In-vehicle information communication system and authentication method

An in-vehicle information communication system is configured from an in-vehicle communication device, an electronic control device that is installed in a vehicle, and an information processing device that is not installed in a vehicle. The electronic control device comprises an electronic control device storage unit, a message generation unit, a MAC generation unit, and an electronic control device communication unit which sends the message and the MAC to the information processing device via the in-vehicle communication device. The information processing device comprises an information processing device storage unit, a message authentication code verification unit, a response code generation unit, and an information processing device communication unit which sends the response code to the electronic control device via the in-vehicle communication device. The electronic control device further comprises a response code verification unit.

TECHNICAL FIELD

The present invention relates to an in-vehicle information communication system and an authentication method.

BACKGROUND ART

Pursuant to the networking of in-vehicle equipment and the increase of in-vehicle software, the necessity of introducing information security technologies is also being recognized in the automobile sector. In particular, the service of distributing and updating the firmware of ECUs (Electric Control Units) from an external information processing device via wireless transmission is now being put into practical application, and the necessity of introducing security technologies for the foregoing firmware update is increasing.

PTL 1 discloses an invention in which, in a communication system configured from an ECU, a center, and a rewriting device existing on a communication path connecting the ECU and the center, when the center authenticates the rewriting device, the center sends, to the rewriting device, secret information required for rewriting the firmware of the ECU.

CITATION LIST

Patent Literature

SUMMARY OF THE INVENTION

Problems to be Solved by the Invention

With the invention described in PTL 1, the secret information related to the ECU is sent from the server to the rewriting device, and it is not possible to secure the confidentiality of the secret information related to the ECU.

Means to Solve the Problems

According to the first mode of the present invention, provided is an in-vehicle information communication system configured from an in-vehicle communication device and an electronic control device which are installed in a vehicle, and an information processing device which is not installed in a vehicle, wherein the electronic control device comprises: an electronic control device storage unit which stores a common key that is shared with the information processing device in advance; a message generation unit which generates a message for use in authentication; a message authentication code generation unit which uses the common key and generates a message authentication code related to the message; and an electronic control device communication unit which sends the message generated by the message generation unit and the message authentication code generated by the message authentication code generation unit to the information processing device via the in-vehicle communication device, wherein the information processing device comprises: an information processing device storage unit which stores the common key; a message authentication code verification unit which performs authentication of the electronic control device by verifying the received message authentication code using the common key and the received message; a response code generation unit which generates a response code by encrypting a value based on the received message via symmetric key encryption with the common key and an information processing device communication unit which, when the verification by the message authentication code verification unit is successful, sends the response code generated by the response code generation unit to the electronic control device via the in-vehicle communication device, and wherein the electronic control device further comprises: a response code verification unit which performs authentication of the information processing by verifying the received response code based on the common key.

According to the second mode of the present invention, provided is an authentication method, in an in-vehicle information communication system configured from an in-vehicle communication device and an electronic control device which are installed in a vehicle, and an information processing device which is not installed in a vehicle, of the electronic control device and the information processing device, wherein the electronic control device: generates a message for use in authentication; uses a common key that is shared with the information processing device in advance and generates a message authentication code related to the message; and sends the generated message and the generated message authentication code to the information processing device via the in-vehicle communication device, wherein the information processing device: authenticates the electronic control device by verifying the received message authentication code using the common key and the received message; generates a response code based on the received message and the common key and, when the verification is successful, sends the generated response code to the electronic control device via the in-vehicle communication device, and wherein the electronic control device authenticates the information processing device by verifying the received response code based on the common key.

Advantageous Effects of the Invention

According to the present invention, it is possible to secure the confidentiality of the secret information related to the ECU.

DESCRIPTION OF EMBODIMENTS

First Embodiment

An embodiment of the in-vehicle information communication system according to the present invention is now explained with reference toFIG. 1toFIG. 12.

FIG. 1is a diagram showing a schematic configuration of the in-vehicle information communication system1in the first embodiment of the present invention. As shown inFIG. 1, the in-vehicle information communication system1includes an information processing device101, and a vehicle103. The information processing device101and the vehicle103are communicably connected to each other via a wireless communication network102. InFIG. 1, while the in-vehicle information communication system1is configured from one information processing device101and one vehicle103, the in-vehicle information communication system1may also be configured from a plurality of information processing devices101and a plurality of vehicles103.

The vehicle103is configured from an in-vehicle communication device131, and a plurality of ECUs132. The in-vehicle communication device131and the plurality of ECUs132are communicably connected to each other via an in-vehicle network133. Only the in-vehicle communication device131is connected to the wireless communication network102, and none of the ECUs132can communicate with the information processing device101without going through the in-vehicle communication device131.

(Configuration of Information Processing Device101)

The information processing device101is, for example, a server device. As shown inFIG. 1, the information processing device101comprises an I/O interface111, a storage unit114, a portable storage medium interface unit119, a communication unit120, and a processing unit121. The I/O interface111, the storage unit114, the portable storage medium interface unit119, the communication unit120, and the processing unit121are communicably connected to each other via a bus118. The storage unit114stores a constant115, key information116, and a transmission/reception table117. The processing unit121comprises an encryption protocol control unit123, and an encryption processing unit124.

The I/O interface111performs interface processing of signals to be input and output between the processing unit121and a display112, and a keyboard113. The processing unit121displays various types of information by outputting signals to the display112via the I/O interface111. The processing unit121can acquire operation signals output from the keyboard113via the I/O interface111, detect the operator's operation performed to the information processing device101, and perform processing according to the detected operation.

The storage unit114is configured, for example, from a ROM, a RAM, a NVRAM (Non Volatile RAM), a hard disk device, a SSD (Solid State Drive), or an optical storage device. The storage unit114stores a constant115, key information116, and a transmission/reception table117.

The constant115is a constant or the like used in encryption processing, and may be, for example, a base point in elliptic curve encryption, or a public key encryption exponent e in RSA encryption.

The key information116is information of a plurality of keys to be used in authentication. The term “key” as used herein refers to predetermined electronic data, and is, for example, and an extremely large number. The types, characteristics, and functions of a key will be described later. As the key information116, keys corresponding to the respective communication destinations are prepared, and the correspondence of the communication destination and the key is recorded in the transmission/reception table117. The transmission/reception table117stores identification information for identifying the in-vehicle communication device131and the ECU132, and identification information of the key information116corresponding to the individual in-vehicle communication devices131and ECUs132.

FIG. 2is a diagram showing an example of the transmission/reception table117. The transmission/reception table117is configured from a vehicle ID for identifying the vehicle103, an in-vehicle communication device ID for identifying the in-vehicle communication device131, an ECU ID for identifying the ECU132, an ECU manufacturer ID for identifying the ECU manufacturer that manufactured the ECU132, firmware version information for identifying the version information of the firmware of the ECU132, an ECU key information ID for identifying the key information to be used in the authentication of the ECU132, and an in-vehicle communication device secret information ID for identifying the key information to be used in the authentication of the in-vehicle communication device131.

Explanation is now continued by returning toFIG. 1.

The portable storage medium interface unit119is an interface device for connecting a portable storage medium to the information processing device101. The processing unit121reads and writes data from and to the USB memory and the various types of memory cards connected via the portable storage medium interface unit119.

The communication unit120communicates with the vehicle103via the wireless communication network102.

The wireless communication network102is, for example, a mobile phone network or a wireless LAN.

The processing unit121is configured from a CPU, a ROM, and a RAM. The CPU executes the programs stored in the ROM by reading the programs into the RAM. However, the processing unit121may also be configured from an MPU in substitute for the CPU, or an MPU may be used together with the CPU.

The encryption protocol control unit123and the encryption processing unit124represent the functions of the programs stored in the ROM as functional blocks.

The encryption protocol control unit123controls the authentication processing described later. The encryption processing unit124performs the various types of encryption processing used in the authentication processing.

FIG. 3is a block diagram showing a configuration of the in-vehicle communication device131.

The in-vehicle communication device131comprises a processing unit151, a communication unit154, and a storage unit155.

The processing unit151is configured from a CPU, a ROM, and a RAM. The CPU executes the programs stored in the ROM by reading the programs into the RAM. However, the processing unit151may also be configured from an MPU (Micro Processing Unit) in substitute for the CPU, or an MPU may be used together with the CPU.

The encryption protocol control unit152and the encryption processing unit153represent the functions of the programs stored in the ROM as functional blocks.

The encryption protocol control unit152controls the authentication processing described later. The encryption processing unit153performs the various types of encryption processing used in the authentication processing.

The communication unit154communicates with the information processing device101via the wireless communication network102, and communicates with the ECU132via the in-vehicle network133.

The storage unit155is configured, for example, from a ROM (Read Only Memory), a RAM (Random Access Memory), a NVRAM (Non Volatile RAM), a hard disk device, a SSD, or an optical storage device. The storage unit155stores a constant156, key information157, and an information management table158.

The constant156is a constant or the like used in encryption processing, and may be, for example, a base point in elliptic curve encryption, or a public key encryption exponent e in RSA encryption.

The key information157is information of a plurality of keys to be used in authentication. The types and functions of a key will be described later. As the key information157, keys corresponding to the respective communication destinations are prepared, and the correspondence of the communication destination and the key is recorded in the transmission/reception table158. The information management table158stores identification information for identifying the information processing device101, and identification information of the key information157corresponding to the individual information processing devices101.

FIG. 4is a diagram showing an example of the information management table158.

The information management table158is used by the in-vehicle communication device131for identifying the ECU132connected to the in-vehicle network in the vehicle103and managing the firmware version information of the ECU132.

The information management table158is configured from a vehicle ID for identifying the vehicle103, an information processing device ID for identifying the information processing device101of the communication destination, an ECU ID for identifying the ECU132, an ECU manufacturer ID for identifying the ECU manufacturer that manufactured the ECU132, firmware version information for identifying the version information of the firmware of the ECU132, and information processing device secret information ID for identifying the key information157to be used in the authentication of the information processing device101.

FIG. 5is a block diagram showing a configuration of the ECU132.

The ECU132comprises a processing unit171, a communication unit174, and a storage unit175.

The processing unit171is configured from a CPU, a ROM, and a RAM. The CPU executes the programs stored in the ROM by reading the programs into the RAM. However, the processing unit171may also be configured from an MPU (Micro Processing Unit) in substitute for the CPU, or an MPU may be used together with the CPU.

The encryption protocol control unit172and the encryption processing unit173represent the functions of the programs stored in the ROM as functional blocks.

The encryption protocol control unit172controls the authentication processing described later. The encryption processing unit173performs the various types of encryption processing used in the authentication processing. The encryption protocol control unit172starts the processing described later when an ignition key (not shown) of the vehicle103is turned ON by the user.

The communication unit174communicates with the in-vehicle communication device131via the in-vehicle network133.

The storage unit175is configured, for example, from a ROM, a RAM, a NVRAM, a hard disk device, a SSD, or an optical storage device. The storage unit175stores a constant176, and key information177.

The constant176is a constant or the like used in encryption processing, and may be, for example, a base point in elliptic curve encryption, or a public key encryption exponent e in RSA encryption.

The key information177is information of a plurality of keys to be used in authentication with a specific information processing device101. The types and functions of a key will be described later. Because the ECU132communicates with only a specific information processing device101, the ECU132does not have keys corresponding to a plurality of communication destinations as with the information processing device101and the in-vehicle communication device131. Thus, the ECU132also does not have information corresponding to the transmission/reception table117and the information management table158.

The key information116stored in the information processing device101, the key information157stored in the in-vehicle communication device131, and the key information177stored in the ECU132are now explained with reference toFIG. 6. However,FIG. 6only shows the key information to be used in the authentication of a certain set of the information processing device101, the in-vehicle communication device131, and the ECU132. Keys indicated at the same height in the vertical direction ofFIG. 6are the same keys or keys that are correlated.

FIG. 6is a diagram showing a correlation of the key information stored in the information processing device101, the in-vehicle communication device131, and the ECU132. The information processing device101comprises a common key CK1, a first secret key SKS, and a second public key PKT. The in-vehicle communication device131comprises a first public key PKS and a second secret key SKT. The ECU132comprises a key K, a key encryption key KEK, and a common key CK2. The key K, the key encryption key KEK, and the common key CK2are the secret information stored in the ECU132. The key K is, for example, information that is required upon outputting an operation command to the ECU132from the outside.

The key K and the key encryption key KEK stored in the ECU132are keys that are only equipped in the ECU132.

The common key CK1stored in the information processing device101and the common key CK2stored in the ECU132are the same, and these are so-called shared secret keys. The common key CK1and the common key CK2are shared by the information processing device101and the ECU132in advance based on a safe delivery method.

The first secret key SKS and the first public key PKS are a pair of keys, a so-called key pair, corresponding to the public key encryption. The second public key PKT and the second secret key SKT are similarly a pair of keys, a so-called key pair, corresponding to the public key encryption. The first secret key SKS and the second secret key SKT are so-called private keys. The first public key PKS and the second public key PKT are so-called public keys.

Authentication is mutually performed between the information processing device101and the ECU132by using the common key CK1and the common key CK2.

Authentication is performed between the information processing device101and the in-vehicle communication device131as a result of one creating an electronic signature (hereinafter simply referred to as a “signature”) by using a secret key, and the other verifying the signature by using a corresponding public key.

The overview of the authentication processing performed by the information processing device101, the in-vehicle communication device131, and the ECU132is now explained.

FIG. 7is a transition diagram showing the overview of the authentication processing. Time is elapsing from top to bottom inFIG. 7.

The processing unit171of the ECU132reads the key information177from the storage unit175when the ignition switch of the vehicle103is turned ON (step S511). The processing unit171of the ECU132implements the encryption processing1by using the key information177acquired in step S511(step S512). The encryption processing1of step S512is realized, for example, based on the flowchart ofFIG. 8described later. The communication unit174of the ECU132sends the information generated in step S512to the in-vehicle communication device131installed in the same vehicle103(step S513).

When the in-vehicle communication device131receives the data sent in step S513, the processing unit151of the in-vehicle communication device131reads the key information157from the storage unit155(step S521).

The processing unit151of the in-vehicle communication device131implements the encryption processing2by using the data received in step S513, and the key information157acquired in step S521(step S522). The encryption processing2of step S522is realized, for example, based on the flowchart ofFIG. 9described later.

The communication unit154of the in-vehicle communication device131sends the information generated in step S522to the information processing device101via the wireless communication network102(step S523).

When the information processing device101receives the data sent in step S523, the processing unit121of the information processing device101reads the key information116stored in the storage unit114(step S531).

The processing unit121of the information processing device101implements the encryption processing3by using the received data and the key information116acquired in step S531(step S532). The encryption processing3of step S532is realized, for example, based on the flowchart ofFIG. 10described later. In the encryption processing3, authentication of the in-vehicle communication device131and the ECU132by the information processing device101is performed.

The communication unit120of the information processing device101sends the data generated in step S532to the in-vehicle communication device131(step S533). When the in-vehicle communication device131receives the data sent in step S533, the processing unit151of the in-vehicle communication device131reads the key information157from the storage unit155(step S541). The processing unit151implements the encryption processing4by using the key information157acquired in step S541, and the received data (step S542). The encryption processing4of step S542is realized, for example, based on the flowchart ofFIG. 11described later. In the encryption processing4, authentication of the information processing device101by the in-vehicle communication device131is performed.

The communication unit154of the in-vehicle communication device131sends the data including the information generated in step S542to the ECU132(step S543).

When the ECU132receives the data sent in step S543, the processing unit171of the ECU132reads the key information177from the storage unit175(step S551). The processing unit171of the ECU132implements the encryption processing5by using the information acquired in step S551(step S552). The encryption processing5of step S552is realized, for example, based on the flowchart ofFIG. 12described later. In the encryption processing5, authentication of the information processing device101and the in-vehicle communication device131by the ECU132is performed.

The communication unit174of the ECU132sends the authentication result in step S552to the in-vehicle communication device131(step S561).

When the in-vehicle communication device131receives the determination result sent in step S561, the processing unit151of the in-vehicle communication device131stores the determination result in the storage unit155. The communication unit154sends the received determination result to the information processing device101(step S562).

When the information processing device101receives the determination result sent in step S562, the processing unit121of the information processing device101stores the determination result in the storage unit114.

Upon completing the execution of step S561, the processing unit171of the ECU132reads the authentication determination result stored in the storage unit175, and determines whether or not the authentication was successful. The processing unit171of the ECU132proceeds to step S572upon determining that the authentication was successful, and ends the processing upon determining that the authentication was unsuccessful (step S571). The processing unit171of the ECU132proceeds to the firmware writing sequence upon determining that the authentication was successful in step S571(step S572).

Upon completing the execution of step S562, the processing unit151of the in-vehicle communication device131reads the authentication determination result stored in the storage unit155, and determines whether or not the authentication was successful. The processing unit151of the in-vehicle communication device131proceeds to step S582upon determining that the authentication was successful, and ends the processing upon determining that the authentication was unsuccessful (step S581). The processing unit151of the in-vehicle communication device131proceeds to the firmware writing sequence upon determining that the authentication was successful in step S581(step S582).

The processing unit121of the information processing device101determines whether or not the authentication was successful with the reception of the determination result in step S562as the trigger. The processing unit121of the information processing device101proceeds to step S592upon determining that the authentication was successful, and ends the processing upon determining that the authentication was unsuccessful (step S591).

The processing unit121of the information processing device101proceeds to the firmware writing sequence upon determining that the authentication was successful in step S591(step S592).

In the firmware writing sequence of step S572, step S582, and step S592, the information processing device101, the in-vehicle communication device131, and the ECU132perform the firmware update processing while communicating with each other. In the firmware update processing, additional encryption/decryption processing of the firmware, generation of a signature, generation of a message authentication code (hereinafter sometimes indicated as “MAC”), verification of the signature and the MAC, and other security functions may also be implemented, and there is no limitation in the method thereof.

Details of the encryption processing1to5shown inFIG. 7are now explained with reference toFIG. 8toFIG. 12.

FIG. 8is a flowchart showing a specific example of the encryption processing1illustrated as step S512inFIG. 7. The executing subject of each step explained below is the encryption protocol control unit172of the ECU132. The encryption protocol control unit172starts the following processing when the ignition switch of the vehicle103is turned ON.

In step S601, the encryption protocol control unit172causes the encryption processing unit173to generate a random number r0, and stores the generated random number r0in the storage unit175. The encryption protocol control unit172then proceeds to step S602.

In step S602, the encryption protocol control unit172causes the encryption processing unit173to encrypt the key K by using the key encryption key KEK. The key K and the key encryption key KEK used in this step are the information stored in the storage unit175as the key information177. The data generated by the encryption processing unit173in this step is hereinafter referred to as the encrypted data X.

Here, when the generation of the encrypted text is expressed with the format of “encrypted text=ENCencryption key(plain text)”, the processing of this step can be expressed with Formula 1 below.
X=EncKEK(K)  (Formula 1)

The encryption protocol control unit172then proceeds to step S603.

In step S603, the encryption protocol control unit172causes the encryption processing unit173to calculate the exclusive OR of the encrypted data X generated in step S602and the random number r0generated in step S601, and stores the calculated exclusive OR as the exclusive OR Y0in the storage unit175. Here, when the operator of the exclusive OR (hereinafter sometimes indicated as “XOR”) is expressed using a symbol in which a cross shape is indicated in a circle, the processing of this step can be expressed with Formula 2 below.

The encryption protocol control unit172then proceeds to step S604.

In step S604, the encryption protocol control unit172generates a message authentication code Z with the exclusive OR Y0generated in step S603as the message, and the common key CK2as the key. Here, when the generation of the message authentication code is expressed with the format of “message authentication code=MACkey(message)”, the processing of this step can be expressed with Formula 3 below.
Z=MACCK2(Y0)  (Formula 3)

The encryption protocol control unit172then proceeds to step S605.

In step S605, the encryption protocol control unit172sends the exclusive OR Y0generated in step603and the message authentication code Z generated in step604to the in-vehicle communication device131by using the communication unit174. The encryption processing1depicted inFIG. 8is thereby ended.

FIG. 9is a flowchart showing a specific example of the encryption processing2illustrated as step S522inFIG. 7. The executing subject of each step explained below is the encryption protocol control unit152of the in-vehicle communication device131. The encryption protocol control unit152starts the following processing upon receiving the exclusive OR Y0and the message authentication code Z from the ECU132.

In step S701, the encryption protocol control unit152causes the encryption processing unit153to execute the following processing. In other words, the encryption protocol control unit152causes the encryption processing unit153to use the second secret key SKT stored as the key information157and generate a signature σ0as the signature of the received exclusive OR Y0. The encryption protocol control unit152then proceeds to step S702.

In step S702, the encryption protocol control unit152sends the signature σ0generated in step S701, the received exclusive OR Y0, and the received message authentication code Z to the information processing device101by using the communication unit154. The encryption processing2depicted inFIG. 9is thereby ended.

FIG. 10is a flowchart showing a specific example of the encryption processing3illustrated as step S532inFIG. 7. The executing subject of each step explained below is the encryption protocol control unit123of the information processing device101. The encryption protocol control unit123starts the following processing upon receiving the signature σ0, the exclusive OR Y0, and the message authentication code Z from the in-vehicle communication device131.

In step S801, the encryption protocol control unit123causes the encryption processing unit124to execute the following processing. In other words, the encryption protocol control unit123causes the encryption processing unit124to verify the received message authentication code Z by using the common key CK1stored as the key information116, and the received exclusive OR Y0. Specifically, the encryption protocol control unit123causes the encryption processing unit124to generate a message authentication code in the same manner as step S604described above. The encryption protocol control unit123then proceeds to step S802.

In step S802, the encryption protocol control unit123determines whether or not the received message authentication code Z is valid. To put it differently, the encryption protocol control unit123determines whether or not the received message authentication code Z and the message authentication code generated in step S801coincide. The encryption protocol control unit123proceeds to step S803upon determining that the received message authentication code Z is valid; that is, upon determining that the received message authentication code Z and the message authentication code generated in step S801coincide. The encryption protocol control unit123proceeds to step S810upon determining that the received message authentication code Z is not valid; that is, upon determining that the received message authentication code Z and the message authentication code generated in step S801do not coincide.

Based on the verification of the message authentication code Z, it is possible to confirm that the ECU132that generated the message authentication code Z has the same common key as the information processing device101. In other words, the encryption protocol control unit123proceeds to step S803when the information processing device101authenticates the ECU132that generated the message authentication code Z as a result of having the same common key.

In step S803, the encryption protocol control unit123causes the encryption processing unit124to execute the following processing. In other words, the encryption protocol control unit123causes the encryption processing unit124to verify the received signature σ0by using the second public key PKT stored as the key information116and the received exclusive OR Y0.

In step S804, the encryption protocol control unit123determines whether or not the received signature σ0is valid. The encryption protocol control unit123proceeds to step S805upon determining that the received signature σ0is valid, and proceeds to step S810upon determining that the received signature σ0is not valid.

Based on the verification of the signature σ0, it is possible to confirm that the in-vehicle communication device131that generated the signature σ0has the second secret key SKT corresponding to the second public key PKT. In other words, the information processing device101authenticates the in-vehicle communication device131that generated the signature σ0on grounds of having the second secret key SKT, and then proceeds to the processing of step S805.

In step S805, the encryption protocol control unit123causes the encryption processing unit124to generate a random number r1, and stores the generated random number r1in the storage unit114. The encryption protocol control unit123then proceeds to step S806.

In step S806, the encryption protocol control unit123causes the encryption processing unit124to execute the following processing. In other words, the encryption protocol control unit123causes the encryption processing unit124to generate encrypted data c1by using the second public key PKT stored as the key information116and encrypting the random number r1. The processing of this step can be expressed with Formula 4 below.
c1=EncPKT(r1)  (Formula 4)

The encryption protocol control unit123then proceeds to step S807.

In step S807, the encryption protocol control unit123causes the encryption processing unit124to execute the following processing. In other words, the encryption protocol control unit123causes the encryption processing unit124to calculate the exclusive OR of the received exclusive OR Y0and the random number r1, and additionally generate encrypted data c2by encrypting the calculated exclusive OR with the common key CK1. The processing of this step can be expressed with Formula 5 below.

The encryption protocol control unit123then proceeds to step S808.

In step S808, the encryption protocol control unit123causes the encryption processing unit124to execute the following processing. In other words, the encryption protocol control unit123causes the encryption processing unit124to use the first secret key SKS stored as the key information157and generate a signature σ1as the signature of c2generated in step S808. The encryption protocol control unit123then proceeds to step S809.

In step S809, the encryption protocol control unit123sends the encrypted data c1generated in step S806, the encrypted data c2generated in step S807, and the signature σ1generated in step S808to the in-vehicle communication device131by using the communication unit120. The encryption processing3depicted inFIG. 10is thereby ended.

In step S810which is executed when a negative determination is made in step S802or step S804, the encryption protocol control unit123sends a message to the effect that the verification was unsuccessful to the in-vehicle communication device131by using the communication unit120. The encryption processing3depicted inFIG. 10is thereby ended.

FIG. 11is a flowchart showing a specific example of the encryption processing4illustrated as step S542inFIG. 7. The executing subject of each step explained below is the encryption protocol control unit152of the in-vehicle communication device131. The encryption protocol control unit152starts the following processing upon receiving the encrypted data c1, the encrypted data c2, and the signature σ1from the information processing device101.

In step S901, the encryption protocol control unit152causes the encryption processing unit153to execute the following processing. In other words, the encryption protocol control unit152causes the encryption processing unit153to verify the signature σ1by using the first public key PKS stored as the key information157, and the received encrypted data c2.

In step S902, the encryption protocol control unit152determines whether or not the received signature σ1is valid. The encryption protocol control unit152proceeds to step S903upon determining that the received signature σ1is valid, and proceeds to step S905upon determining that the received signature σ1is not valid.

Based on the verification of the signature σ1, it is possible to confirm that the information processing device101that generated the signature σ1has the first secret key SKS corresponding to the first public key PKS. In other words, the in-vehicle communication device131authenticates the information processing device101that generated the signature σ1on grounds of having the first secret key SKS, and then proceeds to the processing of step S903.

In step S903, the encryption protocol control unit152causes the encryption processing unit153to execute the following processing. In other words, the encryption protocol control unit152causes the encryption processing unit153to use the second secret key SKT stored as the key information157and decrypt the received encrypted data c1, and thereby generated a decryption result c3. As explained in step806ofFIG. 10, the encrypted data c1is obtained by using the second public key PKT and encrypting the random number r1. Thus, so as long as the information processing device101and the in-vehicle communication device131are using the proper key, the decryption result c3will be the random number r1. The encryption protocol control unit152then proceeds to step S904.

In step S904, the encryption protocol control unit152sends the decryption result c3generated in step S903and the received encrypted data c2to the ECU132by using the communication unit154. The encryption processing4depicted inFIG. 11is thereby ended.

In step S905which is executed when a negative determination is made in step S902, the encryption protocol control unit152sends a message to the effect that the verification was unsuccessful to the ECU132by using the communication unit154. The encryption processing4depicted inFIG. 11is thereby ended.

FIG. 12is a flowchart showing a specific example of the encryption processing5illustrated as step S552inFIG. 7. The executing subject of each step explained below is the encryption protocol control unit172of the ECU132. The encryption protocol control unit172starts the following processing upon receiving the decryption result c3and the encrypted data c2from the in-vehicle communication device131.

In step S1001, the encryption protocol control unit172causes the encryption processing unit173to execute the following processing. In other words, the encryption protocol control unit172causes the encryption processing unit173to use the common key CK2stored as the key information177and decrypt the received encrypted data c2, and thereby generate a decryption result d1. When the generation of the plain text is expressed with the format of “plain text=Decdecryption key(encrypted text)”, the processing of this step can be expressed with Formula 6 below.
d1=DecCK2(c2)  (Formula 6)

The encryption protocol control unit172then proceeds to step S1002.

In step S1002, the encryption protocol control unit172causes the encryption processing unit173to execute the following processing. In other words, the encryption protocol control unit172causes the encryption processing unit173to generate an exclusive OR Y1as the XOR of the decryption result d1generated in step S1001and the received decryption result c3. The processing of this step can be expressed with Formula 7 below.

The encryption protocol control unit172then proceeds to step S1003.

In step S1003, the encryption protocol control unit172causes the encryption processing unit173to execute the following processing. In other words, the encryption protocol control unit172causes the encryption processing unit173to calculate an exclusive OR Y2as the XOR of the exclusive OR Y1calculated in step S1002and the random number r0generated in step S601ofFIG. 8. The processing of this step can be expressed with Formula 8 below.

The encryption protocol control unit172then proceeds to step S1004.

In step S1004, the encryption protocol control unit172causes the encryption processing unit173to execute the following processing. In other words, the encryption protocol control unit172causes the encryption processing unit173to use the key encryption key KEK stored as the key information177and decrypt the exclusive OR Y2calculated in step S1003, and thereby generate a decryption result d2. Here, when the generation of the plain text is expressed with the format of “plain text=Decdecryption key(encrypted text)”, the processing of this step can be expressed with Formula 9 below.
d2=DecKEK(Y2)  (Formula 9)

Here, when Formula 2 and Formula 5 to Formula 8 are substituted for Formula 9, Formula 10 is obtained.

Furthermore, as explained in step S903, so as long as the information processing device101and the in-vehicle communication device131are using the proper key, the decryption result c3will be the random number r1. Furthermore, so as long as the information processing device101and the ECU132are using the proper key, encryption and decryption will be set off because the common key CK1and the common key CK2are the same. Consequently, Formula 10 will be modified as Formula 11 below.

Because the XOR operation will be unaltered when repeated twice, the XOR operation based on r0and the XOR operation based on r1will be set off. Furthermore, when Formula 1 is substituted for Formula 11 and the message authentication code Z is expanded, Formula 12 below is obtained.
d2=DecKEK(EncKEK(K))=K(Formula 12)

In other words, when the information processing device101, the in-vehicle communication device131, and the ECU132were using the proper key in all of the previously explained steps, it can be understood that the key K is obtained as d2.

The encryption protocol control unit172then proceeds to step S1005.

In step S1005, the encryption protocol control unit172determines whether or not the decryption result d2calculated in step S1004coincides with the key K stored as the key information177. The encryption protocol control unit172proceeds to step S1006upon determining that the decryption result d2coincides with the key K, and proceeds to step S1007upon determining that the decryption result d2does not coincide with the key K.

In step S1006, the encryption protocol control unit172determines that both the information processing device101and the in-vehicle communication device131are valid communication partners, and thereby ends the encryption processing5depicted inFIG. 12.

In step S1007which is executed when a negative determination is made in step S1005, the encryption protocol control unit172determines that at least either the information processing device101or the in-vehicle communication device131is an invalid communication partner, and thereby ends the encryption processing5depicted inFIG. 12.

The in-vehicle communication device131sends a message to the effect that the verification was unsuccessful to the ECU132upon receiving a message to the effect that the verification was unsuccessful from the information processing device101. In other words, the in-vehicle communication device131performs the same processing as step S905ofFIG. 11.

The ECU132determines that at least either the information processing device101or the in-vehicle communication device131is an invalid communication partner upon receiving a message to the effect that the verification was unsuccessful from the in-vehicle communication device131. In other words, the ECU132performs the same processing as step S1007ofFIG. 12.

According to the first embodiment of the present invention explained above, the following effects are yielded.

(1) The in-vehicle information communication system1in this embodiment is configured from an in-vehicle communication device131and an electronic control device, or an ECU132, which are installed in a vehicle103, and an information processing device101which is not installed in a vehicle. The electronic control device, or the ECU132, comprises a storage unit175which stores a common key CK that is shared with the information processing device101in advance, a message generation unit, or an encryption processing unit173, which generates a message, or an exclusive OR Y0, for authentication (step S603ofFIG. 8), a MAC generation unit, or an encryption processing unit173, which uses a common key CK2and generates a message authentication code Z related to the message, or the exclusive OR Y0(step S604ofFIG. 8), and a communication unit174which sends the message generated by the message generation unit and the message authentication code Z generated by the MAC generation unit to the information processing device101via the in-vehicle communication device131. The information processing device101comprises a storage unit114which stores a common key CK1, a MAC verification unit, or an encryption processing unit124, which performs authentication of the ECU132by verifying the received MAC with the common key CK1and the received message, or exclusive OR Y0(step S801ofFIG. 10), a response code generation unit, or an encryption processing unit124, which generates a response code, or encrypted data c2, based on the received message, or exclusive OR Y0, and the common key CK1(step S807ofFIG. 10), and a communication unit120which, when the verification by the MAC verification unit is successful (step S804ofFIG. 10: YES), sends the response code, or the encrypted data c2, generated by the response code generation unit to the electronic control device, or the ECU132, via the in-vehicle communication device131. The electronic control device, or the ECU132, further comprises a response code verification unit, or an encryption processing unit173, which performs authentication of the information processing device101by verifying the received response code, or encrypted data c2, based on the common key CK2(step S1001to S1004ofFIG. 12).

The authentication method according to this embodiment is an authentication method, in an in-vehicle information communication system configured from an in-vehicle communication device131and an electronic control device, or an ECU132, which are installed in a vehicle103, and an information processing device101which is not installed in a vehicle, of the electronic control device, or the ECU132, and the information processing device101. The electronic control device, or the ECU132, generates a message, or an exclusive OR Y0, for authentication, uses a common key CK2that is shared with the information processing device101in advance and generates a message authentication code Z related to the message, or the exclusive OR Y0, and sends the generated message and the generated message authentication code Z to the information processing device101via the in-vehicle communication device131. The information processing device101uses the common key CK1and the received message, or exclusive OR Y0, and verifies the received message authentication code Z, generates a response code, or encrypted data c2, based on the received message and the common key CK1, and, when the verification is successful, sends the generated response code to the electronic control device132via the in-vehicle communication device131. The electronic control device, or the ECU132, verifies the received response code based on the common key CK2.

According to the configuration and the authentication method of the in-vehicle information communication system1described above, it is possible to secure the confidentiality of the secret information related to the ECU because the common key CK1, which is the secret information, is not sent to the in-vehicle communication device131which relays the communication of the information processing device101and the ECU132. Furthermore, the information processing device101and the ECU132can authenticate each other while securing the confidentiality of the secret information.

The information processing device101and the ECU132are sharing a common key as a common key CK1and a common key CK2in advance. The ECU132generates an exclusive OR Y0, uses the common key CK2and generates a message authentication code Z regarding the exclusive OR Y0, and sends the exclusive OR Y0and the message authentication code Z to the information processing device101. The information processing device101uses the common key CK1and generates a message authentication code regarding the received exclusive OR Y0. The information processing device101authenticates the ECU132when the message authentication code Z received from the ECU132and the message authentication code Z that it generated message authentication code coincide. This is because the same message authentication code can only be generated by those having a common key that was shared in advance.

The ECU132authenticates the information processing device101by using a symmetric key encryption. This authentication is performed as follows.

The information processing device101and the ECU132are sharing a common key as a common key CK1and a common key CK2in advance. The information processing device101generates encrypted data c2by using the common key CK1and encrypting a value based on the received exclusive OR Y0via symmetric key encryption. The ECU132decrypts the received encrypted data c2, and authenticates the information processing device101when the decrypted value coincides with the value based on the exclusive OR Y0. This is because, since symmetric key encryption is being used, valid encrypted data cannot be generated unless the same common key is used.

The calculation processing required for the ECU132to perform the foregoing authentication is mainly the generation of the message authentication code and the processing of symmetric key encryption. In other words, because the calculation load is small for both the generation of the message authentication code and the processing of symmetric key encryption described above, these can be sufficiently executed even by an ECU132with limited resources.

The algorithm for generating the message authentication code and the algorithm of the symmetric key encryption will suffice so as long as they are common between the information processing device101and the ECU132, and are not limited to specific algorithms. Thus, the algorithm to be used can be easily changed, and it is thereby possible to increase the bit length of the key to match the enhanced functions of the computer, take measures when a vulnerability is discovered in the algorithm, and change to an algorithm that is developed in the future.

(2) The in-vehicle communication device131comprises a storage unit155which stores a first public key PKS as a public key in public key encryption and a second secret key SKT as a secret key in public key encryption, a first signature generation unit, or an encryption processing unit153, which uses the second secret key SKT and generates a first signature σ0as an electronic signature of the message, or the exclusive OR Y0, received from the electronic control device, or the ECU132(step S701ofFIG. 9), and a communication unit154which sends the message received from the electronic control device, or the ECU132, the message authentication code Z received from the electronic control device, or the ECU132, and the first signature generated by the first signature generation unit to the information processing device. The storage unit114of the information processing device101further stores a first secret key SKS which forms a pair with the first public key PKS and a second public key PKT which forms a pair with the second secret key SKT. The information processing device101further comprises a first signature verification unit, or an encryption processing unit124, which uses the second public key PKT and the received message and verifies the received first signature (step S803ofFIG. 10), a random number generation unit, or an encryption processing unit124, which generates a random number r1(step S805ofFIG. 10), an encryption unit, or an encryption processing unit124, which generates an encrypted random number, or encrypted data c1, by encrypting the random number r1generated by the random number generation unit (step S806ofFIG. 10) with the second public key PKT, and a second signature generation unit, or an encryption processing unit124, which uses the first secret key SKS and generates a second signature σ1as an electronic signature of the response code, or the encrypted data c2, generated by the response code generation unit (step S808ofFIG. 10). The response code generation unit generates the response code, or the encrypted data c2, based on the received message, or exclusive OR Y0, the common CP1, and the random number r1. The communication unit120of the information processing device101sends the response code, or the encrypted data c2, generated by the response code generation unit, the encrypted random number, or the encrypted data c1, and the second signature σ1to the in-vehicle communication device131. The in-vehicle communication device131further comprises a second signature verification unit, or an encryption processing unit153, which uses the first public key PKS and the response code, or the encrypted data c2, received from the information processing device101and verifies the received second signature σ1(step S901ofFIG. 11), and a decryption unit, or an encryption processing unit153, which uses the second secret key SKT and decrypts the received encrypted random number, or the encrypted data c1, in to decrypted data, or a decryption result c3(step S903ofFIG. 11). The communication unit154of the in-vehicle communication device131sends the response code, or the encrypted data c2, received from the information processing device101, and the decrypted data, or the decryption result c3, to the electronic control device132. The response code verification unit of the electronic control device, or the ECU132, verifies the received encrypted data c2based on the common key CK2and the decryption result c3.

Consequently, the information processing device101and the in-vehicle communication device131having a key pair can perform authentication by using a public key and verifying the electronic signature created by the counterparty. This is because, when the verification of the electronic signature is successful, it is possible to understand that the party that created the electronic signature has a secret key corresponding to the public key used for the verification.

Authentication is performed between the information processing device101and the ECU132, and authentication is performed between the information processing device101and the in-vehicle communication device131. Consequently, while authentication is not directly performed between the in-vehicle communication device131and the ECU132, authentication can also be indirectly performed between the in-vehicle communication device131and the ECU132via the information processing device101.

(3) The message generation unit, or the encryption processing unit173, of the electronic control device, or the ECU132(step S603ofFIG. 8), generates the message, or the exclusive OR Y0, when an ignition switch of the vehicle103in which the electronic control device is installed is turned ON. The MAC generation unit, or the encryption processing unit173(step S604ofFIG. 8), generates the message authentication code Z when the message generation unit generates the message. When the MAC generation unit generates the message authentication code Z, the communication unit174sends the sends the message generated by the message generation unit and the message authentication code Z generated by the MAC generation unit.

The in-vehicle communication device131and the ECU132are processing a lot of data when the vehicle103is being driven, and it is difficult to secure calculation resources. Thus, authentication can be performed when the vehicle103is started; that is, when the ignition switch is turned ON by the operation, which is when the calculation resources are relatively available.

(4) The electronic control device, or the ECU132, further comprises a second random number generation unit, or an encryption processing unit173, which generates a second random number r0(step S601ofFIG. 8). The storage unit175of the electronic control device, or the ECU132, further stores the first secret information, or a key K, and the second secret information, or a key encryption key KEK. The message generation unit, or the encryption processing unit173, generates encrypted data X by encrypting the key K with the key encryption key KEK, and generates the message, or the exclusive OR Y0, by performing a bit operation, or an exclusive OR, of the encrypted data X and the second random number r0generated by the second random number generation unit.

Consequently, a new random number r0is generated and a different exclusive OR Y0is generated each time the encryption processing1is executed. Because the generated random numbers have no regularity, even if the communication via the wireless communication network102is intercepted by a third party, it is impossible to predict the random number to be subsequently generated, and the exclusive OR Y0to be generated based on the random number, and the safety can thereby be improved.

Modified Example 1

In the first embodiment described above, the same secret key; that is, the second secret key SKT was used in both the signature generation processing in step S701ofFIG. 9and the decryption processing in step S903ofFIG. 11. Nevertheless, a key pair for signature generation/verification and a key pair for encryption/decryption may be separately prepared.

For example, the key information116of the information processing device101further stores a third public key PKU, the key information157of the in-vehicle communication device131further stores a third secret key SKU, and the keys are used as follows. The in-vehicle communication device131uses the second secret key SKT in step S701ofFIG. 9in the same manner as the first embodiment, and uses the third secret key SKU in step S903ofFIG. 11. The information processing device101uses the second public key PKT in step S803ofFIG. 10in the same manner as the first embodiment, and uses the third public key PKU in step S806.

According to Modified Example 1, it is possible to further improve the safety.

Modified Example 2

In the first embodiment described above, the key K and the key encryption key KEK were stored as the key information177of the ECU132. Nevertheless, the encryption processing unit173may additionally generate two random numbers upon generating the random number r0, and use the generated two random numbers as substitutes of the key K and the key encryption key KEK. Furthermore, the generated two random numbers described above may also be stored and used as the key K and the key encryption key KEK, and two random numbers may once again be generated once step S601ofFIG. 8is executed a certain number of times to update the key K and the key encryption key KEK.

Modified Example 3

In the first embodiment described above, the processing of step S511and step S512shown inFIG. 7is started by the ECU132when the ignition key is turned ON by the user, and the subsequent processing is started immediately after the preceding processing is completed. Nevertheless, the timing that the processing of each step is started is not limited thereto.

For example, the processing of step S511and step S512may be started based on a command from the user or the information processing device101. The processing of step S511and step S512may also be started when the processing load of the in-vehicle communication device131or the ECU132becomes a predetermined threshold or less.

The subsequent processing does not need to be started even when the preceding processing is completed until the processing load of the relevant device becomes a predetermined threshold or less, or the subsequent processing may be started only when predetermined conditions are satisfied. For example, the processing of step S532may be started only when the information processing device101detects that the firmware of the communicating ECU132is not the latest version.

Modified Example 4

In the first embodiment described above, both the key K and the key encryption key KEK are stored as the key information177of the ECU132. Nevertheless, only one of either the key K or the key encryption key KEK may be stored.

For example, when the key encryption key KEK is not stored in the key information177, the key K is used as the encrypted data X in step S602ofFIG. 8, and the processing of step S1004ofFIG. 12is omitted.

Modified Example 5

The message authentication code Z may also be generated based on procedures that differ from the first embodiment described above. For example, the exclusive OR of the key K and the random number r0may be encrypted using the key encryption key KEK, and the message authentication code Z may be generated by using the common key CK2. In other words, the calculation formula of the message authentication code Z according to Modified Example 1 can be expressed with Formula 13 below.

Modified Example 5

In the first embodiment described above, whether or not the communication partner is valid was determined in the encryption processing5performed by the ECU132based on whether the decryption result d2coincides with the key K (step S1005ofFIG. 12). Nevertheless, whether or not the communication partner is valid may also be determined based on whether the exclusive OR Y1calculated in step S1002coincides with the exclusive OR Y0. In the foregoing case, the ECU132stores the exclusive OR Y0sent in step S605ofFIG. 8in the storage unit175, and uses the stored exclusive OR Y0in the foregoing determination of coincidence.

According to Modified Example 1, the computational effort can be reduced in an ECU132with limited resources.

The first embodiment described above may also be further modified as follows.

(1) The information processing device101does not necessarily have to comprise the entire hardware configuration described above, and, for example, the information processing device101does not have to comprise the display112or the keyboard113.

(2) The transmission/reception table117and the information management table158do not necessarily have to include all of the information described above, and may also include information other than the information described above. For example, the information management table158may also include an information processing device public information ID for identifying the key information to be used in authenticating the information processing device101.

(3) The storage unit114may store information other than the information described above, and may also store, for example, various types of firmware of the in-vehicle communication device131and the ECU132.

(4) A part of the processing performed by the processing units121,151,171may also be realized with a hardware circuit. For example, the random numbers may also be generated with a random number generator.

Second Embodiment

The second embodiment of the in-vehicle information communication system according to the present invention is now explained with reference toFIG. 13toFIG. 15. In the ensuing explanation, the same constituent elements as the first embodiment are given the same reference numeral, and only the differences are mainly explained. If no explanation is specifically provided, then that constituent element is the same as the first embodiment. This embodiment mainly differs from the first embodiment with respect to the point that a session key is used in the firmware writing sequence.

The configuration of the in-vehicle information communication system1according to the second embodiment differs from the first embodiment with regard to the point that a session key is stored in the storage unit114of the information processing device101, and the storage unit175of the ECU132. However, the session key is not shared in advance as with the key information, and is generated, or delivered in an encrypted state, once the authentication flow is started as described later.

In the second embodiment, the operation of the program differs from the first embodiment. Specifically, the overview of the authentication processing flow explained with reference toFIG. 7in the first embodiment is the same as the first embodiment, and the encryption processing1of step S512, the encryption processing2of step S522, and the encryption processing3of step S532differ from the first embodiment.

FIG. 13is a flowchart showing a specific example of the encryption processing1in the second embodiment. Processing that is the same as the first embodiment is given the same step number, and the explanation thereof is omitted.

In step S1101which is executed after step S604, the encryption protocol control unit172causes the encryption processing unit173to execute the following processing. In other words, the encryption protocol control unit172causes the encryption processing unit173to generate a session key SS, which is a random number, and stores the generated session key SS in the storage unit175, and additionally causes the encryption processing unit173to encrypt the session key SS by using the common key CK2stored as the key information177, and thereby generate an encrypted session key ESS. The encryption protocol control unit172then proceeds to step S1102.

In step S605, the encryption protocol control unit172sends the exclusive OR Y0generated in step603, the message authentication code Z generated in step604, and the encrypted session key ESS generated in step S1101to the in-vehicle communication device131by using the communication unit174. The encryption processing1in the second embodiment depicted inFIG. 13is thereby ended.

FIG. 14is a flowchart showing a specific example of the encryption processing2in the second embodiment. Processing that is the same as the first embodiment is given the same step number, and the explanation thereof is omitted.

In step S1201which is executed after step S701, the encryption protocol control unit152sends the signature σ0generated in step S701, the received exclusive OR Y0, the received message authentication code Z, and the received encrypted session key ESS to the information processing device101by using the communication unit154. The encryption processing2in the second embodiment depicted inFIG. 14is thereby ended.

FIG. 15is a flowchart showing a specific example of the encryption processing3in the second embodiment. Processing that is the same as the first embodiment is given the same step number, and the explanation thereof is omitted.

In step S1301which is executed when a positive determination is made in step S804, the encryption protocol control unit123causes the encryption processing unit124to execute the following processing. In other words, the encryption protocol control unit123causes the encryption processing unit124to use the common key CK1stored as the key information116and decrypt the received encrypted session key ESS, and stores this as the decrypted session key DSS in the storage unit114. The encryption protocol control unit123then proceeds to step S805.

(Communication after Completion of Authentication)

In the communication after the completion of authentication, the ECU132uses the session key SS and encrypts the data to be sent to the information processing device101, and uses the session key SS to decrypt the data received from the information processing device101.

In the communication after the completion of authentication, the information processing device101uses the decrypted session key DSS and encrypts the data to be sent to the ECU132, and uses the decrypted session key DSS and decrypts the data received from the ECU132.

Because the session key SS and the decrypted session key DSS will be the same so as long as the information processing device101and the ECU132are using the proper key, the communication between the information processing device101and the ECU132can be encrypted.

According to the second embodiment of the present invention explained above, the following effects are yielded.

(1) The ECU132generates a session key SS for use in the communication after the completion of authentication, encrypts the generated session key SS by using a common key CK2and generates an encrypted session key ESS, and sends the generated encrypted session key ESS to the information processing device101. The information processing device101decrypts the received encrypted session key ESS by using a common key CK1and thereby obtains a decrypted session key DSS.

Thus, the communication after the completion of authentication can be encrypted by using the session key SS and the decrypted session key DSS. Furthermore, because the session key SS is generated each time the encryption processing1is executed, even if the session key SS is divulged to the outside at a certain time, it is possible to limit the influence of such divulgence.

The respective embodiments and modified examples described above may also be combined with each other.

While various embodiments and modified examples were explained above, the present invention is not limited thereto. Other modes that can be considered with the range of the technical concept of the present invention are also covered by the present invention.

The disclosure of the following priority application is incorporated herein by reference. Japanese Patent Application No. 2015-130315 (filed on Jun. 29, 2015)

REFERENCE SIGNS LIST