Encryption key distribution system, key distribution ECU and key reception ECU

An encryption key distribution system includes: a key distribution ECU that transmits an encryption key; and a key reception ECU that receives the encryption key, the key distribution ECU: transmits the encryption key to the key reception ECU; and determines completion of transmission of the encryption key, based on a result of determination as to whether first verification data transmitted from the key reception ECU matches second verification data of the encryption key which is calculated from a common key stored in the key distribution ECU and an identifier of the key reception ECU, the key reception ECU: records the received encryption key in the key reception ECU; calculates the first verification data from the same common key as the common key stored in the key reception ECU and the identifier of the key reception ECU; and transmits the calculated first verification data to the key distribution ECU.

FIELD

The embodiments discussed herein are related to an encryption key distribution system, a key distribution ECU, a key reception ECU, a key distribution program, a key reception program, and an encryption key distribution method.

BACKGROUND

A secure data transfer are performed between a plurality of electronic control units (ECUs) that are mounted in an automobile or the like, and are connected via a controller area network (CAN).

Japanese Laid-open Patent Publication No. 2013-098719 and Sugashima, Oka, and Vuillaume, “Approaches for Secure and Efficient In-Vehicle Key Management”, Transactions of the Institute of Electronics, Information and Communication Engineers 2016 are disclosed as related art.

SUMMARY

According to an aspect of the embodiments, an encryption key distribution system includes: a key distribution electronic control unit (ECU) that transmits an encryption key; and a key reception electronic control unit (ECU) that receives the encryption key, the key distribution ECU is configured to: transmit the encryption key to the key reception ECU; and determine completion of transmission of the encryption key to the key reception ECU, based on a result of determination as to whether first verification data which is transmitted from the key reception ECU matches second verification data of the encryption key, the second verification data of the encryption key being calculated from a common key which is stored in the key distribution ECU and an identifier of the key reception ECU, the key reception ECU is configured to: record the received encryption key in the key reception ECU; calculate the first verification data of the received encryption key from the same common key as the common key stored in the key reception ECU and the identifier of the key reception ECU; and transmit the calculated first verification data to the key distribution ECU.

DESCRIPTION OF EMBODIMENTS

For example, a transmission-side ECU transmits a message authentication code (MAC) generated from a message data field, a message ID, and a count value indicating the number of times a message has been transmitted.

For example, an encryption key is shared between ECUs. In a case where an encryption key is updated, a master ECU that distributes encryption keys transmits an UID that is the identifier (ID) of the target ECU of the key update, and M1that is a message indicating a key slot. The master ECU further transmits a replay prevention counter, various flags, M2that is a message formed by encrypting a new encryption key, and M3that is an MAC calculated for M1and M2.

In this case, upon receipt of M1, M2, and M3, the target ECU that receives encryption keys first verifies the MAC of M1and M2, using M3. In a case where the result of the MAC verification is acceptable, the target ECU decrypts the encryption key, and stores the decrypted key into the encryption key slot. The target ECU also generates M4that is a message formed with the UID of the target ECU, the encryption key slot, and the encrypted replay prevention counter, and transmits the M4, together with M5as an MAC of the M4, to the master ECU. The master ECU performs MAC verification on the received M4, using the received M5.

However, the information indicating receipt of an encryption key has a large data size, and therefore, the communication volume to be used for key update might become larger. For example, M4transmitted from a target ECU to the master ECU is 32 bytes, and M5is 16 bytes, both of which are larger than 8 bytes, which is the size that can be transmitted by one CAN packet.

An encryption key distribution system, a key distribution ECU, a key reception ECU, a key distribution program, a key reception program, and an encryption key distribution method capable of reducing the amount of data to be used for key update may be provided.

The following is a detailed description of embodiments of an encryption key distribution system, a key distribution ECU, a key reception ECU, a key distribution program, a key reception program, and an encryption key distribution method disclosed in the present application, with reference to the drawings. Note that the present invention is not limited by these embodiments. The embodiments described below may also be combined as appropriate, without departing from the scope of the invention.

First Embodiment

First, an example of an encryption key distribution system according to this embodiment is described with reference toFIG. 1.FIG. 1is a diagram illustrating an example of an encryption key distribution system according to a first embodiment. As illustrated inFIG. 1, an encryption key distribution system1according to this embodiment includes a master ECU100, a target ECU200a,a target ECU200b,and a target ECU200c.In the description below, the target ECU200a,the target ECU200b,and the target ECU200cmay be described as “target ECUs200” unless distinguished from one another. The master ECU100and the target ECUs200are communicably connected to one another by a network N such as a CAN, for example.

The master ECU100in this embodiment is a device that distributes an encryption key to each target ECU. The master ECU100may be formed with a computer including a processor and a memory, for example. The master ECU100is an example of a key distribution ECU.

Each target ECU200in this embodiment is a device that receives an encryption key distributed by the master ECU100. Like the master ECU100, each target ECU200may also be formed with a computer including a processor and a memory, for example. As illustrated inFIG. 1, each target ECU200includes a communication unit210, a storage unit220, and a control unit230. Each target ECU200is an example of a key reception ECU. Further, in the description below, in a case where each of the functional blocks of the respective target ECUs200is distinguished from a corresponding functional block of other target ECUs200, the functional blocks may be described as “the storage unit220a”, “the storage unit220c”, and the like, for example.

Encryption Key Distribution Process

Next, a process of distributing master keys in the encryption key distribution system1is described with reference toFIGS. 2A through 2F.FIGS. 2A through 2Fare diagrams illustrating an example of an encryption key distribution process according to the first embodiment. As illustrated inFIG. 2A, the master ECU100(MASTER ECU) is communicably connected to the target ECU200a(ECU A), the target ECU200b(ECU B), and the target ECU200c(ECU C) through the network N. A master key is an example of an encryption key.

Each target ECU200is assigned a UID that is an identifier (ID) for uniquely identifying the target ECU200. For example, as illustrated inFIG. 2A, the UID of the target ECU200ais “UID_A”, and the UID of the target ECU200cis “UID_C”. The UIDs are stored in the storage units220aand220cof the respective target ECUs200, for example. Each UID is an example of the identifier of the key reception ECU.

Further, each target ECU200stores a master key distributed from the master ECU100in a predetermined key slot. Furthermore, in this embodiment, the master ECU100and the target ECUs200each store a replay counter value that is information for detecting a retransmission attack.

First, as illustrated inFIG. 2A, out of the target ECUs200, the target ECU200aand the target ECU200cboth transmit a master key update request to the master ECU100(1. Master key update request). Note that the target ECU200bdoes not transmit any master key update request, as illustrated inFIG. 2A. In this case, the target ECUs200that transmit the master key update request and the master ECU100share beforehand a temporary master key to be used for distribution of a new master key. The temporary master key is an example of a common key.

Upon receipt of the master key update request, the master ECU100identifies the target ECU200aand the target ECU200c,which are the target ECUs200that have transmitted the master key update request. The master ECU100then generates a new master key for each of the target ECU200aand the target ECU200c(2. Generation of new master keys). The master ECU100sequentially stores generated messages and the like into an ECU list storage unit121.

The master ECU100then generates a message M1, using the UIDs of the target ECUs200that have transmitted the master key update request, and the key slots of the respective target ECUs200. The master ECU100also generates a message M2, using the replay counter values, various flags to be used for other master key distribution processes, and the new master keys encrypted with the temporary master key (3. M1and M2generation). The message M1is generated with the pieces of information marked with “★” inFIG. 2A, for example. The message M2is generated with the pieces of information marked with “●” inFIG. 2A, for example.

Referring now toFIG. 2B, the master ECU100generates an MAC of data M1+M2generated by combining the message M1and the message M2(4. Generation of MAC (M3) of M1+M2). The master ECU100generates an MAC, using MASTER_ECU_KEY, which is the temporary master key stored in advance. The master ECU100then transmits the generated messages M1and M2and the generated MAC M3(MAC_A) to the target ECU200a(5. M1, M2, and M3transmission). Although the process between the master ECU100and the target ECU200awill be described below, the same process is to be performed between the master ECU100and the target ECU200c.

Referring now toFIG. 2C, the master ECU100generates M4corresponding to the target ECU200a,using the UID “UID_A”, “key slot A”, and “counter value A” of the target ECU200a,which are stored in the target ECU200a.The master ECU100then generate M5(MAC_A), which is an MAC of the generated M4, using MASTER_ECU_KEY (6. Generation of MAC (M5) of M4).

For all the target ECUs200that have transmitted the master key update request, the master ECU100generates M5in the same manner, and stores all the generated M5into a comparison candidate table storage unit122(7. Generation of comparison candidate table).

Next, a master key reception process to be performed by a target ECU200is described. Although a process in the target ECU200awill be described below, the same process is to be performed by the target ECU200c. The target ECU200bthat has not transmitted the master key update request does not receive any master key, and therefore, does not perform the same process.

First, upon receipt of M1, M2and M3from the master ECU100, the target ECU200averifies whether the counter value contained in M2is valid (8. Counter value verification). In a case where the target ECU200averifies that the counter value is valid, the target ECU200agenerates M3(MAC_A′), which is an MAC of the data M1+M2generated by combining the received M1and M2(9. Generation of MAC of M1+M2). Like the master ECU100, the target ECU200aalso generates the MAC, using the temporary master key MASTER_ECU_KEY stored in advance.

Referring now toFIG. 2D, the target ECU200averifies whether the M3(MAC_A) received from the master ECU100matches the generated M3(MAC_A′) (10. Verification of generated M3and received M3). Since M3(MAC_A) and M3(MAC_A′) are both generated with the same MASTER_ECU_KEY, the target ECU200averifies that the received M3is not valid in a case where the generated M3and the received M3do not match. In a case where the target ECU200averifies that M3is valid, the target ECU200adecrypts the received M2with the temporary master key, and stores the new master key into the key slot A (11. Master key storage (Decrypting M2with temporary master key)).

Referring now toFIG. 2E, the target ECU200agenerates a message M4, using “UID_A”, which is the UID of the target ECU200a,“key slot A”, which is the key slot, and the counter value A. The target ECU200athen generates M5(MAC_A′), which is an MAC of the generated M4, using MASTER_ECU_KEY (12. Generation of MAC (M5) of M4). The message M4is an example of an encryption key data set, and M5is an example of encryption key verification data.

The target ECU200athen transmits only M5to the master ECU100(13. M5transmission). In doing so, the target ECU200adoes not transmit M4.

Referring now toFIG. 2F, the master ECU100that has received M5stores the received M5(MAC_A′) into the ECU list storage unit121. At this stage, the master ECU100does not receive the message M4from the target ECU200a,and therefore, is unable to identify that the target ECU200that has transmitted M5corresponds to the target ECU200corresponding to which UID. The master ECU100then verifies whether M5(MAC_A′) received from the target ECU200matches any of the M5s stored in the comparison candidate table (14. Verification of generated M5and received M5). For example, the master ECU100compares the received M5with the M5s in the comparison candidate table stored in the comparison candidate table storage unit122in a brute-force manner.

Like M3(MAC_A) and M3(MAC_A′), the received M5(MAC_A′) and the M5s (MAC_A) in the comparison candidate table are generated with the use of MASTER_ECU_KEY, which is the master key stored in advance. For this reason, in a case where M5(MAC_A) that matches the received M5(MAC_A′) is not stored in the comparison candidate table, for example where the received M5does not match any M5in the comparison candidate table, the master ECU100verifies that the received M5is not valid.

In a case where the M5(MAC_A) that matches the received M5(MAC_A′) is stored in the comparison candidate table, for example where the master ECU100verifies that the received M5(MAC_A′) is valid, the master ECU100deletes the M5(MAC_A) from the comparison candidate table. As a result, the master ECU100confirms that the master key distribution process for the target ECU200ahas been properly completed (15. Deletion of verified M5from comparison candidate table). The master ECU100repeats the procedures 14 and 15 until verifying that the M5s received from all the target ECUs200that have transmitted the master key update request are valid. For example, in a case where all the M5s stored in the comparison candidate table are deleted, the master ECU100ends the process.

As described above, in the encryption key distribution system according to this embodiment, an ECU as a distribution destination of a CAN encryption key update transmits only verification data without transmitting the data set corresponding to the distributed encryption key, and the distribution source ECU compares the received verification data with the verification data stored in the distribution source ECU. Thus, communication volume is reduced.

Functional Blocks

Referring back toFIG. 1, the functional blocks of the respective devices are described. As illustrated inFIG. 1, the master ECU100includes a communication unit110, a storage unit120, and a control unit130. The communication unit110transmits data output from control unit130to the target ECUs200through the network N. The communication unit110also outputs data received from the target ECUs200through the network N, to the control unit130.

The storage unit120stores a program to be executed by the control unit130, for example, and various kinds of data such as the temporary master key. The storage unit120also includes the ECU list storage unit121, the comparison candidate table storage unit122, and a log storage unit123. The storage unit120is equivalent to a semiconductor memory element such as a random access memory (RAM), a read only memory (ROM), or a flash memory, or a storage device such as a hard disk drive (HDD).

The ECU list storage unit121stores information about each target ECU200, as illustrated inFIG. 2A. As illustrated inFIG. 2A, the ECU list storage unit121stores the UID of each target ECU200, information about the key slot, and the counter value, which are associated with one another. The ECU list storage unit121further stores M3and M5for each target ECU200, as illustrated inFIG. 2E. As illustrated inFIG. 2A, the ECU list storage unit121may store information about the target ECU200that has not transmitted the master key update request. The information stored in the ECU list storage unit121is registered beforehand by an acquisition unit131described later, and is sequentially updated by the acquisition unit131and a generation unit132described later.

As illustrated inFIG. 2E, the comparison candidate table storage unit122stores M5s that have been generated by the master ECU100and correspond to the respective target ECUs200that have transmitted the master key update request. Further, as illustrated inFIG. 2F, each M5stored in the comparison candidate table storage unit122is deleted when a verification unit134described later verifies that the received corresponding M5(MAC_A′) is valid. The information stored in the comparison candidate table storage unit122is registered by the generation unit132described later, and is sequentially deleted by the verification unit134.

The log storage unit123stores logs such as information about various kinds of events in the encryption key distribution process. For example, the log storage unit123stores the result of verification of validity of a received M5and the like. The information stored in the log storage unit123is registered by the verification unit134, for example. The log storage unit123is only roughly illustrated.

Referring back toFIG. 1, the control unit130is a processing unit that supervises the overall processes to be performed by the master ECU100, and is a processor, for example. The control unit130includes the acquisition unit131, the generation unit132, an encryption key output unit133, and the verification unit134. The acquisition unit131, the generation unit132, the encryption key output unit133, and the verification unit134are an example of electronic circuits included in the processor, and an example of processes to be executed by the processor.

The acquisition unit131receives a master key update request from a target ECU200through the communication unit110, and outputs an instruction to generate an encryption key to the generation unit132. The acquisition unit131also receives M5from the target ECU200through the communication unit110, and outputs an instruction to verify the received M5to the verification unit134.

When receiving an output of an encryption key generation instruction from the acquisition unit131, the generation unit132generates an encryption key. The generation unit132also generates a message M1, using the UID of the target ECU200and information about the key slot, which are stored beforehand in the ECU list storage unit121. The generation unit132encrypts the master key with the temporary master key, and generates a message M2, using the counter value, various flags, and the encrypted master key. The generation unit132generates M3, which is an MAC of data generated by combining the generated M1and M2. The generation unit132then outputs the generated M1, M2, and M3to the encryption key output unit133.

The generation unit132further generates M4relating to the target ECU200, using the UID of the target ECU200, the information about the key slot, and the counter value, which are stored beforehand in the ECU list storage unit121. The generation unit132then generates M5, which is an MAC of the generated M4, and stores the M5into the comparison candidate table storage unit122.

The encryption key output unit133transmits the M1, M2, and M3output from the generation unit132, to the target ECU200through the communication unit110.

Receiving an output of a verification instruction from the acquisition unit131, the verification unit134verifies whether the received M5matches any of the M5s stored in the comparison candidate table storage unit122. In a case where the received M5does not match any of the M5s stored in the comparison candidate table storage unit122, the verification unit134verifies that the received M5is not valid, and discards the received M5. In a case where the received M5matches one of the M5s stored in the comparison candidate table storage unit122, the verification unit134verifies that the received M5is valid, and deletes the M5matching the received M5from the comparison candidate table storage unit122. The verification unit134stores the result of the verification of the received M5, into the log storage unit123.

Meanwhile, as illustrated inFIG. 1, each target ECU200includes a communication unit210, a storage unit220, and a control unit230. The communication unit210transmits data output from control unit230to the master ECU100through the network N. The communication unit210also outputs data received from the master ECU100through the network N, to the control unit230.

The storage unit220stores a program to be executed by the control unit230, for example, and various kinds of data such as the temporary master key. The storage unit220also includes a counter221and a key slot222. The storage unit220is equivalent to a semiconductor memory element such as a RAM, a ROM, or a flash memory, or a storage device such as an HDD.

The counter221stores a replay counter value that is information for detecting a retransmission attack, as indicated by reference numeral221ainFIG. 2C. The key slot222stores the master key distributed from the master ECU100, as indicated by reference numeral222ainFIG. 2D.

The control unit230is a processing unit that supervises the overall processes to be performed by the target ECU200, and is a processor, for example. The control unit230includes an output unit231, an encryption key acquisition unit232, and an encryption key verification unit233. The output unit231, the encryption key acquisition unit232, and the encryption key verification unit233are an example of electronic circuits included in a processor, and an example of processes to be executed by the processor.

The output unit231transmits a master key update request to the master ECU100through the communication unit210. The output unit231outputs a master key update request at a time when an instruction from the user (not illustrated) of the target ECU200is issued, a predetermined event occurs, or a predetermined time has elapsed, for example. The output unit231also transmits M5output from the encryption key verification unit233to the master ECU100through the communication unit210.

The encryption key acquisition unit232acquires M1, M2, and M3transmitted from the master ECU100through the communication unit210, and outputs the M1, M2, and M3to the encryption key verification unit233.

Upon receipt of the output of M1, M2and M3from the encryption key acquisition unit232, the encryption key verification unit233decrypts M2with the temporary master key, and refers to the counter221to verify whether the counter value is valid. In a case where the encryption key verification unit233verifies that the counter value is not valid, the encryption key verification unit233discards the received M1, M2, and M3.

In a case where the encryption key verification unit233verifies that the counter value is valid, the encryption key verification unit233generates a MAC of M1and M2. The encryption key verification unit233then determines whether the generated MAC matches the received M3.

The MAC generated by the encryption key verification unit233and the M3received from the master ECU100are both generated with the use of the M1and M2and the temporary master key. Accordingly, in a case where the generated MAC and the received M3do not match, the encryption key verification unit233verifies that the received M3is not valid.

In a case where the generated MAC and the received M3do not match, the encryption key verification unit233discards the received M1, M2, and M3. In a case where the generated MAC matches the received M3, on the other hand, the encryption key verification unit233decrypts the new master key from M2, and stores the new master key into the key slot222. The encryption key verification unit233also generates a message M4, using the UID of the encryption key verification unit233, the counter value of the counter221, and information about the key slot222. The encryption key verification unit233then generates M5, which is an MAC of the generated message M4, and outputs the M5to the output unit231.

Process Flow

Next, the encryption key distribution process to be performed by the encryption key distribution system1according to this embodiment is described.FIG. 3is a sequence diagram illustrating an example of the encryption key distribution process according to the first embodiment. As illustrated inFIG. 3, the output units231of ECU_A and ECU_C, which are target ECUs200, transmit a key update request to the master ECU100(S1).

Upon receipt of the key update request, the acquisition unit131of the master ECU100outputs an encryption key generation instruction to the generation unit132. The generation unit132refers to the ECU list storage unit121, to identify the target ECUs200that have transmitted the key update request (S2). The generation unit132also generates new master keys to be distributed to the target ECUs200(S3).

The generation unit132then generates messages M1and M2, using the information stored in the ECU list storage unit121(S4). The generation unit132then generates M3, which is a MAC of data generated by combining the generated M1and M2, and outputs the generated M1, M2, and M3to the encryption key output unit133(S5). The encryption key output unit133transmits the M1, M2, and M3output from the generation unit132to ECU_A and ECU_C, which are the target ECUs200that have transmitted the key update request (S6).

The generation unit132also generates a message M4, using the UIDs of the target ECUs200, the encryption key slots, and the counter values, which are stored in the ECU list storage unit121. The generation unit132then generates the MAC (M5) of M4, and stores the MAC (M5) into the comparison candidate table storage unit122(S7).

The encryption key acquisition unit232of each of the target ECUs200receives the M1, M2, and M3from the master ECU100, and outputs the M1, M2, and M3to the encryption key verification unit233. The encryption key verification unit233decrypts the M2output from the encryption key acquisition unit232, and refers to the counter221, to verify whether the counter value is valid (S8). In a case where the encryption key verification unit233verifies that the counter value is valid, the encryption key verification unit233generates an MAC of the output M1and M2(S9). The encryption key verification unit233then verifies whether the generated MAC matches the output M3(S10).

In a case where the encryption key verification unit233verifies that the generated MAC matches the output M3, the encryption key verification unit233stores the new master key obtained by decrypting the M2into the key slot222(S11). The encryption key verification unit233then generates a message M4, using the UID of the encryption key verification unit233, the encryption key slot, and the counter value. The encryption key verification unit233then generates M5, which is an MAC of M4(S12), and outputs the M5to the output unit231. The output unit231transmits the M5output from the encryption key verification unit233, to the master ECU100(S13). At this stage, the output unit231does not transmit the message M4.

The acquisition unit131of the master ECU100receives the M5from the target ECU200, and outputs the M5to the verification unit134. The verification unit134then verifies whether the received M5matches the M5output from the acquisition unit131(S14). In a case where the verification unit134verifies that the generated MAC (M5) of M4matches the M5output from the acquisition unit131, the verification unit134deletes the MAC (M5) of M4stored in the comparison candidate table storage unit122(S15).

Next, processes in the respective devices are described, with reference toFIGS. 4 through 6.FIG. 4is a flowchart illustrating an example of an encryption key transmission process according to the first embodiment. As illustrated inFIG. 4, the acquisition unit131of the master ECU100stands by until receiving a key update request from a target ECU200(S100: No). When the acquisition unit131receives a key update request through the communication unit110(S100: Yes), the acquisition unit131outputs an encryption key generation instruction to the generation unit132. The generation unit132refers to the ECU list storage unit121, and identifies the UID and the key slot of the target ECU200that has transmitted the key update request (S101).

The generation unit132then refers to the ECU list storage unit121, and acquires the counter value of the target ECU200(S102). The generation unit132then generates a new master key (S103), and encrypts the new master key using the temporary master key (S104).

The generation unit132then generates messages M1and M2by referring to the ECU list storage unit121(S105). The generation unit132further generates M3, which is an MAC of the generated messages M1and M2(S106). The generation unit132then outputs the generated M1, M2, and M3to the encryption key output unit133. The encryption key output unit133transmits the M1, M2, and M3output from the generation unit132, to the target ECU200that has transmitted the key update request, through the communication unit110(S107).

The generation unit132then refers to the ECU list storage unit121, and generates a message M4, using the UID, the encryption key slot, and the counter value of the target ECU200that has transmitted M5. The generation unit132then generates an MAC of the generated M4(S108). The generation unit132then stores the generated MAC of M4into the comparison candidate table storage unit122, and generates a comparison candidate table (S109). Through the above process, a new master key is transmitted from the master ECU100to the target ECU200that has transmitted the key update request.

Next, a data reception process to be performed by the target ECU200is described, with reference toFIG. 5.FIG. 5is a flowchart illustrating an example of an encryption key reception process according to the first embodiment. As illustrated inFIG. 5, the encryption key acquisition unit232of the target ECU200that has transmitted the key update request stands by until receiving the M1, M2, and M3from the master ECU100(S200: No). Upon receipt of the M1, M2, and M3(S200: Yes), the encryption key acquisition unit232outputs the M1, M2, and M3to the encryption key verification unit233.

The encryption key verification unit233decrypts the M2output from the encryption key acquisition unit232. The encryption key verification unit233then refers to the counter221, and verifies whether the counter value contained in the decrypted M2is valid (S201). If the encryption key verification unit233verifies that the counter value is not valid (S201: No), the encryption key verification unit233discards the messages M1, M2, and M3(S211), and ends the process.

If the encryption key verification unit233verifies that the counter value is valid (S201: Yes), the encryption key verification unit233generates an MAC of M1and M2. The encryption key verification unit233then verifies whether the generated MAC matches the M3(S202). If the encryption key verification unit233verifies that the generated MAC and the M3do not match (S202: No), the encryption key verification unit233discards the messages M1, M2, and M3(S211), and ends the process.

If the encryption key verification unit233verifies that the generated MAC matches the M3(S202: Yes), the encryption key verification unit233stores the new master key obtained by decrypting the M2into the key slot222(S203). The encryption key verification unit233then generates a message M4, using the UID of the encryption key verification unit233, the encryption key slot, and the counter value. The encryption key verification unit233then generates M5, which is an MAC of the M4(S204), and outputs the M5to the output unit231. The output unit231transmits the M5output from the encryption key verification unit233to the master ECU100(S205). Through the above process, the target ECU200stores the new master key transmitted from the master ECU100, and transmits the M5, which is verification data, to the master ECU100.

Next, a verification process in the master ECU100is described, with reference toFIG. 6.FIG. 6is a flowchart illustrating an example of a distribution verification process according to the first embodiment. As illustrated inFIG. 6, the acquisition unit131of the master ECU100stands by until receiving the M5as the verification data from the target ECU200(S300: No). Upon receipt of the M5through the communication unit110(S300: Yes), the acquisition unit131outputs an M5verification instruction to the verification unit134.

The verification unit134then refers to the comparison candidate table storage unit122, and verifies whether the MAC of the M4that matches the M5output from the acquisition unit131is stored in a brute-force manner (S301). If the verification unit134verifies that the MAC of the M4that matches the M5is not stored (S302: No), the verification unit134stores, into the log storage unit123, information indicating that the verification related to the received M5has failed (S311). The verification unit134then discards the received M5(S312), returns to S200, and stands by until receiving a new M5.

If the verification unit134verifies that the MAC of the M4that matches the M5is stored (S302: Yes), the verification unit134stores, into the log storage unit123, information indicating that the verification related to the received M5has been successful (S303). The verification unit134then deletes the MAC of the M4, which matches the received M5, from the comparison candidate table storage unit122(S304).

The verification unit134then determines whether there is an MAC of M4remaining in the comparison candidate table storage unit122(S321). If the verification unit134determines that there is a remaining MAC of M4(S321: Yes), the verification unit134returns to S300, and stands by until receiving a new M5. If the verification unit134determines that there is no remaining MAC of M4(S321: No), the verification unit134deletes the comparison candidate table stored in the comparison candidate table storage unit122(S322). The verification unit134then stores, into the log storage unit123, information indicating that the process of distributing a key to the target ECU200that has transmitted the key update request has been completed (S323), and ends the process. Through such a process, the master ECU100verifies whether key distribution to the target ECU200has been completed. In doing so, the target ECU200does not transmit M4but transmits only M5, which is the MAC of M4, to the master ECU100. Thus, the amount of data to be used for key update is reduced from 48 bytes to 16 bytes.

In this embodiment, the verification unit134verifies the M5received from the target ECU200by performing brute-force comparison with the MAC of the M4stored in the comparison candidate table storage unit122. A brute-force comparison process in this embodiment is now described, with reference toFIG. 7.FIG. 7is a diagram illustrating an example of a brute-force comparison process according to the first embodiment.FIG. 7illustrates an example of a brute-force comparison process using a comparison candidate table generated in a case where key update requests are received from five target ECUs200of “UID_D” through “UID_H”. In this case, five MAC values from a MAC value “D” through a MAC value “H” are stored in the comparison candidate table.

First, in a case where the verification unit134receives M5whose MAC value is “D” from the target ECU200of “UID_D”, the received MAC value “D” is compared with the five MAC values stored in the comparison candidate table in a brute-force manner. For example, the verification unit134performs a brute-force comparison process for the MAC value “D” up to five times. As a result, the verification unit134verifies that the MAC value “D” matches the received MAC value, for example, that a valid MAC value has been received. In this case, the verification unit134deletes the MAC value “D” from the comparison candidate table. For example, at this stage, four MAC values are stored in the comparison candidate table.

Next, in a case where the verification unit134receives M5whose MAC value is “E” from the target ECU200of “UID_E”, the received MAC value “E” is compared with the four MAC values stored in the comparison candidate table in a brute-force manner. For example, the verification unit134performs a brute-force comparison process for the MAC value “E” up to four times, and accordingly, the processing time becomes shorter than in the case with the MAC value “D”.

The verification unit134verifies that the MAC value “E” matches the received MAC value, as in the above described case. In this case, the verification unit134deletes the MAC value “E” from the comparison candidate table, and accordingly, the number of MAC values stored in the comparison candidate table decreases to three.

In this manner, the number of MAC values stored in the comparison candidate table decreases each time a valid MAC value is received. As a result, the verification unit134reduces original “25 times”, which correspond to the number of times of performing a brute-force MAC value comparison process to “15 times”. Thus, it is possible to shorten the time to be taken by brute-force comparison.

Effects

As described above, in an encryption key distribution system including a key distribution ECU that transmits encryption keys and key reception ECUs that receive encryption keys, the key distribution ECU transmits an encryption key to a key reception ECU. The key distribution ECU also determines whether the encryption key transmission to the key reception ECU has been completed, on the basis of a result of determination as to whether verification data transmitted from the key reception ECU matches encryption key verification data calculated from a common key held in the key distribution ECU and the identifier of the key reception ECU. Further, in the encryption key distribution system, the key reception ECU records the received encryption key therein, calculates the verification data of the received encryption key from the common key stored therein and the identifier of the key reception ECU, and transmits the verification data of the received encryption key to the key distribution ECU. This reduces the amount of data to be used for key update.

The key distribution ECU also transmits encryption keys to a plurality of key reception ECUs that have transmitted a key request among the key reception ECUs, and determines from which key reception ECU the received verification data has been transmitted among the plurality of key reception ECUs that have transmitted the key request. By doing so, the key distribution ECU identifies the key reception ECU for which the key update has been completed.

The key distribution ECU also calculates encryption key verification data from the common key and the identifiers of a plurality of key reception ECUs to which encryption keys are to be transmitted, and stores the calculated encryption key verification data associated with the identifiers of the plurality of key reception ECUs into a verification data storage. In a case where it is determined that the stored verification data matches verification data received from a key reception ECU, the key distribution ECU deletes the matched verification data from the verification data storage. This reduces the time to be taken to verify whether key update has succeeded.

In a case where it is determined that all the verification data stored in the verification data storage has been deleted, the key distribution ECU determines that reception of encryption keys has been completed at the plurality of key reception ECUs that have transmitted the key request. Thus, the key distribution ECU readily recognizes completion of reception of encryption keys at all the key reception ECUs.

Further, each key reception ECU does not transmit an encryption key data set to the key distribution ECU. This reduces the amount of data to be used for key update.

The method of reducing the amount of data to be used for key update may be a method of not transmitting part of the message M4, or a method of reducing the data length of M5, for example. However, by the method of not transmitting part of the message M4, the amount of data to be reduced is small. If the data length of M5is reduced, the guaranteed space becomes smaller, and the security strength becomes lower. According to this embodiment, it is possible to reduce the amount of data to be used for key update, without a decrease in security strength.

Second Embodiment

Although an embodiment of the present invention has been described above, the present invention may be implemented in various forms in addition to the above embodiment. For example, the number of master ECUs100and the number of target ECUs200in the encryption key distribution system1are not limited to the numbers illustrated inFIG. 1, and the encryption key distribution system1may include a plurality of master ECUs100and four or more target ECUs200. Alternatively, one of the target ECUs200may also serve as the master ECU100.

In the first embodiment, a configuration for distributing master keys has been described. However, the present invention is not limited to this, and may be a configuration for distributing encryption keys that are not master keys. In this case, to encrypt a key to be distributed, the generation unit132may use an existing master key, instead of the temporary master key.

The generation unit132may incorporate a hash value of the UID into the message M1, instead of the UID contained in the message M1. This further reduces the amount of data to be used for key update.

In a process of verifying whether a counter value is valid, the encryption key verification unit233may verify that the counter value is valid not only in a case where the received counter value matches the value of the counter221, but also in a case where the difference between the two counter values is within a predetermined allowable range. In this case, the encryption key verification unit233may correct the value of the counter221, depending on the received counter value.

Further, although this embodiment has been described through the encryption key distribution system1formed in one CAN, the present invention is not limited to this, and the encryption key distribution system1may be formed across a plurality of CANs. In this case, a plurality of master ECUs100may exist. Further, the respective master ECUs100, or the master ECUs100and the target ECUs200may belong to different CANs. Furthermore, each target ECU200may share “CAN ID”, which is the ID uniquely identifying the CAN, with the other target ECUs200. Thus, it is possible to reduce the number of “CAN IDs”, which is limited.

System

Further, each component of each device illustrated in the drawings is functionally conceptual, and therefore, the devices do not have to be physically configured as illustrated in the drawings. For example, specific aspects of separation and integration of the respective components are not limited to the illustrated forms, and all or some of the components may be functionally or physically separated and integrated in an arbitrary unit depending on various loads and usage states. For example, the acquisition unit131and the encryption key output unit133may be integrated. Alternatively, each output unit231may be separated into a processing unit that outputs an encryption key update request and a processing unit that outputs verification data. Further, all or some of the various processing functions to be executed by each device may be executed by a CPU (or a microcomputer such as an MPU or a micro controller unit (MCU)). Alternatively, all or some of the various processing functions may of course be executed by a program to be analyzed and executed by a CPU (or a microcomputer such as an MPU or an MCU) or hardware using wired logic.

Hardware

Further, each target ECU200described in the above embodiments is formed with an electronic device such as a microcomputer mounted in a vehicle, for example.FIG. 8is a diagram illustrating an example hardware configuration of an ECU. Although a target ECU200will be described as an example below, the master ECU100may also have the same hardware configuration.

As illustrated inFIG. 8, an electronic device9000includes a processor9001, a CAN communication interface9002, a RAM9003, a nonvolatile memory9004, and an external interface9005. The processor9001, the CAN communication interface9002, the RAM9003, the nonvolatile memory9004, and the external interface9005are mounted on one chip, for example.

Examples of the processor9001include a CPU, a digital signal processor (DSP), an FPGA, and a programmable logic device (PLD). The CAN communication interface9002is a wired interface that controls communication with other ECUs. Examples of the RAM9003and the nonvolatile memory9004include RAMs such as synchronous dynamic random access memories (SDRAMs), ROMs, and flash memories. The external interface9005is a wired or wireless interface that controls communication with an external device controlled by a target ECU200, for example.

The processor9001executes a program for achieving the same functions as the output unit231, the encryption key acquisition unit232, and the encryption key verification unit233, for example. By doing so, the processor9001performs a process for achieving the same functions as the output unit231, the encryption key acquisition unit232, and the encryption key verification unit233.

The master ECU100described in the above embodiments may also be formed with the same electronic device9000. In this case, the processor9001that forms the master ECU100executes a program for achieving the same functions as the acquisition unit131, the generation unit132, the encryption key output unit133, and the verification unit134, for example. By doing so, the processor9001performs a process for achieving the same functions as the acquisition unit131, the generation unit132, the encryption key output unit133, and the verification unit134.