiving the authentication failure message, the authentication procedure processing unit 201 of the requesting unit unit can newly select another authentication information, and generate a key value corresponding to the seed value based on the newly selected authentication information.

Next, a security authentication method according to an embodiment of the present invention will be described with reference to FIGS. 4, 5, and 6. FIG.

4 is a diagram illustrating a security authentication method of a communication system according to an embodiment of the present invention. 5 is a diagram illustrating an arbitrary unit connection period in the security authentication method of FIG. FIG. 6 is a diagram showing a period during which the authentication process is retried in the security authentication method of FIG. 4;

4 is a diagram illustrating a communication system 11 according to an exemplary embodiment of the present invention for performing security authentication for communication between a request side unit unit (Request_ECU) 11q and a response side unit unit (Response_ECU) 11p among a plurality of unit units 11 Quot; is treated.

Here, the plurality of unit units 11 share a plurality of different authentication information and their selection order numbers.

Each of the authentication information includes a masking algorithm for calculating a key value corresponding to an arbitrary seed value, a setting period (SPP in FIG. 5) allocated to data transmission / reception and authentication processing between unit units 11 during each unit connection period, And the communication channel frequency allocated to the communication between the unit units 11 during the period.

At least two of the mask algorithm, the authentication period, and the communication channel frequency are different from each other in any two of the plurality of authentication information.

4, the security authentication method using the response-side unit unit 11p includes a step S11 of receiving an authentication request message from the request-side unit unit 11q, a step (S21) generating an arbitrary seed value corresponding to the authentication request message (S22), and transmitting the generated seed value to the requesting side unit unit 11q (S23 A step S14 of receiving a key value corresponding to the seed value from the request side unit unit 11q, a step S24 of verifying whether or not the key value is valid based on the selected authentication information and the seed value, (S25 in FIG. 5) based on the time of receipt of the authentication key (S25 in FIG. 5) based on the received time of the key value, whether or not the key value is valid, (Step S26) and transmitting the selected authentication And changing a frequency for communication based on the information (S27).

The request side unit unit 11q transmits an authentication request message to the response unit unit 11p selected as the communication target. (S11)

Then, the requesting side unit unit 11q selects any one of the plurality of pieces of authentication information, which is different from the previous authentication information used for transferring the authentication request message and corresponds to the predetermined sequence number. (S12)

When the response-side unit unit 11p receives the authentication request message of the request-side unit unit 11q (S11), the response-side unit unit 11p responds to a predetermined sequence number different from the previous authentication information used for reception of the authentication request message among the plurality of authentication information And selects one of the pieces of authentication information. (S21) At this time, since the response side unit unit 11p and the request side unit unit 11q share a plurality of pieces of authentication information and their predetermined selection order, they can select the same authentication information.

At this time, the authentication information selected by the request side unit unit 11q and the response side unit unit 11p in response to the authentication request message may include a communication channel frequency different from the previous authentication information used for transmission / reception of the authentication request message have.

In this way, the frequency for communication between the unit units 11 can be changed based on the authentication success message corresponding to the boundary between unit connection periods (UCPs). That is, the frequency used for communication during each unit connection period (UCP) may be changed to be different from the frequency used in the previous unit connection period. As a result, even if the mask algorithm is hacked, it becomes difficult to hack the transmission / reception data due to the changed frequency, so that the hacking on the transmission / reception data can be more firmly protected.

The authentication information selected by the request side unit unit 11q and the response side unit unit llp in response to the authentication request message may include a masking algorithm different from the previous authentication information used for sending and receiving the authentication request message .

In this manner, the mask algorithm for verifying the key value can be changed based on the authentication request message for starting the authentication process. That is, the mask algorithm used in each unit connection period (UCP) can be changed differently from the mask algorithm used in the previous unit connection period. This makes it difficult to hack the mask algorithm due to the mask algorithm which is changed for each unit connection period (UCP), so that the hacking to the mask algorithm can be more firmly protected.

Next, the response-side unit unit 11p generates an arbitrary seed value corresponding to the received authentication request message (S22), and transmits the generated seed value to the request-side unit unit 11q. (S23)

Upon receiving the seed value from the response-side unit unit 11p, the request-side unit unit 11q generates a key value corresponding to the seed value based on the mask algorithm of the selected authentication information S12. (S13) Then, the request side unit unit 11q delivers the key value corresponding to the seed value to the response side unit unit lOp. (S14)

Upon receiving the key value from the requesting side unit unit 11q (S14), the response unit unit 11p verifies whether or not the received key value is valid, and verifies whether or not the authentication period is in progress. (S24, S25)

That is, the response-side unit unit 11p verifies the validity of the key value based on the seed value transmitted to the request-side unit unit 11q and the mask algorithm of the selected authentication information. (S24) As an example, if the value calculated by substituting the seed value in the mask algorithm of the selected authentication information S21 is different from the key value received from the response-side unit unit 11p, it can be determined that the key value is invalid.

If the key value is not valid, the response side unit unit 11p retries the authentication process. (S29)

Then, the response-side unit unit 11p verifies whether or not a predetermined security authentication period (SAP) is established based on the setting period (SPP) of the selected authentication information (S21) and the reception time of the key value. (S25)

That is, as shown in Fig. 5, each unit connection period (UCP) is a period in which the frequency used for communication remains the same. Here, since the frequency used for communication between the unit units 11 is changed at the time of transmitting and receiving the authentication success message, the boundary between unit connection periods (UCP) corresponds to the authentication success message.

The unit connection period (UCP) includes a frequency change period (CFP) and a set period (SPP). Here, the setting period SPP is specified by each authentication information.

The setting period SPP includes a data transmission / reception period DEP and a security authentication period SAP. In the data transmission / reception period DEP, data transmission / reception is performed between the unit units 11 using the frequency changed during the frequency change period (CEP). In the security authentication period (SAP), authentication processing for communication security is performed.

Here, the security authentication period SAP may be defined as a remaining period except for the data transmission / reception period DEP in the setup period SPP. Accordingly, the security authentication period (SAP) corresponds to the setup period (SPP) and the data transmission / reception period (DEP).

The response-side unit unit 11p recognizes the key value corresponding to the authentication process only when the key value corresponding to the seed value is received within the security authentication period SAP.

That is, if the reception time of the key value is included within the security authentication period (SAP), the key value can be judged to be reasonable as not having passed the security authentication period (SAP).

On the other hand, if the reception time of the key value is after the end of the security authentication period (SAP), the key value may be judged to be unfit for the authentication process as it has passed the security authentication period (SAP). In this case, the response side unit unit 11p retries the authentication processing. (S29)

As described above, when the key value received from the request-side unit unit 11q does not correspond to the mask algorithm and the seed value of the selected authentication information and is invalid, or when the key value is received at the security authentication period (SAP) If one occurs, the response side unit unit 11p retries the authentication processing. (S29)

In this manner, indiscriminate collection of the seed value and the key value can be prevented, so that the hacking to the mask algorithm can be more firmly protected.

If the key value received from the request side unit unit 11q is valid as corresponding to the mask algorithm and the seed value of the selected authentication information and the reception time of the key value does not exceed the security authentication period SAP, The unit 11p transmits an authentication success message to the requesting side unit unit 11q. (S26)

In addition, even if the security authentication period (SAP) remains, since the frequency should be changed when the authentication success message is transmitted and received, the corresponding unit connection period (UCP) ends according to the transmission / reception of the authentication success message, ').

Then, the communication unit 111 of the response unit unit 11p transmits the frequency used for communication between the unit units during the frequency change period (CFP) of the next unit connection period UCP 'to the communication channel frequency of the selected authentication information S21 . (S27)

When the request side unit unit 11q receives the authentication success message (S26), the communication unit 111 of the request side unit unit 11q interrupts the unit connection unit during the frequency change period (CFP) of the next unit connection period UCP ' And changes the frequency used for communication to the communication channel frequency of the selected authentication information S21. (S15)

At this time, the plurality of unit units 11 can set the frequency change period (CFP) to be the same as a specific value.

After completing the authentication process, the request side unit unit 11q and the response side unit unit 11p process data transmission / reception using the changed frequency during the data transmission / reception period DEP '. (S30)

In addition, in the data transmission / reception period DEP, when the request side unit unit 11q or the response side unit unit 11p detects a communication error (S28), the authentication process can be retried. (S29)

Although not shown in detail in FIG. 4, step S29 of retrying the authentication process includes transmitting an authentication failure message, allocating a re-response window period (Re-Response Window Period (RRWP) in FIG. 6) Generating the seed value, transmitting the seed value, receiving the key value, verifying whether the key value is valid, and verifying whether or not the re-response window period is valid.

In addition, the step of retrying the authentication procedure (S29) may further include a step of receiving the authentication request message again and again selecting the authentication information before the step of regenerating any seed value. In this manner, the mask algorithm is changed due to the changed authentication information in the process of retrying the authentication process, so that it is possible to more firmly protect against hacking.

For example, as shown in FIG. 6, when the reception time of the key value exceeds the security authentication period (SAP), the authentication process can be retried. (S29)

At this time, the response-side unit unit 11p delivers the authentication failure message and allocates the re-response window period RRWP. The re-response window period RRWP is for verifying whether the key value to be received is worth again. The re-response window period RRWP may be set to a predetermined period, or may be set to the same period as the security authentication period (SAP).

Upon receiving the key value corresponding to the newly generated seed value, the response-side unit unit 11p verifies whether the key value is valid and whether or not the key value is received at the re-response window period RRWP. If the authentication success message is transmitted and received even before the predetermined re-response window period RRWP is terminated, the next unit connection period UCP 'is started.

As described above, in the communication system and its security authentication method according to an embodiment of the present invention, the mask algorithm is changed based on the authentication request message using a plurality of pieces of authentication information, and communication between unit units is performed based on the authentication success message To change the frequency. As described above, the mask algorithm changed for each unit unit period makes it possible to more firmly prevent hacking of the mask algorithm. Even if the mask algorithm is hacked, the transmission / reception data can be protected from hacking due to the frequency that is changed for each unit unit period.

In addition, since it is possible to further verify whether or not the key value is appropriate for the receiving time point by using the predetermined security authentication period corresponding to the setting period of the authentication information, it is possible to prevent the unintentional key value collection.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit or scope of the invention. Will be clear to those who have knowledge of.

10: Communication system
11: unit unit
12: Bus unit
11q: request side unit
11p: response side unit

Claims (12)

A communication system for providing communication between a plurality of unit units,
Each of the unit units
A communication unit connected to the bus unit for communication;
A communication scheduling unit for performing authentication for security of the communication based on a message received from the communication unit; And
And an authentication information providing unit which holds a plurality of different authentication information and provides any one of the authentication information according to a request of the communication scheduling unit,
Wherein each of the plurality of authentication information includes a mask algorithm for calculating a key value corresponding to an arbitrary seed value, a setting period allocated to data transmission / reception between the unit units and processing of the authentication during each unit connection period, And a communication channel frequency allocated to communication between the unit units,
Wherein the communication scheduler selects any one of the plurality of authentication information, communicates a communication channel frequency of the selected authentication information to the communication unit,
Wherein the communication unit changes a frequency for communication between the unit units based on a communication channel frequency transmitted from the communication scheduling unit.
delete The method according to claim 1,
The communication scheduling unit
An authentication procedure processor for selecting any one of the plurality of authentication information to process the authentication;
A seed value generation unit for generating an arbitrary seed value corresponding to an authentication request message received from a requesting unit unit requesting the communication among the plurality of unit units;
A key value verifying unit for verifying whether the key value received from the requesting unit is valid based on the mask algorithm of the selected authentication information and the seed value; And
And a verification unit for verifying whether or not a predetermined security authentication period is established based on a setting period of the selected authentication information and a reception time of the key value,
Wherein the security authentication period comprises a remaining period after data transmission / reception is performed between the unit units during the setting period.
The method of claim 3,
The authentication procedure processing unit
Transmits an authentication success message to the requesting side unit unit based on whether the key value is valid and whether or not the security authentication period is performed,
Transmits the communication channel frequency of the selected authentication information to the communication unit,
Wherein the frequency of the communication unit for communication between the unit units is changed to the communication channel frequency transmitted from the authentication procedure processing unit and the communication unit performs communication at the changed frequency during the next unit connection period.
The method of claim 3,
Wherein when the authentication request message is transmitted to the response unit unit, which is any one of the plurality of unit units, through the communication unit, the authentication procedure processor selects any one of the plurality of authentication information,
The communication scheduling unit
And a key value generation unit that generates a key value corresponding to the seed value of the response unit unit based on the selected authentication information when receiving an arbitrary seed value from the response unit unit.
6. The method of claim 5,
When the authentication request message is transmitted to the response unit unit through the communication unit or when the authentication request message is received from the request-side unit unit, the authentication procedure processor transmits or receives the authentication request message among the plurality of authentication information items And selects any one of authentication information corresponding to a predetermined sequence number that is different from the previous authentication information used in the authentication process.
Side unit unit authenticates the request-side unit unit using a plurality of different authentication information for communication security between a request-side unit unit requesting communication and a response-side unit unit accepting communication among a plurality of unit units In the method,
Wherein each of the plurality of authentication information includes a mask algorithm for calculating a key value corresponding to an arbitrary seed value, a setting period allocated to data transmission / reception between the unit units and processing of the authentication during each unit connection period, And a communication channel frequency allocated to communication between the unit units,
Receiving an authentication request message from the requesting unit;
Selecting one of the plurality of authentication information to process the authentication for the communication security;
Generating an arbitrary seed value corresponding to the authentication request message;
Transmitting the generated seed value to the requesting unit unit;
Receiving a key value corresponding to the seed value from the requesting unit unit;
Verifying whether the key value is valid based on the seed value and the mask algorithm of the selected authentication information;
Verifying whether or not a predetermined security authentication period is based on the setting period of the selected authentication information and the reception time of the key value;
Transmitting an authentication success message to the requesting unit unit based on whether or not the key value is valid and whether or not the security authentication period is performed; And
And changing a frequency for communication between the unit units based on the communication channel frequency of the selected authentication information.
8. The method of claim 7,
Wherein the predetermined security authentication period is a remaining period after a period in which the data transmission and reception is performed during the setting period of the selected authentication information in the step of verifying whether or not the security authentication period is performed.
8. The method of claim 7,
Wherein the selecting of one of the plurality of pieces of authentication information comprises the step of selecting one of the pieces of authentication information corresponding to a predetermined order different from the previous authentication information used for receiving the authentication request message among the plurality of pieces of authentication information Authentication method.
10. The method of claim 9,
Before receiving the authentication request message from the requesting unit unit,
Wherein the request-side unit unit transmits the authentication request message to the response-side unit unit, and transmits the authentication request message to the response-side unit unit, which is different from the previous authentication information used in the transmission of the authentication request message among the plurality of authentication information, Of the authentication information.
11. The method of claim 10,
After transmitting the authentication success message to the requesting unit,
Wherein the requesting unit transmits the authentication success message to change the frequency for communication between the unit units based on the selected authentication information.
8. The method of claim 7,
Further comprising the step of performing the authentication process again if any one of the case where the key value is not valid and the case where the security authentication period is exceeded occurs.

Images