Patent Publication Number: US-2021174607-A1

Title: Method and system for replacing vehicle parts using in-vehicle network based on vehicle ethernet

Description:
CROSS REFERENCE TO RELATED APPLICATION 
     This application claims the benefit of Korean Patent Application No. 10-2019-0164118, filed Dec. 10, 2019, which is hereby incorporated by reference in its entirety into this application. 
     BACKGROUND OF THE INVENTION 
     1. Technical Field 
     The present invention relates generally to technology for securely replacing vehicle parts, and more particularly to technology for enabling a vehicle owner, a vehicle manufacturer, a vehicle maintenance company, and a vehicle to securely replace an electronic control unit (ECU) using existing IT technology when replacement of the ECU is required due to failure thereof in a vehicle in which an in-vehicle network is configured based on an automotive Ethernet. 
     2. Description of the Related Art 
     With the recent advent of technologies such as autonomous driving, a connected car, and the like, vehicles increasingly adopt IT technology, which results in increasing attention being paid to fields related to vehicle security technology. 
     For example, provision of new services, such as autonomous driving and connected cars, requires technology for quickly transmitting a large amount of data, and in order to satisfy this requirement, an automotive Ethernet is adopted not only in a network outside a vehicle but also in an in-vehicle network. That is, in the IoT environment, in which all things are connected over the Internet, vehicles are necessarily placed in an environment in which the vehicles must frequently perform communication via external networks. However, when IT technology is increasingly applied to vehicles, security threats present in the existing IT technology also appear in vehicles, so security threats to vehicles are expected to increase. 
     In order to respond to such security threats to vehicles, security solutions for external networks of vehicles have been actively researched, but analysis of security threats to in-vehicle networks to which an automotive Ethernet is applied and research into security solutions therefor are not being actively conducted. As the most fundamental security function for in-vehicle networks, a secure communication function must be provided, and to this end, secure key management must also be provided. 
     Also, in the event of replacement of an ECU due to a problem in a vehicle, the owner of the vehicle has to date been unable to check whether the ECU is replaced with a certified ECU and has had no choice but to trust the results of repair and replacement provided by a vehicle maintenance company. That is, there may be a problem in which, if the vehicle maintenance company replaces the ECU regardless of the inspection result, or if the vehicle maintenance company illicitly replaces an ECU, which needs to be replaced according to the inspection result, with an uncertified ECU, the owner of the vehicle cannot detect this situation. 
     Also, when replacement of the ECU of a vehicle having a problem is entrusted to a vehicle maintenance company, critical data (key information, sensitive information, and the like) included in the ECU can be exposed by the vehicle maintenance company. Further, because most in-vehicle networks are configured such that ECUs connected with the same domain (the same vehicle gateway) use the same secret key when security functions are applied, leakage of the secret key of one of the ECUs may result in security threats to all of the ECUs connected to the domain. 
     DOCUMENTS OF RELATED ART 
     (Patent Document 1) Korean Patent Application Publication No. 10-2019-0072009, published on Jun. 25, 2019 and titled “Method for programming electronic control unit using vehicle diagnostic system” 
     SUMMARY OF THE INVENTION 
     An object of the present invention is to provide a system for more securely repairing a vehicle and replacing vehicle parts by applying IT technology to a process in which a vehicle maintenance company carefully inspects and repairs the vehicle. 
     Another object of the present invention is to prevent installation of an uncertified part in a vehicle through the process of registering a certified genuine part, which is performed between a vehicle manufacturer and a vehicle part manufacturer, thereby fundamentally preventing the uncertified vehicle part from being connected with the vehicle. 
     A further object of the present invention is to provide a vehicle part replacement method that can be trusted by a vehicle owner by enabling the vehicle owner to check information about a new vehicle part (ECU), with which an old vehicle part is replaced, and to additionally check the result of replacement again. 
     Yet another object of the present invention is to minimize a key management burden imposed on a domain gateway by forcing ECUs connected with the same domain in a vehicle to use the same session key (secret key). 
     Still another of the present invention is to construct a secure communication channel in a vehicle using a session key that is based on an initial session key and is updated each time communication is required, the initial session key being generated when an ECU is registered or when a new ECU to replace an old ECU is registered. 
     In order to accomplish the above objects, a method for replacing vehicle parts according to the present invention includes performing, by a vehicle diagnosis module included in a vehicle, vehicle self-diagnosis in response to a request made through the terminal of a vehicle owner; performing, by the vehicle and a vehicle manufacturer server, an authentication process for a new part with which a vehicle part is replaced when the vehicle part is replaced depending on the result of the vehicle self-diagnosis based on a vehicle part replacement agreement procedure between the terminal of the vehicle owner and the maintenance terminal of a vehicle maintenance company; and checking, by the terminal of the vehicle owner, whether replacement of the vehicle part is performed normally by requesting an integrity check result from each of the vehicle and the vehicle manufacturer server when the maintenance terminal transmits a part replacement completion message to the terminal of the vehicle owner after the authentication process is completed. 
     Here, the method may further include registering, by the vehicle, at least one domain gateway included in the vehicle in the vehicle manufacturer server. 
     Here, registering the at least one domain gateway may include transmitting, by the vehicle, the public key and signature value of each of the at least one domain gateway to the vehicle manufacturer server; authenticating, by the vehicle manufacturer server, the at least one domain gateway based on the signature value thereof, and transmitting, by the vehicle manufacturer server, a session key encrypted with the public key of the at least one domain gateway to the vehicle when authentication is completed; and decrypting and storing, by the vehicle, the session key, and requesting and receiving, by the vehicle, a security policy from the vehicle manufacturer server. 
     Here, the vehicle part replacement agreement procedure may include a process in which the maintenance terminal requests the vehicle diagnosis module to perform detailed inspection of the vehicle in response to a request from the terminal of the vehicle owner for inspection of the vehicle and a process in which the maintenance terminal asks the terminal of the vehicle owner whether to replace the vehicle part depending on the result of the detailed inspection of the vehicle. 
     Here, performing the authentication process may include transmitting, by the vehicle, the public key and signature value of the new part to the vehicle manufacturer server; and performing, by the vehicle manufacturer server, authentication of the new part based on the signature value of the new part. 
     Here, the method may further include encrypting, by the vehicle manufacturer server, identification information of the new part with the session key and transmitting, by the vehicle manufacturer server, the encrypted identification information to the vehicle along with the public key of the new part; updating, by the vehicle, the session key based on the identification information of the new part, encrypting, by the vehicle, the updated session key with the public key of the new part, and transmitting, by the vehicle, the encrypted session key, to the new part; and encrypting, by the vehicle, a security policy stored in the at least one domain gateway with the updated session key and transmitting, by the vehicle, the encrypted security policy to the new part. 
     Here, checking whether the replacement of the vehicle part is performed normally may be configured such that the terminal of the vehicle owner checks the integrity check result by comparing a first integrity value received from the vehicle with a second integrity value received from the vehicle manufacturer server. 
     Here, the first integrity value may be acquired in such a way that the terminal of the vehicle owner again requests the vehicle diagnosis module to perform vehicle self-diagnosis after receiving the part replacement completion message, and the second integrity value may be acquired in such a way that the terminal of the vehicle owner requests the result of authentication of the new part from the vehicle manufacturer server after receiving the part replacement completion message. 
     Also, a system for replacing vehicle parts according to an embodiment of the present invention includes a vehicle performing vehicle self-diagnosis based on a vehicle diagnosis module included in the vehicle; the terminal of a vehicle owner for requesting the vehicle to perform the vehicle self-diagnosis; the maintenance terminal of a vehicle maintenance company for inspecting the vehicle and replacing a vehicle part in response to a request from the terminal of the vehicle owner; and a vehicle manufacturer server for performing an authentication process for a new part with which the vehicle part is replaced based on communication of the vehicle when the vehicle part is replaced depending on the result of the vehicle self-diagnosis based on a vehicle part replacement agreement procedure between the terminal of the vehicle owner and the maintenance terminal. The terminal of the vehicle owner checks whether replacement of the vehicle part is performed normally by requesting an integrity check result from each of the vehicle and the vehicle manufacturer server when the terminal of the vehicle owner receives a part replacement completion message from the maintenance terminal after completion of the authentication process. 
     Here, the vehicle may register at least one domain gateway included therein in the vehicle manufacturer server. 
     Here, when the vehicle transmits the public key and signature value of each of the at least one domain gateway to the vehicle manufacturer server, the vehicle manufacturer server may authenticate the at least one domain gateway based on the signature value of the at least one domain gateway. When authentication is completed, the vehicle manufacturer server may transmit a session key encrypted with the public key of the at least one domain gateway to the vehicle, and the vehicle may decrypt and store the session key and request and receive a security policy from the vehicle manufacturer server. 
     Here, the vehicle part replacement agreement procedure may include a process in which the maintenance terminal requests the vehicle diagnosis module to perform detailed inspection of the vehicle in response to a request from the terminal of the vehicle owner for inspection of the vehicle and a process in which the maintenance terminal asks the terminal of the vehicle owner whether to replace the vehicle part depending on the result of the detailed inspection of the vehicle. 
     Here, the authentication process may include a process in which the vehicle transmits the public key and signature value of the new part to the vehicle manufacturer server and a process in which the vehicle manufacturer server performs authentication of the new part based on the signature value of the new part. 
     Here, when the vehicle manufacturer server encrypts identification information of the new part with the session key and transmits the same to the vehicle along with the public key of the new part, the vehicle may update the session key based on the identification information of the new part, encrypt the updated session key with the public key of the new part, and transmit the same to the new part. The vehicle may encrypt a security policy stored in the at least one domain gateway with the updated session key and transmit the same to the new part. 
     Here, the terminal of the vehicle owner may compare a first integrity value received from the vehicle with a second integrity value received from the vehicle manufacturer server. 
     Here, the first integrity value may be acquired in such a way that the terminal of the vehicle owner again requests the vehicle diagnosis module to perform vehicle self-diagnosis after receiving the part replacement completion message, and the second integrity value may be acquired in such a way that the terminal of the vehicle owner requests the result of authentication of the new part from the vehicle manufacturer server after receiving the part replacement completion message. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
       The above and other objects, features and advantages of the present invention will be more clearly understood from the following detailed description, taken in conjunction with the accompanying drawings, in which: 
         FIG. 1  is a view illustrating a system for replacing vehicle parts according to an embodiment of the present invention; 
         FIG. 2  is a view illustrating an example of an in-vehicle network based on an automotive Ethernet according to the present invention; 
         FIG. 3  is a flowchart illustrating a method for replacing vehicle parts according to an embodiment of the present invention; 
         FIG. 4  is a view specifically illustrating the process of replacing a vehicle part according to an embodiment of the present invention; 
         FIG. 5  is a view illustrating an example of a domain gateway authentication process in a method for replacing vehicle parts according to the present invention; 
         FIG. 6  is a view illustrating an example of a vehicle part registration process in a method for replacing vehicle parts according to the present invention; 
         FIG. 7  is a view illustrating an example of the process of registering replacement with a new vehicle part in a method for replacing vehicle parts according to the present invention; and 
         FIG. 8  is a view illustrating a system for replacing vehicle parts according to another embodiment of the present invention. 
     
    
    
     DESCRIPTION OF THE PREFERRED EMBODIMENTS 
     The present invention will be described in detail below with reference to the accompanying drawings. Repeated descriptions and descriptions of known functions and configurations that have been deemed to unnecessarily obscure the gist of the present invention will be omitted below. The embodiments of the present invention are intended to fully describe the present invention to a person having ordinary knowledge in the art to which the present invention pertains. Accordingly, the shapes, sizes, etc. of components in the drawings may be exaggerated in order to make the description clearer. 
     Hereinafter, a preferred embodiment of the present invention will be described in detail with reference to the accompanying drawings. 
       FIG. 1  is a view illustrating a system for replacing vehicle parts according to an embodiment of the present invention. 
     Referring to  FIG. 1 , the system for replacing vehicle parts according to an embodiment of the present invention includes a vehicle  110 , a vehicle owner&#39;s terminal  120 , a maintenance terminal  130 , and a vehicle manufacturer server  140 . 
     Here, as shown in  FIG. 2 , the vehicle  210  according to an embodiment of the present invention may be assumed to include three domain gateways, namely, a domain gateway 1  DG 1 , a domain gateway 2  DG 2 , and a domain gateway 3  DG 3 , based on a central gateway CG. 
     Referring again to  FIG. 2 , the vehicle  210  may include the domain gateway 1  DG 1  and the domain gateway 2  DG 2  according to the functions and roles thereof, and ECUs corresponding to the respective domains may be connected therewith. Also, the domain gateway 3  DG 3  may serve to interface with the outside of the vehicle. 
     Here, the structure of the vehicle  210  illustrated in  FIG. 2  is merely the internal structure of the vehicle corresponding to an embodiment for explaining the present invention, and various structures may be applied thereto depending on the vehicle design. For example, a domain gateway includes the functions of a central gateway, whereby only a single vehicle gateway may be configured, without the central gateway. Also, the vehicle may include a greater number of domain gateways than the number of domain gateways illustrated in  FIG. 2 . 
     Here, the OBD module included in the vehicle  210  may perform vehicle self-diagnosis in response to a request for self-diagnosis of the vehicle  210 , and may transmit the result of the vehicle self-diagnosis to the outside via the domain gateway 3 . 
     Here, the vehicle owner  220  may request the vehicle  210  to perform vehicle self-diagnosis using his/her terminal  120  illustrated in  FIG. 1 , and may receive the result of the vehicle self-diagnosis using the same. 
     Here, when a fault is discovered in the result of the vehicle self-diagnosis, the vehicle owner may request a vehicle maintenance company  230  to carefully inspect the vehicle and to perform repair and maintenance thereof depending on the inspection result. 
     Here, the vehicle maintenance company  230  may carefully inspect the vehicle in response to the request from the vehicle owner  220 , may perform vehicle repair and maintenance depending on the vehicle inspection result, and may transmit the vehicle repair and maintenance result to the vehicle owner  220 . 
     Also, the vehicle manufacturer  240  may perform the process of registering and authenticating an ECU while communicating with the vehicle  210  over a network in the vehicle-manufacturing process or vehicle repair and maintenance process. For example, when the vehicle owner  220  requests confirmation of the vehicle repair and maintenance results from the vehicle manufacturer server  140  using his/her terminal  120 , the vehicle manufacturer server  140  may transmit the results of vehicle repair and maintenance performed by the vehicle maintenance company  230  to the terminal  120  of the vehicle owner. 
     Here, the vehicle owner  220  may receive the vehicle repair and maintenance results from the vehicle manufacturer  240  using his/her terminal  120 , such as a smartphone, based on an existing secure communication protocol. 
     Hereinafter, the process of replacing a vehicle part based on the vehicle  110 , the terminal  120  of the vehicle owner, the maintenance terminal  130 , and the vehicle manufacturer server  140  illustrated in  FIG. 1  will be briefly described. 
     First, a vehicle diagnosis module included in the vehicle  110  performs vehicle self-diagnosis in response to a request made through the terminal  120  of the vehicle owner. 
     Here, the vehicle  110  may register at least one domain gateway included therein in the vehicle manufacturer server  140 . 
     Here, the vehicle  110  may transmit the public key and signature value of each of the at least one domain gateway to the vehicle manufacturer server  140 . 
     Here, the vehicle manufacturer server  140  may perform authentication of the at least one domain gateway based on the signature value thereof, and may transmit a session key encrypted with the public key of the at least one domain gateway to the vehicle  110  when authentication is completed. 
     Here, the vehicle  110  may decrypt the session key and store the same, and may request and receive security policies from the vehicle manufacturer server  140 . 
     Also, when a vehicle part is replaced depending on the result of the vehicle self-diagnosis based on a vehicle part replacement agreement procedure between the terminal  120  of the vehicle owner and the maintenance terminal  130  of the vehicle maintenance company, the vehicle  110  and the vehicle manufacturer server  140  perform the process of authenticating a new part with which the vehicle part is replaced. 
     Here, the vehicle part replacement agreement procedure may include a process in which the maintenance terminal  130  requests the vehicle diagnosis module to carefully inspect the vehicle in response to a request from the terminal  120  of the vehicle owner to inspect the vehicle and a process in which the maintenance terminal  130  asks the terminal  120  of the vehicle owner whether to replace a vehicle part depending on the vehicle inspection result. 
     Here, the vehicle  110  may transmit the public key and signature value of a new part to the vehicle manufacturer server  140 . 
     Here, the vehicle manufacturer server  140  may authenticate the new part based on the signature value thereof. 
     Here, the vehicle manufacturer server  140  may encrypt the identification information of the new part with a session key and transmit the same to the vehicle  110  along with the public key of the new part. 
     Here, the vehicle  110  may update the session key based on the identification information of the new part, encrypt the updated session key with the public key of the new part, and transmit the same to the new part. 
     Here, the vehicle  110  may encrypt security policies stored in the at least one domain gateway with the updated session key and transmit the same to the new part. 
     Also, when the maintenance terminal  130  transmits a part replacement completion message to the terminal  120  of the vehicle owner after completion of the authentication process, the terminal  120  of the vehicle owner requests an integrity check result from each of the vehicle  110  and the vehicle manufacturer server  140 , thereby checking whether the vehicle part replacement has been performed normally. 
     Here, the terminal  120  of the vehicle owner may perform the integrity check by comparing a first integrity value received from the vehicle  110  with a second integrity value received from the vehicle manufacturer server  140 . 
     Here, the first integrity value may be acquired in a manner in which the terminal  120  of the vehicle owner again requests the vehicle diagnosis module to perform vehicle self-diagnosis after it receives the part replacement completion message. 
     Here, the second integrity value may be acquired in a manner in which the terminal  120  of the vehicle owner requests the result of authentication of the new part from the vehicle manufacturer server  140  after it receives the part replacement completion message. 
     Through the above-described process, the vehicle part may be more securely replaced. 
       FIG. 3  is a flowchart illustrating a method for replacing vehicle parts according to an embodiment of the present invention. 
     Referring to  FIG. 3 , in the method for replacing vehicle parts according to an embodiment of the present invention, a vehicle diagnosis module included in a vehicle performs vehicle self-diagnosis in response to a request made through the terminal of a vehicle owner at step S 310 . 
     For example, describing this process with reference to a specific vehicle part replacement process illustrated in  FIG. 4 , a vehicle owner may request a vehicle  410  to perform vehicle self-diagnosis through the terminal  420  of the vehicle owner at step S 402  when a problem occurs in the vehicle during driving. Then, the vehicle  410  may perform self-diagnosis at step S 404 , and may return the result of the vehicle self-diagnosis to the terminal  420  of the vehicle owner at step S 406 . 
     Also, although not illustrated in  FIG. 3 , in the method for replacing vehicle parts according to an embodiment of the present invention, the vehicle may register at least one domain gateway included in the vehicle in a vehicle manufacturer server. 
     Here, the vehicle may transmit the public key and signature value of each of the at least one domain gateway to the vehicle manufacturer server. 
     Here, the vehicle manufacturer server may authenticate the at least one domain gateway based on the signature value thereof, and may transmit a session key encrypted with the public key of the at least one domain gateway to the vehicle when authentication is completed. 
     Here, the vehicle may decrypt the session key and store the same, and may request and receive security policies from the vehicle manufacturer server. 
     Hereinafter, the process of certifying the domain gateway 1   520  of a vehicle and registering the same in a vehicle manufacturer server  510  when a vehicle manufacturer produces the vehicle using the domain gateway 1   520  will be described in detail with reference to  FIG. 5 . 
     Here, the domain gateway 1   520  is a vehicle part constituting the vehicle, and may be a product produced by the vehicle manufacturer or a third-party vehicle part manufacturer. Generally, a method in which the third-party vehicle part manufacturer supplies vehicle parts to the vehicle manufacturer is used. Accordingly, when the domain gateway 1   520 , which is a kind of vehicle part, is produced, public/private keys may be generated and embedded therein, and the digital signature value of the vehicle manufacturer for the public key may also be embedded therein. Here, the digital signature value embedded in the domain gateway 1   520  may be used as authentication information for certification and registration when the vehicle manufacturer intends to use the required vehicle part in the process of manufacturing a vehicle. 
     Also, before the process of manufacturing a vehicle, the vehicle manufacturer server  510  may store information about a domain gateway capable of being registered in the corresponding vehicle and ECUs capable of being registered in the domain gateway, and the vehicle manufacturer server  510  may include the function of a key management server by storing the public/private keys. 
     Here, in addition to the vehicle manufacturer server  520 , the domain gateway 1   520  may securely store the private key using a hardware security module or a secure storage area, and may manage the private key so as to be prevented from being exposed outside. 
     Based on this process, the domain gateway 1   520  may request authentication thereof from the vehicle manufacturer server  510  using the unique identification value DG 1 _ID thereof at step S 502  in order to check whether registration thereof is possible. 
     Here, upon receiving an authentication request message for registration of the domain gateway 1   520 , the vehicle manufacturer server  510  checks DG 1 _ID, which is the unique identification value, at step S 504 , thereby checking whether the domain gateway 1   520  is capable of being registered. 
     Then, when it is determined that the domain gateway 1   520  is capable of being registered, the vehicle manufacturer server  510  may request authentication information corresponding to DG 1 _ID (that is, the public key of the domain gateway 1  DG 1  and the signature value of the vehicle manufacturer) from the domain gateway 1   520  at step S 506 . 
     Then, when the domain gateway 1   520  transmits the authentication information (the public key of DG 1  and the signature value of the vehicle manufacturer) to the vehicle manufacturer server  510  at step S 508 , the vehicle manufacturer server  510  may certify the domain gateway 1  through signature verification at step S 510 , and may generate a session key between the vehicle manufacturer and the domain gateway DG 1  using DG 1 _ID information at step S 512 . 
     Then, the vehicle manufacturer server  510  may encrypt the generated session key with the public key of the domain gateway 1   520  and transmit the same to the domain gateway 1   520  at step S 514 . 
     Then, the domain gateway 1   520  may decrypt the encrypted session key with the private key thereof and check the same at step S 516 . 
     Then, after it checks the session key, the domain gateway 1   520  may request the security policies to process (ECU IDs capable of being registered in DG 1 , the ID of the message to process, an access control policy, and the like) from the vehicle manufacturer server  510  at step S 518 . 
     Then, the vehicle manufacturer server  510  may encrypt the security policies to transmit to the domain gateway 1   520  using the generated session key and transmit the same at step S 520 . 
     Upon receiving the message transmitted after being encrypted, the domain gateway 1   520  may decrypt the encrypted message with the session key at step S 522 , may check the security policies to process, and may transmit a message announcing completion of authentication of DG 1  to the vehicle manufacturer server  510  at step S 524 . 
     Here, upon receiving the authentication completion message, the vehicle manufacturer server  510  may calculate an integrity value using DG 1 _ID and securely store the same in the hardware security module or secure storage area at step S 526 . 
     Here, the integrity value may be calculated as a hash value using DG 1 _ID (Hash (DG 1 _ID)). 
     Also, in the method for replacing vehicle parts according to an embodiment of the present invention, when a vehicle part is replaced depending on the vehicle self-diagnosis result based on the vehicle part replacement agreement procedure between the terminal of the vehicle owner and the maintenance terminal of the vehicle maintenance company, the vehicle and the vehicle manufacturer server perform the process of authenticating a new part with which the vehicle part is replaced at step S 320 . 
     For example, describing this process with reference to  FIG. 4 , a vehicle owner may transmit a request for repair and maintenance of the vehicle  410  to the maintenance terminal  430  of the vehicle maintenance company at step S 408  when a fault in a vehicle part, such as an ECU, is confirmed as the result of the vehicle self-diagnosis. 
     Here, the vehicle part replacement agreement procedure may include a process in which the maintenance terminal requests the vehicle diagnosis module to carefully inspect the vehicle in response to a request from the terminal of the vehicle owner for inspection of the vehicle and a process in which the maintenance terminal asks the terminal of the vehicle owner whether to replace the vehicle part depending on the result of careful inspection of the vehicle. 
     For example, describing the same with reference to  FIG. 4 , the maintenance terminal  430  of the vehicle maintenance company may request the vehicle diagnosis module included in the vehicle  410  to carefully inspect the vehicle at step S 410 . Then, whether the vehicle part is actually defective may be checked by receiving the vehicle inspection result from the vehicle  410 . Then, when a fault in the vehicle part is confirmed as checked through the vehicle self-diagnosis result, the maintenance terminal  430  may ask the vehicle owner whether to replace the defective vehicle part (ECU) by transmitting the vehicle inspection result to the vehicle owner through the terminal  420  of the vehicle owner at step S 414 . Then, the maintenance terminal  430  receives consent to the replacement of the vehicle part from the terminal  420  of the vehicle owner at step S 416 , and may replace the part (ECU) of the vehicle  410  at step S 418 . 
     Here, the vehicle maintenance company, which serves to replace the vehicle part, does not have to be additionally concerned with the process of replacing the defective vehicle part with a new part. That is, the vehicle maintenance company only has to connect the new ECU, to which the vehicle owner gives consent, with the vehicle in a hardware manner in place of the defective ECU, and the ECU replacement process may be performed through the authentication process (S 420  and S 422 ) between the vehicle  410  and the vehicle manufacturer server  440 . Here, the vehicle maintenance company only needs to check the result. 
     Here, the existing ECU installed in the vehicle is installed after being authenticated and registered in the domain gateway in the process of manufacturing the vehicle, and this process will be described in detail with reference to  FIG. 6 . 
     For example, because an ECU 10   630  is the ECU to be registered in a domain gateway 1   620  during a vehicle-manufacturing process, DG 1 _ID and ECU 10 _ID of the ECU 10   630  are transmitted to a vehicle manufacturer server  610  in order to authenticate the ECU 10   630  and register the same in the domain gateway 1   620 , whereby registration of the ECU 10   630  in the domain gateway 1   620  may be requested at step S 602 . 
     Here, the domain gateway 1   620  and the ECU 10   630  are vehicle parts constituting the vehicle, and may be products produced by the vehicle manufacturer or a third-party vehicle part manufacturer. Accordingly, when the domain gateway 1   620  or the ECU 10   630 , which are kinds of vehicle parts, is produced, public/private keys of each of the domain gateway 1  and the ECU 10  may be generated and embedded therein, and the digital signature value (OEM signature value) of the vehicle manufacturer for the public key may also be embedded. Here, the digital signature value embedded in each of the domain gateway 1   620  and the ECU 10   630  may be used as authentication information for certification and registration when the vehicle manufacturer intends to use the required vehicle part in the vehicle-manufacturing process. 
     Then, the vehicle manufacturer server  610  may check whether the ECU 10   630  is capable of being registered at step S 604  by checking the received ECU 10 _ID, and may request authentication information corresponding to the ECU 10 _ID (the public key of the ECU 10  and the signature value of the vehicle manufacturer) from the ECU 10   630  at step S 606  when it is determined that registration of the ECU 10  is possible. 
     Then, the vehicle manufacturer server  610  may receive the authentication information (the public key of the ECU 10  and the signature value of the vehicle manufacturer) from the ECU 10   630  at step S 608 , and may certify the ECU 10   630  through signature verification at step S 610 . 
     Then, the vehicle manufacturer server  610  may encrypt the ECU 10 _ID information with the session key shared with the domain gateway 1   620  and transmit the same to the domain gateway 1   620  along with the public key of the ECU 10   630  at step S 612 . 
     Then, the domain gateway 1   620  may check the ECU 10 _ID, which is decrypted using the session key, and may update the session key using the checked information, thereby generating an initial session key for the ECU 10   630  at step S 614 . 
     Here, the initial session key may be alternatively generated using information about all of the registered ECUs after all of the ECUs to be registered in the domain gateway 1   620  have been registered therein. That is, all of the ECUs connected with the domain gateway 1   620  are forced to use the same session key, whereby the key management burden imposed on the domain gateway 1   620  may be reduced. 
     The initial session key generated as described above may be encrypted with the public key of the ECU 10   630  that made the request for registration thereof, and may be transmitted to the ECU 10   630  at step S 616 . 
     Then, the ECU 10   630  may decrypt the session key, which is encrypted with the public key thereof, with the private key thereof, thereby checking the session key at step S 618 . 
     Then, after it checks the session key, the ECU 10   630  may request security policies (the ID of the message to process, an access control policy, and the like) from the domain gateway 1   620  at step S 620 , and the domain gateway 1   620  may encrypt the security policies to be processed by the ECU 10   630  with the generated initial session key and transmit the same to the ECU 10  at step S 622 . 
     Then, the ECU 10   630  may decrypt the encrypted message with the previously received initial session key, and may check and apply the security policies to be processed thereby at step S 624 . 
     Then, when the ECU 10   630  transmits a registration completion message to the domain gateway 1   620  at step S 626 , the domain gateway 1   620  may receive the registration completion message, calculate an integrity value (hash value) based on the priority of the ECU_ID registered in the domain gateway 1   620 , and store the same at step S 628 . 
     Here, the integrity value may be calculated as a hash value using the DG 1 _ID (Hash (DG 1 _ID)) and a hash value using the ECU 10 _ID (Hash (Hash (DG 1 _ID)∥ECU 10 _ID)). 
     Then, the domain gateway 1   620  may transmit a message announcing completion of registration of the ECU 10  to the vehicle manufacturer server  610  at step S 630 . 
     Here, upon receiving the registration completion message, the vehicle manufacturer server  610  may calculate an integrity value (hash value) using the same method as in the domain gateway 1   620  and store the same, thereby completing registration of the ECU 10   630  in the domain gateway 1   620 . 
     Also, in the present invention, a new part may be authenticated and registered in the domain gateway through a vehicle part replacement process. 
     Here, the vehicle may transmit the public key and signature value of the new part to the vehicle manufacturer server. 
     Here, the vehicle manufacturer server may authenticate the new part based on the signature value thereof. 
     Here, the vehicle manufacturer server may encrypt the identification information of the new part with a session key and transmit the same to the vehicle along with the public key of the new part. 
     Here, the vehicle may update the session key based on the identification information of the new part, encrypt the updated session key with the public key of the new part, and transmit the same to the new part. 
     Here, the vehicle may encrypt the security policies stored in the at least one domain gateway with the updated session key and transmit the same to the new part. 
     Hereinafter, this process will be described in detail with reference to  FIG. 7 . 
     Here, the ECU 20   730  illustrated in  FIG. 7  is the new ECU to be registered as the ECU to replace the ECU 10 , which has been registered in the domain gateway 1   720  in the vehicle-manufacturing process as described with reference to  FIG. 6 . 
     Here, the domain gateway 1   720  and the ECU 20   730  are vehicle parts constituting a vehicle, and may be products produced by a vehicle manufacturer or a third-party vehicle part manufacturer. Therefore, when the domain gateway 1  or the ECU 20   730 , which are vehicle parts, is produced, public/private keys for each of the domain gateway 1  and the ECU 20  may be generated and embedded therein, and a digital signature value (OEM signature value) of the vehicle manufacturer for the public key may also be embedded. Here, the digital signature value embedded in each of the domain gateway 1   720  and the ECU 20   730  may be used as authentication information for certification and registration when the vehicle manufacturer intends to use the required vehicle part in the vehicle-manufacturing process. 
     Here, the ECU 20   730  transmits identification information DG 1 _ID of the domain gateway 1   720 , information (ECU 10 _ID) about the ECU 10  that is required to be replaced, and information (ECU 20 _ID) about the ECU 20 , which is a new part to replace the ECU 10 , to the vehicle manufacturer server  710 , thereby requesting registration of the new ECU so as to replace the ECU registered in the domain gateway 1   720  at step S 702 . 
     Then, the vehicle manufacturer server  710  may check whether the ECU 20   730  is capable of being registered at step S 704  by checking the ECU 20 _ID, and may request authentication information corresponding to the ECU 20 _ID (the public key of the ECU 20  and the signature value of the vehicle manufacturer) at step S 706  when it is determined that registration of the ECU 20  is possible. 
     Here, when the ECU 20   730  transmits the authentication information (the public key of the ECU 20  and the signature value of the vehicle manufacturer) to the vehicle manufacturer server  710  at step S 708 , the vehicle manufacturer server  710  may certify the ECU 20   730  through signature verification at step S 710 . 
     Then, the vehicle manufacturer server  710  may encrypt information corresponding to ECU 10 _ID∥ECU 20 _ID using the session key shared with the domain gateway 1   720  and transmit the same to the domain gateway 1   720  along with the public key of the ECU 20   730  at step S 712 . 
     Then, the domain gateway 1   720  may check the ECU 20 _ID of the ECU that requests registration thereof so as to replace the old ECU by performing decryption with the session key, and may update the session key using the checked ECU 20 _ID at step S 714 . 
     Here, the session key may be alternatively updated using information about all of the ECUs that have been registered in the domain gateway 1   720 , including the ECU 20   730  newly registered in the domain gateway 1   720  through replacement. Through this process, all of the ECUs connected with the domain gateway 1   720  are forced to use the same new session key, whereby the key management burden imposed on the domain gateway 1   720  and a security threat of leakage of the existing session key may be reduced. 
     Then, the domain gateway 1   720  may encrypt the updated session key with the public key of the ECU 20   730  and transmit the same to the ECU 20   730  at step S 716 . 
     Then, the ECU 20   730  may decrypt the encrypted session key with the private key thereof, thereby checking the updated session key at step S 718 . 
     Then, after it checks the updated session key, the ECU 20   730  may request security policies (the ID of the message to process, an access control policy, and the like) from the domain gateway 1   720  at step S 720 . 
     Then, the domain gateway 1   720  may encrypt the security policies to be processed by the ECU 20   730  with the updated new session key and transmit the same to the ECU 20   730  at step S 722 . 
     Then, the ECU 20   730  may decrypt the encrypted message with the updated session key received from the domain gateway 1   720  at step S 724 , thereby checking and applying the security policies to be processed by the ECU 20   730 . 
     Then, the ECU 20   730  may transmit a replacement registration completion message, announcing completion of registration for replacement with the ECU 20 , to the domain gateway 1   720  at step S 726 . 
     Then, after it receives the replacement registration completion message, the domain gateway 1   720  may calculate an integrity value (hash value) based on the priority of the ECU_ID registered in the domain gateway 1   720  and store the same at step S 728 . 
     Here, the integrity value may be calculated as a hash value using the DG 1 _ID (Hash (DG 1 _ID)), a hash value using the ECU 10 _ID (Hash (Hash (DG 1 _ID)∥ECU 10 _ID)), and a hash value using the ECU 20 _ID (Hash (Hash (Hash (DG 1 _ID)∥ECU 10 _ID)∥ECU 20 _ID)). 
     Then, the domain gateway 1   720  may transmit the message announcing completion of registration of the ECU 20  to the vehicle manufacturer server  710  at step S 730 . 
     Here, upon receiving the message announcing completion of registration of the ECU 20 , the vehicle manufacturer server  710  may calculate an integrity value (hash value) using the same method as in the domain gateway 1   720  and store the same, thereby completing registration of the ECU 20  in the domain gateway 1   720  for replacement. 
     Also, in the method for replacing vehicle parts according to an embodiment of the present invention, when the maintenance terminal transmits a part replacement completion message to the terminal of the vehicle owner after completion of the authentication process, the terminal of the vehicle owner requests an integrity check result from each of the vehicle and the vehicle manufacturer server, thereby checking whether replacement of the vehicle part is performed normally at step S 330 . 
     For example, describing this process with reference to  FIG. 4 , when replacement with the ECU, corresponding to a new part, has been completed normally in the vehicle  410  at step S 424 , the maintenance terminal  430  may transmit a part replacement completion message (ECU replacement completion message) to the terminal  420  of the vehicle owner at step S 426 . 
     Here, the vehicle maintenance company may check once more whether the vehicle  410  is in a normal state by carefully inspecting the vehicle again, and may then transmit the ECU replacement completion message to the vehicle owner. 
     Here, the terminal of the vehicle owner may perform the integrity check by comparing a first integrity value received from the vehicle with a second integrity value received from the vehicle manufacturer server. 
     Here, the first integrity value may be acquired in such a way that the terminal of the vehicle owner again requests the vehicle diagnosis module to perform vehicle self-diagnosis after it receives the part replacement completion message. 
     For example, describing this process with reference to  FIG. 4 , after it receives the ECU replacement completion message from the maintenance terminal  430  of the vehicle maintenance company, the terminal  420  of the vehicle owner may again request the vehicle  410  to perform vehicle self-diagnosis at step S 428 . Then, the terminal  420  of the vehicle owner may receive the integrity value, generated through the vehicle self-diagnosis performed by the vehicle  410 , along with the result of the vehicle self-diagnosis at steps S 430  and S 432 . 
     Here, the second integrity value may be acquired in such a way that the terminal of the vehicle owner requests the result of authentication of the new part from the vehicle manufacturer server after it receives the part replacement completion message. 
     For example, describing this process with reference to  FIG. 4 , the terminal  420  of the vehicle owner may request confirmation of ECU replacement from the vehicle manufacturer server  440  at step S 434 , and may receive the integrity value generated after replacement of the ECU from the vehicle manufacturer server  440  at step S 436 . 
     Accordingly, when the integrity value received from the vehicle  410  through the terminal  420  of the vehicle owner and the integrity value received from the vehicle manufacturer server  440  through the terminal  420  of the vehicle owner are the same as each other, the vehicle owner may confirm that the ECU has been securely replaced with a certified ECU. If the two integrity values received from the vehicle  410  and the vehicle manufacturer server  440  are different from each other, it may be confirmed that the new ECU is not a genuine product but an uncertified ECU. 
     Using the above-described vehicle part replacement method, maintenance of a vehicle and replacement of vehicle parts may be more securely performed, and there is an effect of assuredly preventing an uncertified vehicle part from being connected with the vehicle. 
     Also, the vehicle domain gateway is forced to manage security policies for different ECUs connected with the same domain, whereby the load imposed when all of vehicle parts (ECUs) have to be connected with the vehicle manufacturer server may be minimized. 
     Also, because the ECUs connected with the same domain in the vehicle are forced to use the same session key (secret key), there is an effect of minimizing the burden of the vehicle domain gateway that manages keys for all of the ECUs connected with the same domain. 
     Also, the session key used for communication with the ECUs connected with the domain is based on the initial session key that is generated when an ECU is registered or when an ECU is registered for replacement, but each time communication is required, a newly updated session key is used, whereby a secure communication channel may be provided in the vehicle. 
       FIG. 8  is a view illustrating a system for replacing vehicle parts according to another embodiment of the present invention. 
     Referring to  FIG. 8 , the system for replacing vehicle parts according to another embodiment of the present invention includes a vehicle  810 , a display terminal  820  in the vehicle, which takes the role of the vehicle owner&#39;s terminal  120  illustrated in  FIG. 1 , a maintenance terminal  830 , and a vehicle manufacturer server  840 . 
     Here, the system for replacing vehicle parts illustrated in  FIG. 8  may provide a vehicle self-diagnosis result, the result of replacement of a vehicle part, or the result of vehicle repair and maintenance to the vehicle owner using the display terminal  820  in the vehicle, rather than using the vehicle owner&#39;s terminal in the form of a mobile terminal in  FIG. 1 . 
     Here, the system structure illustrated in  FIG. 8  includes the display terminal  820  in the vehicle, which can be provided separately from the vehicle owner&#39;s terminal  120  illustrated in  FIG. 1 , when it is assumed that the vehicle owner is inside the vehicle  810 , and the display terminal  820  may be, for example, a display device built into the vehicle, such as a digital cluster, a head unit, an infotainment device, or the like. 
     For example, the display terminal  820  in the vehicle may be supplied with power from the vehicle  810 , and may communicate with the vehicle  810 , the maintenance terminal  830 , and the vehicle manufacturer server  840  using an in-vehicle network of the vehicle  810  or a network  850  outside the vehicle  810 . 
     That is, even though the vehicle owner does not use a separate mobile terminal, the vehicle owner may request vehicle self-diagnosis by manipulating the display terminal  820  provided in the vehicle  810 , and may check the diagnosis result or the result of vehicle part replacement or vehicle repair and maintenance using the display terminal  820 . 
     According to the present invention, a system for more securely repairing a vehicle and replacing vehicle parts may be provided by applying IT technology to a process in which a vehicle maintenance company carefully inspects and repairs the vehicle. 
     Also, the present invention prevents installation of an uncertified part in a vehicle through the process of registering a certified genuine part, which is performed between a vehicle manufacturer and a vehicle part manufacturer, thereby fundamentally preventing the uncertified vehicle part from being connected with the vehicle. 
     Also, the present invention may provide a vehicle part replacement method that can be trusted by a vehicle owner by enabling the vehicle owner to check information about a new vehicle part (ECU), with which an old vehicle part is replaced, and to additionally check the result of replacement. 
     Also, the present invention may minimize a key management burden imposed on a domain gateway by forcing ECUs connected with the same domain in a vehicle to use the same session key (secret key). 
     Also, the present invention may construct a secure communication channel in a vehicle using a session key that is based on an initial session key and is updated each time communication is required, the initial session key being generated when an ECU is registered or when a new ECU to replace an old ECU is registered. 
     As described above, the method for replacing vehicle parts using an in-vehicle network based on an automotive Ethernet and system therefor according to the present invention are not limitedly applied to the configurations and operations of the above-described embodiments, but all or some of the embodiments may be selectively combined and configured, so the embodiments may be modified in various ways.