Information processing apparatus, method, and system

Abstract

The present disclosure provides an information processing device, method, and system capable of determining a current owner of the information processing device by a server providing a predetermined service. An information processing device is provided with: an eUICC that holds first profile information used in connection to a first communication system; and a control unit that executes an operation of connecting to the first communication system using the first profile information. The control unit further performs: a first electronic certificate for obtaining, from a predetermined authentication bureau, first authentication information used for authentication performed by the first server and proving the first authentication information as information of a first owner; storing the first authentication information and the first electronic certificate in the eUICC; the authentication performed by the first server is accepted using the first authentication information and the first electronic certificate. A default profile is stored in the eUICC, and the information processing apparatus uses the default profile to connect to the first communication system during a period when the information processing apparatus is sold in a new product or in a second-hand manner.

Description

Technical Field

[0001] The present disclosure relates to wireless communication using a SIM in a terminal. Background Art

[0002] Currently, a technology is disclosed, that is, an operational profile including settings for connecting to a first wireless communication network, a bootstrap profile for connecting to a second wireless communication network, and an applet are maintained in a UICC (Universal Integrated Circuit Card), and when the applet uses the operational profile to connect to the first wireless communication network, if loss of operational connectivity with the first wireless communication network is detected, the applet uses the bootstrap profile to connect to the second wireless communication network, thereby reestablishing wireless communication with a host device. (For example, Patent Document 1).

[0003] Prior Art Literature

[0004] Patent Literature

[0005] Patent Document 1: Japanese Patent Application Publication No. 2023-515277 Summary of the invention

[0006] Problems to be solved by the invention

[0007] An object of one disclosed aspect is to provide an information processing device, method, and system capable of identifying the current owner of the information processing device by a server providing a predetermined service.

[0008] Methods for solving problems

[0009] One aspect of the present disclosure is an information processing device comprising:

[0010] An embedded universal integrated circuit card that stores first profile information used in connection to a first communication system and in which a correspondence relationship is established with a first owner of the information processing device;

[0011] a control unit configured to execute an operation of connecting to the first communication system using the first profile information,

[0012] The control unit also performs the following operations, namely:

[0013] Obtaining a first electronic certificate from a predetermined certification authority, the first electronic certificate being an electronic certificate that proves that first authentication information corresponding to the first profile information used in authentication performed by a first server trusted by the first communication system is information of the first owner;

[0014] storing the first authentication information and the first electronic certificate in the embedded universal integrated circuit card; and

[0015] The first server performs authentication using the first authentication information and the first electronic certificate.

[0016] Another aspect of the present disclosure is a method, which is executed by a computer having an embedded universal integrated circuit card that stores first profile information, the first profile information being information used in connection with a first communication system and associated with a first owner of an information processing device,

[0017] The computer performs the following operations, namely:

[0018] connecting to the first communication system using the first profile information;

[0019] Obtaining a first electronic certificate from a predetermined certification authority, the first electronic certificate being an electronic certificate that proves that first authentication information corresponding to the first profile information used in authentication performed by a first server trusted by the first communication system is information of the first owner;

[0020] storing the first authentication information and the first electronic certificate in the embedded universal integrated circuit card; and

[0021] The first server performs authentication using the first authentication information and the first electronic certificate.

[0022] Another aspect of the present disclosure is an information processing device comprising:

[0023] An embedded universal integrated circuit card capable of maintaining a plurality of profile information used in connection to a communication network;

[0024] a control unit configured to set any one of the plurality of profile information to an effective state and connect to the communication network using the effective profile information,

[0025] In the information processing device,

[0026] The embedded universal integrated circuit card stores default profile information used in connection with the first communication system and set with content of charging communication fees to a predetermined operator when the information processing device is shipped from the factory.

[0027] The control unit performs the following operations, namely:

[0028] When the information processing device is shipped from a factory, the default profile information is set to a valid state, and the default profile information is used to connect to the first communication system.

[0029] When first profile information corresponding to a first owner of the information processing device is stored in the embedded universal integrated circuit card, the default profile information is invalidated, the first profile information is set to a valid state, and the first profile information is used to connect to the first communication system.

[0030] Effects of the Invention

[0031] According to one aspect of the present disclosure, the current owner of the information processing device can be identified by a server that provides a predetermined service. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 This is a diagram showing an example of service provision to the vehicle according to the first embodiment.

[0033] Figure 2 A diagram showing an example of the hardware structure of a DCM.

[0034] Figure 3 This is an example of the functional structure of DCM.

[0035] Figure 4 A diagram showing an example of the hardware configuration of an information processing device.

[0036] Figure 5 A diagram showing an example of the functional structure of an HSS.

[0037] Figure 6 This is a diagram showing an example of information stored in a subscriber information database.

[0038] Figure 7 A diagram showing an example of information stored in a terminal connection information database.

[0039] Figure 8 A diagram showing an example of a functional structure of a server.

[0040] Fig. 9The following is an example of a flowchart of the download process of the profile information executed by the DCM.

[0041] Fig.10 This is an example of a flowchart of the process of validating or invalidating a configuration file executed by the DCM.

[0042] Fig.11 This is an example of a flowchart of the process of obtaining the identity verification certificate executed by the DCM.

[0043] Fig.12 This is a diagram showing an example of a processing sequence until the DCM acquires the owner profile and connects to the communication system.

[0044] Fig.13 This is a diagram showing an example of a processing sequence until a DCM obtains a user identification certificate and accesses a server.

[0045] Fig.14 This is a diagram showing an example of transition of profile information used in a vehicle. DETAILED DESCRIPTION

[0046] When purchasing a vehicle, in order to confirm the identity of the new owner of the vehicle, a seal certificate or the like is required. Instead of a seal certificate, an electronic certificate of a personal number card can be used. Based on such an identity confirmation document, a predetermined certification authority (CA: Certificate Authority or Certification Authority) will establish an association between the vehicle and the owner after review, and issue an electronic certificate indicating that the owner of the vehicle is the real owner. The electronic certificate will be stored in a vehicle-mounted device installed in a vehicle with communication functions such as a connected vehicle, and used in the authentication implemented by the electronic certificate when receiving services for the vehicle.

[0047] In many cases, the electronic certificate proving the owner of the vehicle is stored in a secure storage area of ​​the vehicle-mounted device, and in this case, it cannot be rewritten. The vehicle may be sold as a second-hand vehicle, and the owner may change. However, since the electronic certificate proving the owner stored in the secure storage area of ​​the vehicle-mounted device cannot be rewritten, the electronic certificate of the original owner will be maintained even if the owner of the vehicle changes. Therefore, on the side providing services to the vehicle, even if the owner of the vehicle has changed from the original owner, the current owner cannot be determined, and services corresponding to the current owner cannot be provided.

[0048] In one embodiment of the present disclosure, in view of the above-mentioned problem, an electronic certificate that proves the identity of the owner is kept in the eUICC (Embedded Universal Integrated Circuit Card) of the information processing device. As a result, the electronic certificate that proves the identity can be rewritten, and the service provider that uses the electronic certificate to implement authentication can determine the current owner of the information processing device.

[0049] More specifically, one embodiment of the present disclosure is an information processing device, the information processing device comprising: an embedded universal integrated circuit card, which stores first profile information used in connection with a first communication system and corresponding to a first owner of the information processing device; and a control unit, which performs an operation of connecting to the first communication system using the first profile information. The control unit obtains a first electronic certificate from a predetermined certification authority, the first electronic certificate being an electronic certificate that proves that the first authentication information corresponding to the first profile information used in authentication performed by a first server trusted by the first communication system is information of the first owner. The control unit stores the first authentication information and the first electronic certificate in an eUICC. The control unit accepts authentication performed by the first server using the first authentication information and the first electronic certificate.

[0050] Information processing devices include, for example, vehicle-mounted devices, smart phones, tablet terminals, wearable terminals, IoT terminals, and terminals capable of wireless communication based on mobile communication methods. Vehicle-mounted devices include, for example, DCM (Data Communication Module), car navigation devices, driving recorders, and ECU (Electronic Control Unit). Control units include, for example, CPU (Central Processing Unit), DSP (Digital Signal Processor), data communication processors and other processors, and FPGA (Field-Programmable Gate Array) and other circuits.

[0051] The first communication system is, for example, a mobile communication method after 4G (LTE-Advanced), 5G, and 6G, and a wireless communication system such as 3G that requires the terminal to have an eUICC. The eUICC can be a chip type or a card type. The authentication information is, for example, key information such as a public key. The first server trusted by the first communication system can be a server within the first communication system or a server outside the first communication system. The first communication system can be a system managed by a manufacturer of an information processing device or a device equipped with an information processing device, or a communication system of an operator that issues profile information stored in the eUICC.

[0052] Since the first profile information corresponds to the first owner, when the owner of the information processing device changes, the profile information will also change. Since the first authentication information corresponds to the first profile information, when the profile information changes, the authentication information will also change. Since the first electronic certificate is issued for the first authentication information, when the authentication information changes, the electronic certificate will also change. That is, when the owner changes, the electronic certificate will also change. In one embodiment of the present disclosure, by making the eUICC that can rewrite data maintain the electronic certificate confirmed by the owner, the electronic certificate can be rewritten together with the change of the owner of the information processing device. As a result, the service provider who uses the electronic certificate confirmed by the owner to implement authentication can correctly determine the current owner of the information processing device.

[0053] In one embodiment of the present disclosure, the information processing device may also maintain a small application, and the small application uses the first profile information as a key to generate the first authentication information. The control unit may also start the small application and generate the first authentication information. As a result, the electronic certificate confirmed by the user will be required to be changed in conjunction with the change of the profile information. In addition to the change of the owner of the information processing device, when the profile information is updated due to, for example, vulnerability issues, the first authentication information can also be updated, so that security can be maintained.

[0054] In addition, the control unit may also obtain the first profile information and the applet from the second server that manages the profile information, and store the first profile information and the applet in the eUICC. The second server is, for example, an SM-DP+ (Subscription Manager Data Preparation+) server when the first communication system is a system corresponding to LTE (Long Term Evolution). Thus, the applet can also be rewritten remotely in the same manner as the profile information.

[0055] In addition, the control unit may also obtain at least the updated applet from the second server and store it in the eUICC when the applet is updated. The control unit may also start the updated applet, regenerate the first authentication information, obtain the electronic certificate from a predetermined certification authority (CA) for the regenerated first authentication information, and store the regenerated first authentication information and the re-obtained electronic certificate in the eUICC. Thus, for example, in the case where the vulnerability of the electronic certificate is weakened, the applet can be updated by updating the generation algorithm of the first authentication information, so that the first authentication information and the electronic certificate can be updated.

[0056] In one embodiment of the present disclosure, the control unit may also obtain a second electronic certificate from a predetermined certification authority when the second profile information corresponding to the second owner and maintained in the eUICC is set to a valid state. The second electronic certificate is an electronic certificate that proves that the second authentication information corresponding to the second profile information is the information of the second owner. The control unit may also store the second authentication information and the second electronic certificate in the eUICC, and accept the authentication performed by the first server using the second authentication information and the second electronic certificate. At this time, the first profile information and the first electronic certificate are invalidated or deleted. Thus, for example, when the owner of the information processing device changes from the first owner to the second owner, it is possible to suppress the first server from confusing the first owner (previous owner) with the second owner (current owner).

[0057] In vehicles that can communicate, such as connected vehicles, various data such as vehicle status and driving data are collected by the vehicle's manufacturing business. However, a vehicle becomes communicative after it is purchased and a contract is concluded between the purchaser (owner) and the carrier network, etc. Since the vehicle is not communicative from the time it is shipped from the factory to the time it is purchased, information on the vehicle cannot be collected.

[0058] In one embodiment of the present disclosure, in view of the above-mentioned problem, the eUICC of the information processing device is made to store the default profile information in such a manner that the information processing device is in a communicable state when shipped from the factory. As a result, the information processing device is in a communicable state during the period from when the information processing device is shipped from the factory to when it is purchased. For example, a manufacturing business of the information processing device or a device equipped with the information processing device can also collect information of the information processing device during the period from when the information processing device is shipped from the factory to when it is purchased.

[0059] More specifically, one embodiment of the present disclosure is an information processing device, which includes: an eUICC capable of maintaining multiple profile information used in connection to a communication network; and a control unit that performs the following operation, namely, setting any one of the multiple profile information to a valid state and using the validated profile information to connect to the communication network. The eUICC maintains default profile information used in connection to a first communication system when the information processing device is shipped from a factory. The control unit sets the default profile information to a valid state when the information processing device is shipped from a factory, and uses the default profile information to connect to the first communication system. When the first profile information corresponding to the first owner of the information processing device is stored in the eUICC, the control unit invalidates the default profile information, sets the first profile information to a valid state, and uses the first profile information to connect to the first communication system.

[0060] The information processing device is, for example, a vehicle-mounted device mounted on a vehicle, a smart phone, a tablet terminal, a wearable terminal, an IoT terminal, and a terminal capable of wireless communication based on a mobile communication method. The vehicle-mounted device is, for example, a DCM, a car navigation device, a driving recorder, and an ECU. The control unit is, for example, a processor such as a CPU, a DSP, and a data communication processor, and a circuit such as an FPGA. The first communication system is, for example, a mobile communication method after 4G, 5G, and 6G, and a wireless communication system such as 3G that sets eUICC as a necessary condition for the terminal. The first communication system can be a system managed by a manufacturer of an information processing device or a device equipped with an information processing device, or a communication system of an operator that issues profile information maintained in an eUICC.

[0061] According to one embodiment of the present disclosure, the information processing device can be connected to the first communication system by using the default profile information from the time the device is shipped from the factory until the device is purchased and the owner is determined. Thus, the first communication system can also collect information related to the information processing device from the time the device is shipped from the factory until the device is purchased.

[0062] In one embodiment of the present disclosure, the default profile information may include a setting for collecting communication fees from a predetermined operator. In the default profile information, the predetermined operator set as the collection target is an operator that collects information related to the information processing device. The predetermined operator is, for example, an administrator of the first communication system (a manufacturer of information processing devices, a manufacturer of devices that carry information processing devices on vehicles, etc., and an operator that issues profile information), and an operator that entrusts the administrator of the first communication system with the collection of information related to the information processing device.

[0063] According to one aspect of the present disclosure, since the communication fee for the communication performed by connecting to the first communication system using the default profile information from the time of factory shipment to the time of purchase is not charged to the owner, the owner can be relieved of the burden of the communication fee. In addition, since the default profile information is invalidated after the owner of the information processing device makes a decision, the predetermined carrier does not need to bear the communication fee after the owner makes a decision.

[0064] In one embodiment of the present disclosure, the control unit may also invalidate or delete the first profile information, set the default profile information to a valid state, and connect to the first communication system using the default profile information when the information processing device is sold second-hand by a predetermined second-hand sales business. Thus, for example, while the information processing device is being sold second-hand, the information processing device is also in a communicable state, so that information related to the information processing device can be collected.

[0065] As another aspect of the present disclosure, a system can be cited, which includes: the above-mentioned information processing device; and a third server that stores information indicating whether the profile information used in the connection to the first communication system implemented by the information processing device is the default profile information. When the first communication system is a system corresponding to 4G, the third server is, for example, an HSS (Home Subscriber Server).

[0066] According to one aspect of the present disclosure, it is possible to determine whether the information processing device is being sold based on information indicating whether the profile information used for connection to the first communication network is default profile information, which is stored in the third server.

[0067] As another aspect, the present disclosure can also be defined as a method for causing a computer to execute the processing of the information processing device, a program for causing a computer to execute the processing of the information processing device, and a computer-readable recording medium recording the program.

[0068] Hereinafter, embodiments of the present disclosure will be described based on the drawings. The structures of the following embodiments are exemplifications, and the present disclosure is not limited to the structures of the embodiments.

[0069] <First Embodiment>

[0070] Figure 1 This figure is a diagram showing an example of service provision to the vehicle 10 involved in the first embodiment. In the first embodiment, the communication system 2 is a system managed by the manufacturing business of the vehicle 10. The communication system 2 implements the collection of information related to the communication of the vehicle 10 and the control related to the communication of the vehicle 10. In addition, after the communication of the vehicle 10 passes through the communication system 2, the communication system 2 connects to an external network such as the Internet, thereby enhancing the safety of the vehicle 10. In addition, the communication system 2 provides services such as vehicle status monitoring services, navigation services, and emergency notification services to the vehicle 10. The server 4 is a server trusted by the communication system 2, and provides these services to the vehicle 10. Although the server 4 is Figure 1 It exists outside the communication system 2, but can also exist inside the communication system 2.

[0071] The vehicle 10 is a networked vehicle and is equipped with a DCM 1 that performs a communication function. In the first embodiment, the manufacturing business of the vehicle 10, which is the manager of the communication system 2, does not have a communication infrastructure. Therefore, the owner of the vehicle 10 signs a contract with a communication carrier to connect the vehicle 10 to the communication system 2 through the communication carrier network. In addition, the DCM 1 can also communicate in a communication method different from the mobile communication method, such as WiFi communication. The DCM 1 can connect to the Internet using WiFi as an access network, for example. In the case where WiFi is used as an access network, the DCM 1 can connect to the Internet even if it is not connected to the communication system 2. However, in this case, it is impossible to receive services from the communication system 2. On the other hand, even in the case where WiFi is used as an access network, the DCM 1 can be connected to the communication system 2 by setting, and connected to the Internet via the communication system 2. However, in the first embodiment, in the case where WiFi is used as an access network, the method of connecting the DCM 1 to the communication system 2 is set as a method outside the scope of the description.

[0072] The communication system 2, SM-DP+3, server 4, and authentication authority 5 are connected to a public network such as the Internet, respectively, so that they can communicate with each other. In addition, the vehicle 10 is connected to a public network such as the Internet through a WiFi network, for example, so that it can connect to the SM-DP+3, server 4, and authentication authority 5.

[0073] The communication system 2 includes HSS 21 and AAA (Authentication Authorization Accounting) 22. Figure 1 In the embodiment, the structural elements involved in the first embodiment are extracted for representation, and the structural elements of the communication system 2 are not limited to Figure 1 HSS21 stores information related to subscribers connected to the communication system 2. The information related to the subscribers stored in HSS21 includes, for example, identification information of the owner of the vehicle 10, identification information of the vehicle 10 (DCM 1), authentication information used for authentication of the DCM 1, and identification information of the profile information used for authentication.

[0074] AAA 22 uses a predetermined authentication method and the information related to DCM 1 stored in HSS 21 to perform authentication of DCM 1. The authentication method adopted by AAA 22 is, for example, AKA (Authentication and Key Agreement) authentication adopted in the authentication of the carrier network. However, the authentication method adopted by AAA 22 is not limited to AKA authentication, and an authentication method unique to the communication system 2 may also be adopted.

[0075] SM-DP+3 manages profile information. SM-DP+3 stores profile information about the contracting party (the owner of the vehicle 10 in the first embodiment) who has signed a subscription contract for the service of the communication system 2, which is issued by the communication system 2. In addition, SM-DP+3 provides profile information corresponding to the owner of the vehicle 10 in response to a request from the DCM 1. SM-DP+3 is managed by the same administrator as the administrator of the communication system 2, for example.

[0076] The certification authority 5 is a system that verifies that the owner of the vehicle 10 is the real owner and issues an electronic certificate indicating that the authentication information used for the vehicle 10 is the owner's information. The certification authority 5 is a system managed by a trusted third party agency. Hereinafter, the electronic certificate indicating that the authentication information used for the vehicle 10 is the owner's information is simply referred to as an identity confirmation certificate.

[0077] The DCM 1 has an eSIM and uses profile information stored in the eSIM to connect to the communication system 2. In the first embodiment, since the DCM 1 is mounted on the vehicle 10, the purchaser of the vehicle 10, the owner of the vehicle 10, the owner of the DCM 1, and the contracting party of the communication system 2 are the same person.

[0078] In the first embodiment, the eSIM of the DCM 1 stores default profile information used in connection with the communication system 2. The default profile information is downloaded from the SM-DP+3 via WiFi or the like by a staff of a manufacturing business at the time of factory shipment, stored in the eSIM, and made effective. The default profile information is profile information set corresponding to the communication system 2. That is, during the period when the DCM 1 uses the default profile information to connect to the communication system 2, it indicates that the owner of the vehicle 10 is the communication system 2, that is, the vehicle 10 is not owned by a specific individual but is being sold. By keeping the default profile information in the eSIM of the DCM 1, the DCM 1 is in a state where it can connect to the communication system 2 and communicate after the factory shipment. In addition, the communication system 2 can obtain information related to the DCM 1 after the factory shipment of the DCM 1, so that even if the vehicle 10 is being sold, for example, the state of the vehicle 10 can be monitored. Hereinafter, the default profile information is simply referred to as the default profile.

[0079] In the first embodiment, the flow from when the owner of the vehicle 10 purchases the vehicle 10 to when the owner receives the service provided by the communication system 2 is as follows.

[0080] (1) When the purchase contract of the vehicle 10 is concluded, the new owner submits a personal identification document such as a seal certificate and a garage certificate. In addition, along with the purchase contract of the vehicle 10, a contract for joining the service of the communication system 2 is also executed. Based on the contents of the purchase contract of the vehicle 10 and the contract for joining the service of the communication system 2, information related to the owner is registered in the communication system 2.

[0081] The information related to the owner registered in the communication system 2 includes, for example, the owner's personal information such as name, address, gender, date of birth, and identity verification documents, information related to the purchased vehicle, and subscriber information in the service of the communication system 2. The information related to the purchased vehicle includes, for example, the vehicle name, model, information recorded on the license plate, and the location of the garage. The subscriber information in the service of the communication system 2 includes, for example, the owner's identification information (IMSI), the identification information of the DCM 1 (IMEI), profile information, and setting information such as the contract content of the service plan and the payment method. The subscriber information in the service of the communication system 2 is stored in the HSS 21. The owner's personal information and the information related to the vehicle can be stored in the HSS 21 or in a database different from the HSS 21.

[0082] The subscription contract for the service of the communication system 2 can be completed at the same time as the purchase contract of the vehicle 10, or at a later time than the purchase contract of the vehicle 10. When the subscription contract for the service of the communication system 2 is established, the communication system 2 issues the profile information corresponding to the owner based on the subscriber information, and the profile information is registered in the SM-DP+3. In addition, the information of the identity confirmation document (seal certificate, identity confirmation document with facial image, personal number card) is sent from the communication system 2 to the certification authority 5, and the certification authority 5 conducts the identity confirmation review for the owner of the vehicle 10, and registers the information establishing the correspondence between the owner of the vehicle 10 and the vehicle 10 (DCM 1) in the certification authority 5.

[0083] (2) The owner of the vehicle 10 operates the DCM 1 to download the profile information corresponding to the owner of the vehicle 10 from the SM-DP+3. The download of the profile information may be implemented, for example, via WiFi. In the first embodiment, since the DCM 1 uses the default profile to connect to the communication system 2, it may also be implemented via the communication system 2. The profile information corresponding to the owner of the vehicle 10 is stored in the eSIM of the DCM 1. Hereinafter, the profile information corresponding to the owner of the vehicle 10 is simply referred to as the owner profile.

[0084] For example, when the owner profile is validated by an operation performed by the owner of the vehicle 10, the default profile is invalidated. Next, the owner of the vehicle 10 is treated as a subscriber of the service of the communication system 2, and the connection between the DCM 1 and the communication system 2 is reestablished. In this process, the DCM 1 receives authentication by the AAA 22 using the owner profile information. The AAA 22 authenticates the owner of the vehicle 10 using the subscriber information corresponding to the owner of the vehicle 10 stored in the HSS 21. Thus, the HSS 21 records that the DCM 1 is connecting to the communication system 2 using the owner profile. Thereafter, the DCM 1 can connect to the Internet via the communication system 2.

[0085] (3) When the owner of the vehicle 10 receives a service from the server 4 as one of the services of the communication system 2, the DCM 1 receives authentication from the server 4. The DCM 1 generates authentication information for authentication. In the first embodiment, the DCM 1 generates the authentication information by using the owner's configuration file as a key. The authentication method adopted by the server 4 is, for example, TLS (Transport Layer Security) authentication. The authentication information is, for example, a public key and a private key used in TLS authentication.

[0086] (4) DCM 1 requests the certification authority 5 to issue a personal confirmation certificate for the owner of the vehicle 10 to prove that the authentication information is the owner of the vehicle 10. Since the corresponding relationship between the vehicle 10 (DCM 1) and the owner of the vehicle 10 has been registered in the certification authority 5, the certification authority 5 issues the personal confirmation certificate based on the corresponding relationship. Since the personal confirmation certificate is made based on the personal confirmation document, it can strongly prove that the owner is the real owner. DCM 1 obtains the personal confirmation certificate from the certification authority 5, and stores the personal confirmation certificate and the authentication information in the eSIM in a manner associated with the owner's profile. In addition, the authentication information sent to the certification authority 5 and issued with the personal confirmation certificate is, for example, a public key used in TLS authentication. The eSIM stores the TLS public key and private key.

[0087] (5) DCM 1 accesses server 4 via communication system 2, and transmits the identity verification certificate stored in eSIM to server 4 to receive authentication from server 4. If the authentication is successful, DCM 1 can receive services from server 4 thereafter.

[0088] In the first embodiment, the authentication information used for authentication with the server 4 is generated by using the profile information of the owner of the vehicle 10 as a key. In addition, since the identity confirmation certificate related to the authentication information is stored in the eSIM, it can be rewritten. Therefore, for example, when the owner profile that is activated is changed along with the change of the owner of the vehicle 10, the identity confirmation certificate used for authentication by the server 4 is also changed. Therefore, even if the owner of the vehicle 10 is changed, the server 4 can identify the current owner of the vehicle 10 based on the identity confirmation certificate used for authentication by the DCM 1.

[0089] In addition, there are two main methods for connecting DCM 1 to communication system 2 through a carrier network. In the first method, communication system 2 is an MVNO (Mobile Virtual Network Operator) that has a billing function for connection to communication system 2, and DCM 1 uses a carrier network that has signed an MVNO contract with communication system 2 for connection. In this case, settings related to the collection of communication fees are implemented in the default profile and the owner profile in the eSIM. For example, as the collection target of communication fees, the manager of communication system 2 (the manufacturing business of vehicle 10) is set in the default profile, and the owner of vehicle 10 is set in the owner profile.

[0090] In another method, the communication system 2 is not an MVNO and does not have a billing function for the connection to the communication system 2, and the DCM 1 uses an IPsec tunnel on the carrier network to connect to the gateway (ePDG) in the communication system 2. In this case, the DCM 1 has another SIM (hereinafter, the second SIM) for connecting to the carrier network, and the owner of the vehicle 10 needs to sign a contract with the carrier network in addition to the communication system 2. In the authentication in the establishment of the connection between the DCM 1 and the carrier network, the profile information used in the connection to the carrier network stored in the second SIM is used. After the connection between the DCM 1 and the carrier network is established, the default profile or the owner profile in the eSIM is used for the authentication when the connection is established with the communication system 2. In this case, there is no special contract between the carrier network used by the DCM 1 in the connection to the communication system 2 and the communication system 2, and the owner of the vehicle 10 can freely select the carrier network. In addition, the default profile and the owner profile in the eSIM do not implement settings related to the collection of communication fees. The second SIM may be an eSIM or a card-type SIM. In the following description, the eSIM is assumed to be the second SIM.

[0091] For example, in DCM 1, a default profile is stored in the eSIM when the vehicle 10 is shipped from the factory, and profile information used for connecting to a carrier network specified by a manufacturer of the vehicle 10 is stored in the second SIM. In this profile information, for example, the manager of the communication system 2 (the manufacturer of the vehicle 10) is set as the target of the communication fee collection. When the vehicle 10 is purchased, as described above, an owner profile is stored in the eSIM, and profile information used for connecting to a carrier network selected by the owner is stored in the second SIM. In this profile information, the owner of the vehicle 10 is set as the target of the communication fee collection.

[0092] In the first embodiment, regardless of the connection method between DCM 1 and communication system 2 via the carrier network, communication fees incurred while connecting to communication system 2 using the default profile are charged to the manager of communication system 2 (the manufacturer of vehicle 10 ).

[0093] Figure 21 is a diagram showing an example of the hardware structure of the DCM 1. As a hardware structure, the DCM 1 includes a CPU 101, a memory 102, an auxiliary storage device 103, a first communication unit 104A, a second communication unit 104B, and an eUICC 105. The auxiliary storage device 103 is, for example, a HDD (Hard Disk Drive) and an SSD (Solid State Drive). Among the programs stored in the auxiliary storage device 103, there are, for example, an OS (Operating System), a communication control program, and other multiple programs. The communication control program is a program for connecting to the communication system 2 using the profile information in the eUICC 105. The memory 102 includes, for example, a semiconductor memory such as a ROM (Read Only Memory) and a RAM (Random Access Memory). The memory 102 and the auxiliary storage device 103 are each an example of a recording medium that can be read by a computer.

[0094] The CPU 101 performs various processes by loading the OS and other various programs stored in the auxiliary storage device 103 into the memory 102 and executing them. The CPU 101 is not limited to one, and a plurality of CPUs may be provided. The CPU 101 is an example of a "control unit".

[0095] In the first embodiment, the first communication unit 104A communicates with an external device based on a 4G mobile communication method. In addition, when the communication system 2 is a system corresponding to a 5G or 6G or later mobile communication method, the first communication unit 104A is set to also correspond to the mobile communication method corresponding to the communication system 2. The second communication unit 104B implements wireless communication based on a method different from the mobile communication method. The second communication unit 104B corresponds to wireless communication methods such as WiFi and Bluetooth (registered trademark).

[0096] In the first embodiment, the eUICC 105 is a chip-type eUICC. However, the present invention is not limited thereto, and the eUICC 105 may also be a card-type card that is pluggable in and out of the DCM 1. In this case, the DCM 1 is provided with a slot for an eSIM card and a reader and writer. Figure 2 In the embodiment, a structure is envisioned in which the eUICC 105 is a chip type and is embedded in the DCM 1.

[0097] The eUICC 105 includes a CPU 105-1, a memory 105-2, and an auxiliary storage device 105-3. The CPU 105-1 and the memory 105-2 are respectively the same as the CPU 101 and the memory 102. The auxiliary storage device 105-3 is, for example, a flash memory or an EEPROM. In the auxiliary storage device 105-3, for example, the OS of the eUICC, a program for downloading profile information, a program for managing profile information, etc. are stored.

[0098] In addition, the hardware structure of DCM 1 is not limited to Figure 2 For example, in addition to the eUICC 105, a device equivalent to a SIM may be further provided. The device equivalent to a SIM is, for example, a SIM slot of a SIM card of an eUICC or a card-type pluggable UICC and a SIM card reader.

[0099] Figure 3 This is an example of the functional structure of the DCM 1. As a functional structure, the DCM 1 includes a communication control unit 11, an LPAd 12, and a service control unit 16. The communication control unit 11 controls the connection between the DCM 1 and the communication system 2 using the profile information that is saved and validated in the eUICC 105. The details of the processing of the communication control unit 11 will be described later.

[0100] The service control unit 16 performs control for receiving services of the communication system 2 including services of the server 4. Specifically, the service control unit 16 performs authentication of the server 4 and processing related to the service.

[0101] The LPAd 12 manages the profile information stored in the eUICC 105. That is, the processing performed by the DCM 1 on the eUICC 105 is performed via the LPAd 12. More specifically, the LPAd 12 downloads the profile information from the SM-DP+3 according to the instruction from the user, and forwards the downloaded profile information to the eUICC 105. In addition, the LPAd 12 accepts the instruction from the user to validate, invalidate, or delete the profile information stored in the eUICC 105, and forwards the instruction to the eUICC 105. In addition, the LPAd 12 inquires the SM-DP+3 about the existence of events such as the update of the profile information, for example. In addition, when the communication control unit 11 and the service control unit 16 access the information stored in the eUICC 105, the access is also performed via the LPAd 12.

[0102] As a functional structure, the eUICC 105 includes an ISD-R (Issuer Security Domain Root) 13, an ISD-P (Issuer Security Domain Profile) for a default profile 14, and an ISD-P for an owner profile 15. These functional structures are achieved by the CPU 105-1 executing a program stored in the auxiliary storage device 105-3.

[0103] ISD-R 13 is an interface with LPAd 12. ISD-R 13 receives the forwarding of the downloaded profile information from LPAd 12 and installs the profile information. In addition, the communication between ISD-R 13 and SM-DP+3 related to the download of the profile information uses secure communication. In addition, ISD-R 13 executes validation, invalidation, or deletion of the corresponding profile information according to the instruction input from LPAd 12.

[0104] ISD-P is an area for storing profile information. ISD-P is generated separately for profile information. Profile information is downloaded from SM-DP+3 as data packaged together with the small application described later, the control program of the OTA (Over The Air) function, the program for controlling access to the wireless communication network, etc. In the following, the packaged data including the profile information is referred to as a profile package. The profile package includes an encrypted part for storing the profile information, etc., and a part for storing the steps for making ISD-P. ISD-P is made based on the steps for making ISD-P described in the profile package and through ISD-R 13. The encrypted part of the profile package is decrypted by the OS of the eUICC, and the profile information, etc. are expanded in the ISD-P. In the following, ISD-P is sometimes referred to as a profile. In addition, the validation of the profile information represents the operation of activating the ISD-P.

[0105] The default profile ISD-P 14 is created when the default profile package is downloaded from SM-DP+3 and installed at the time of factory shipment. The owner profile ISD-P 15 is created when the owner profile package is downloaded from SM-DP+3 and installed by the operation of the owner of the vehicle 10.

[0106] The owner profile ISD-P 15 stores profile information 151, authentication information generation applet 152, authentication information 153, and identity verification certificate 154. The profile information 151 is the owner profile of the vehicle 10. The profile information 151 includes, for example, IMSI (International Mobile Subscription Identity) which is the individual identification number of the DCM 1, ICCID (Integrated Circuit Card ID) which is identification information of the owner profile of the vehicle 10, and authentication information used for authentication of the communication system 2. The authentication information used for authentication of the communication system 2 is, for example, a public key and a private key of AKA authentication.

[0107] The authentication information generation applet 152 is a program that uses the profile information 151 as a key to generate authentication information 153. The authentication information 153 is, for example, a public key and a private key used in the TLS authentication adopted by the server 4. The person confirmation certificate 154 is an electronic certificate issued by the certification authority 5 for the authentication information 153. When the authentication information 153 includes a public key and a private key, the person confirmation certificate 154 is an electronic certificate related to the public key. The public key and the private key are collectively referred to as key information. In addition, in Figure 3 In the embodiment, the structural elements involved in the first embodiment are extracted and represented, and the structural elements included in the owner profile ISD-P 15 are not limited to those in Figure 3 The structural elements shown in .

[0108] In the default profile ISD-P 14, for example, default profile information is stored. The default profile information includes, for example, IMSI, which is the individual identification number of the DCM 1, ICCID, which is the identification information of the default profile information, and authentication information used in the authentication of the communication system 2. In addition, IMSI and ICCID are different values ​​in the default profile ISD-P 14 and the owner profile ISD-P 15. In the case where the vehicle 10 is to be sold and the service of the server 4 is to be received, the authentication information used in the authentication of the server 4 and the electronic certificate proving that the authentication information is the information of the manager of the communication system 2 (the manufacturing business of the vehicle 10) can also be stored in the default profile ISD-P 14. In the case where the authentication information is generated by an applet, the applet can also be stored in the default profile ISD-P 14. The authentication information generation algorithm of the applet can be the same as or different from the authentication information generation applet 152. However, the format of the generated authentication information is the same in any generation algorithm.

[0109] in addition, Figure 3 The functional structure of the DCM 1 shown is an example, and the functional structure of the DCM 1 is not limited to Figure 3 Example shown.

[0110] Figure 4 1 is a diagram showing an example of the hardware structure of the information processing device 6. The information processing device 6 is an example of a device that acts as any one of the HSS 21, AAA 22, SM-DP + 3, and the server 4. The information processing device 6 is, for example, a computer or device dedicated to the HSS 21, AAA 22, SM-DP + 3, and the server 4.

[0111] As a hardware structure, the information processing device 6 includes a processor 601, a memory 602, an auxiliary storage device 603, and a communication unit 604. The processor 601, the memory 602, the auxiliary storage device 603, and the communication unit 604 are electrically connected together through a bus. The memory 602 and the auxiliary storage device 603 are respectively the same as the memory 102 and the auxiliary storage device 103. In the auxiliary storage device 603, a program for realizing the actions of any one of the HSS 21, AAA 22, SM-DP + 3, and the server 4 undertaken by the information processing device 6 is stored.

[0112] The processor 601 performs various processes by loading the OS and other various programs stored in the auxiliary storage device 603 into the memory 602 and executing them. The processor 601 is, for example, a CPU, a DSP, and a GPU (Graphics Processing Unit). In addition, the processor 601 is not limited to one, and a plurality of processors may be provided. In the case of a plurality of processors 601, the plurality of processors 601 may be processors of different types.

[0113] The communication unit 604 is, for example, a NIC (Network Interface Card), an optical line interface, etc. In addition, the communication unit 604 may be, for example, a wireless communication circuit for connecting to a wireless network such as a wireless LAN. In addition, the hardware structure of the information processing device 6 is not limited to Figure 4 The structure shown.

[0114] Figure 5 2 is a diagram showing an example of the functional structure of HSS 21. As a functional structure, HSS 21 includes a control unit 211, a subscriber information DB 212, and a terminal connection information DB 213. The control unit 211 reads data from the subscriber information DB 212 or the terminal connection information DB 213, or writes data to the subscriber information DB 212 or the terminal connection information DB 213, for example, based on a request from AAA 22.

[0115] The subscriber information DB 212 stores subscriber information. The terminal connection information DB 213 stores information related to terminals connected to the communication system 2. The functional configuration of the HSS 21 is not limited to the Figure 5 The content shown.

[0116] Figure 6 FIG. 2 is a diagram showing an example of information stored in the subscriber information DB 212. Figure 6 One record of the subscriber information DB 212 shown includes fields for subscriber ID, vehicle ID, SIM ID, profile ID, matching ID, default, authentication information, and setting information.

[0117] In the field of the subscriber ID, for example, the IMSI assigned by the communication system 2 to the subscriber of the service of the communication system 2 is stored. In the first embodiment, the subscriber is the manager of the communication system 2 in the default profile and the owner of the vehicle 10 (the contracting party of the service of the communication system 2) in the owner profile.

[0118] In the field of vehicle ID, IMEI (International Mobile Equipment Identity) which is identification information of DCM 1 assigned by the manufacturer of DCM 1 is stored. In addition, there is a case where the manufacturer of vehicle 10 is different from the manufacturer of DCM 1. In the field of SIM ID, EID (Embedded Identity Document) which is the identification number of SIM assigned to eUICC or UICC is stored.

[0119] In the field of profile ID, ICCID as identification information of profile information is stored. In the field of match ID, match ID assigned to profile information is stored. Match ID is identification information for identifying profile package in SM-DP+3. In the field of default, information indicating whether the profile information is a default profile is stored. Information indicating whether the profile information is a default profile is, for example, a flag. In the field of authentication information, authentication information used for authentication of the DCM 1 is stored. For example, when the authentication method adopted by AAA 22 is AKA authentication, in the field of authentication information, a public key and a private key corresponding to DCM 1 are stored.

[0120] The fields of the setting information store the contents set in the configuration file. For example, the setting information of the configuration file includes the contents of the contract with the subscriber and policy information. When the communication system 2 is an MVNO, the setting information also stores the collection target and collection rules of the communication fee. In the case of the default configuration file, the collection target of the communication fee becomes the manager of the communication system 2 (the manufacturer of the vehicle 10). In the case of the owner configuration file, the collection target of the communication fee becomes the owner of the vehicle 10.

[0121] The information stored in the subscriber information DB 212 is input from, for example, an operator terminal of the communication system 2. The information stored in the subscriber information DB 212 is not limited to Figure 6 Example shown.

[0122] Figure 7 2 is a diagram showing an example of information stored in the terminal connection information DB 213. The terminal connection information DB 213 stores information related to the connection of the DCM 1 that is currently connected to the communication system 2. Figure 7 One record of the terminal connection information DB 213 shown includes fields for a subscriber ID, a vehicle ID, a certification date and time, and a profile ID.

[0123] In the fields of the subscriber ID and vehicle ID, IMSI and IMEI are stored respectively, similarly to the fields of the subscriber ID and vehicle ID of the subscriber information DB 212. In the field of the authentication date and time, the date and time when the DCM 1 is authenticated by the AAA 22 is stored. In the field of the profile ID, identification information (ICCID) of the profile information used in the authentication performed by the AAA 22 is stored. The record of the terminal connection information DB 213 is generated when the DCM 1 reconnects to the communication system 2, and is deleted when the communication with the DCM 1 is disconnected.

[0124] When the ICCID in the profile ID field of the record of the terminal connection information DB 213 indicates that it is a default profile in the subscriber information DB 212, it can be determined that the corresponding vehicle is currently being sold as a new car or a used car. In addition, the information stored in the terminal connection information DB 213 is not limited to Figure 7 In addition, although the first embodiment shows an example in which the subscriber information DB 212 is divided into information that does not change according to the connection status of the DCM 1 and information that changes dynamically according to the connection status of the DCM 1 and is managed, the present invention is not limited to this. The information stored in the subscriber information DB 212 and the information stored in the terminal connection information DB 213 may be managed as one database in an integrated state.

[0125] Figure 8 1 is a diagram showing an example of the functional structure of the server 4. As a functional structure, the server 4 includes an authentication unit 41, a service provider 42, and a user information DB 43. The authentication unit 41 authenticates the DCM 1 in a predetermined authentication method (for example, TLS authentication). The authentication unit 41 receives the identity confirmation certificate 154 from the DCM 1, thereby permitting access to the server 4. The service provider 42 performs processing related to the service corresponding to the DCM 1.

[0126] The user information DB 43 stores information related to users of the services provided by the server 4. The information related to the user includes, for example, identification information of the user, authentication information used for authentication of the user, personal information of the user, and service content corresponding to the personal information of the user. For example, identification information (IMSI) of a subscriber in the communication system 2 is used as the identification information of the user.

[0127] The identity confirmation certificate 154 is a certificate of authentication information generated for use with the profile information. The profile information includes identification information (IMSI) that can identify the owner of the vehicle 10. The service provider 42 can identify the owner of the vehicle 10 by using the identity confirmation certificate 154 used in the authentication, and can provide services corresponding to the attributes of the owner of the vehicle 10. In addition, for example, part of the information stored in the user information DB 43, such as the user's personal information, can also use the information in the database stored in the communication system 2. In addition, the functional structure of the server 4 is not limited to Figure 8 The content shown.

[0128] <Processing Flow>

[0129] Fig. 9 The following is an example of a flowchart of the download process of the profile information executed by the DCM 1. Fig. 9 The processing shown is repeatedly executed during the operation of the DCM 1. Fig. 9 The processing shown is mainly executed by the CPU 101 of the DCM 1, but for ease of understanding, the functional structural elements are mainly used for description. Fig. 9 The same applies to the subsequent flowcharts.

[0130] In OP101, LPAd 12 determines whether a user operation requesting to obtain a configuration file has been input. For example, when the contract for joining the service of the communication system 2 is completed, a QR code (registered trademark) including an activation code for downloading the owner's configuration file is notified from the communication system 2 to the DCM 1. The notification method of the QR code can be, for example, notified by printing it on a paper medium, notified by accessing a predetermined URL, or notified by sending it to the smartphone of the owner of the vehicle 10 by means of an e-mail or the like. In the case where the QR code is notified by using a paper medium or the smartphone of the owner of the vehicle 10, for example, the owner of the vehicle 10 can also input the user operation requesting to obtain the configuration file to the DCM 1 by reading the QR code using a vehicle-mounted camera or the like mounted on the vehicle 10 and connected to the DCM 1. In the case where the QR code is notified as digital data (for example, image data) by accessing a predetermined URL, the DCM 1 can also input the user operation requesting to obtain the configuration file to the DCM 1 by reading the data of the QR code. The activation code is also input together with the request. In addition, the user operation of requesting to obtain the configuration file is not limited to the method using the QR code.

[0131] If a user operation requesting acquisition of a configuration file is input (OP101: YES), the process proceeds to OP102. If a user operation requesting acquisition of a configuration file is not input (OP101: NO), the process proceeds to OP105.

[0132] In OP102, LPAd 12 sends a profile request to SM-DP+3 to obtain profile information. When a QR code is used, an activation code is also sent together with the profile request. The activation code includes, for example, the address of SM-DP+3 and a matching ID.

[0133] In OP103, LPAd 12 downloads the configuration file package from SM-DP+3. In OP104, LPAd 12 forwards the downloaded configuration file package to eUICC 105. Fig. 9 The shown processing ends.

[0134] In OP105, the LPAd 12 determines whether the profile information held in the owner profile ISD-P 15 has been updated. The profile information is updated, for example, when a vulnerability is found in the authentication information included in the profile information 151 or the authentication information 153, or when the algorithm of the authentication information generation applet 152 is updated. In addition, the update of the profile information is detected by the ISD-R 13 and notified to the LPAd 12. When the profile information held in the owner profile ISD-P 15 has been updated (OP105: Yes), the process proceeds to OP102.

[0135] In addition, the update of the profile information is implemented for each package. Therefore, the profile package including the updated profile information is downloaded from SM-DP+3 to create an ISD-P corresponding to the re-updated profile information. The ISD-P corresponding to the profile information before the update is invalidated by validating the ISD-P corresponding to the updated profile information. Therefore, the matching ID of the profile package will change from the matching ID before the update. The matching ID of the profile package including the updated profile information is obtained from SM-DP+3 at the same time as the update of the profile information is detected through ISD-R 13, for example. However, the update of the profile information is not limited to the method of implementing it for each package, and it can also be implemented in units of updated profile information and mini-applications. In the case of implementing the update of the profile information in units of profile information or mini-applications, the updated profile information or mini-applications can also be downloaded from SM-DP+3 and stored in the ISD-P. In addition, the download process of the profile information is not limited to Fig. 9 The processing shown in the figure can be appropriately changed according to the implementation mode.

[0136] Fig.10 This is an example of a flowchart of the process of enabling or disabling a configuration file executed by the DCM 1 . Fig.10 The processing shown is repeatedly executed at a predetermined cycle during the operation of the DCM 1 .

[0137] In OP201, LPAd 12 determines whether a user operation for validating a profile has been input. In addition, a user operation for validating or invalidating a profile is input, for example, from a menu screen related to the SIM. In a case where a user operation for validating a profile has been input (OP201: Yes), the process proceeds to OP202. In OP202, LPAd 12 notifies ISD-R 13 of an instruction to validate the profile, and ISD-R 13 invalidates the profile if there is currently a profile that is validated. In a case where there is currently no profile that is validated, the process of OP202 is skipped. In OP203, ISD-R 13 validates the profile (ISD-P) that has been designated for validation.

[0138] If the user operation for validating the profile is not input (OP201: No), the process proceeds to OP204. In OP204, the LPAd 12 determines whether the user operation for invalidating the profile is input. If the user operation for invalidating the profile is input (OP204: Yes), the process proceeds to OP205. If neither the user operation for validating the profile nor the user operation for invalidating the profile is input (OP204: No), Fig.10 The processing shown ends. In OP205, the LPAd 12 notifies the ISD-R 13 of an instruction to invalidate the configuration file, and the ISD-R 13 invalidates the configuration file (ISD-P) designated for invalidation.

[0139] In OP206, since there is a change in the configuration file being validated or invalidated, LPAd12 notifies the communication control unit 11 of the change in the configuration file being validated or the invalidation of all configuration files. If there is a change in the configuration file being validated, the communication control unit 11 uses the revalidated configuration file information to reconnect the communication with the communication system 2. If the configuration file information is invalidated and there is no configuration file being validated, the communication with the communication system 2 is disconnected. Thereafter, Fig.10 The shown processing ends.

[0140] For example, when the vehicle 10 is shipped from the factory, a validation operation of the default profile is input by a staff member (OP201: Yes), so that the default profile is validated (OP203). For example, when the vehicle 10 is purchased and the new owner downloads the owner profile from the SM-DP+3 in preparation for connecting the DCM 1 to the communication system 2, a user operation of validating the owner profile is input by the owner of the vehicle 10 (OP201: Yes). In this case, since the default profile is being validated, the default profile is invalidated (OP202), and thereafter, the owner profile is validated (OP203).

[0141] For example, when the vehicle 10 is sold from the owner to a used car dealer and is sold as a used car, the owner of the vehicle 10 or a staff of the used car dealer inputs a user operation to validate the default profile in order to invalidate the owner profile (OP201: Yes). In this case, first, the owner profile being validated is invalidated (OP202), and then the default profile is validated (OP203). In addition, when the owner profile is invalidated, the authentication information 153 and the person confirmation certificate 154 in the owner profile ISD-P 15 are also invalidated.

[0142] In addition, the processing of enabling or disabling the configuration file is not limited to Fig.10 In addition, when the vehicle 10 is sold from the owner to a used car dealer, the owner profile may also be deleted from the eUICC 105 .

[0143] Fig.11 This is an example of a flowchart of the process of obtaining the user confirmation certificate 154 executed by the DCM 1. Fig.11 The processing shown is started by obtaining permission from the user to obtain the identity confirmation certificate 154 when the service control unit 16 accesses the server 4, for example, when the owner profile ISD-P 15 does not store the identity confirmation certificate 154, or when the validity period of the identity confirmation certificate 154 of the owner profile ISD-P 15 has expired. The case where the identity confirmation certificate 154 is not stored in the owner profile ISD-P 15 is, for example, the case where the server 4 is not accessed after the owner profile is downloaded from the SM-DP+ 3 or after the owner profile is updated.

[0144] In OP301, the service control unit 16 requests the LPAd 12 to generate the authentication information 153 implemented by the authentication information generation applet 152. In OP302, the LPAd 12 starts the authentication information generation applet 152 through the ISD-R 13, thereby generating the authentication information 153, and the service control unit 16 obtains the authentication information 153. In OP303, the service control unit 16 sends a request for the issuance of an electronic certificate for the authentication information 153 to the certification authority 5. A part (for example, a public key) or all of the authentication information 153 is also sent together with the request.

[0145] In OP304, the service control unit 16 obtains the identity verification certificate 154 from the authentication authority 5. In OP305, the service control unit 16 stores the authentication information 153 and the identity verification certificate 154 in the owner profile ISD-P 15. Fig.11 The process shown ends. The service control unit 16 sends the identity confirmation certificate 154 to the server 4, and performs the authentication process with the server 4 using the authentication information 153, thereby starting to use the service of the server 4. In addition, the process of obtaining the identity confirmation certificate 154 is not limited to Fig.11 Example shown.

[0146] Fig.12 2 is a diagram showing an example of a processing sequence until the DCM 1 obtains the owner profile and connects to the communication system 2. Fig.12 The illustrated processing sequence is based on the premise that a default profile is stored in the eUICC 105 and the default profile is in a valid state.

[0147] In S11, the DCM 1 receives an input of a user operation requesting an owner profile from the owner of the vehicle 10 ( Fig. 9 , OP101: Yes). In S12, DCM 1 sends a profile request to SM-DP+3 ( Fig. 9 , OP102). In S13, DCM 1 downloads the owner profile package from SM-DP+3 ( Fig. 9 , OP103). The communication between DCM 1 and SM-DP+3 in S12 and S13 is implemented via WiFi, for example. In S14, DCM 1 forwards the downloaded owner profile package to eUICC 105 ( Fig. 9 In S15, an ISD-P 15 for the owner profile is created based on the package of the owner profile through the ISD-R 13 in the eUICC 105, and the owner profile is installed.

[0148] In S21, a user operation for validating the owner profile is inputted from the owner of the vehicle 10 to the DCM 1 (OP201: Yes). In S22, the DCM 1 instructs the ISD-R 13 in the eUICC 105 to validate the owner profile. In S23, after the currently validated default profile is invalidated (OP202), the owner profile is validated (OP204). In S24, the DCM 1 is notified that the new owner profile has been validated (OP206).

[0149] In S25, the DCM 1 uses the owner profile information to perform a step of establishing a connection to the communication system 2. Among a series of steps of the AAA 22, an authentication process (AKA authentication) is performed between the DCM 1 and the HSS 21 using the owner profile information. When the communication between the DCM 1 and the communication system 2 is established, the DCM 1 can communicate with an external network such as the Internet via the communication system 2.

[0150] Fig.13 This is a diagram showing an example of the sequence of processes until the DCM 1 obtains the identity verification certificate 154 and accesses the server 4. Fig.13 The order of processing shown is based on the premise that, for example, Fig.12 The sequence shown is followed, and DCM 1 completes the connection to communication system 2 using the owner profile.

[0151] In S31, the DCM 1 receives an input of a user operation requesting acquisition of the person confirmation certificate 154 from the user (for example, the owner of the vehicle 10). Fig.11 For example, when a user operation for starting a service of the server 4 is inputted from the user and the eUICC 105 does not hold the identity confirmation certificate 154, a message requesting permission to obtain the identity confirmation certificate 154 is outputted, and when the user permits, a user operation for requesting the acquisition of the identity confirmation certificate 154 is inputted.

[0152] In S32, the DCM 1 instructs the ISD-R 13 of the eUICC 105 to generate the authentication information 153. In S33, the authentication information 153 is generated by the applet 152 generated by the authentication information of the eUICC 105, and the profile information 151 is used to generate the authentication information 153. In S34, the DCM 1 obtains the authentication information 153 through the ISD-R 13 of the eUICC 105 ( Fig.11 In S35, DCM1 sends a request for issuance of an electronic certificate and the authentication information 153 (for example, a public key) to the authentication authority 5. ( Fig.11 , OP303). In S36, the certification authority 5 issues the identity verification certificate 154. In S37, the DCM 1 receives the identity verification certificate 154 from the certification authority 5 ( Fig.11 , OP304). In S38, the DCM 1 forwards the identity confirmation certificate 154 to the eUICC 105. In S39, the ISD-R 13 of the eUICC 105 stores the identity confirmation certificate 154 and the authentication information 153 in the ISD-P 15 for the owner profile ( Fig.11 , OP305).

[0153] In S41, the DCM 1 reads the identity confirmation certificate 154 from the eUICC 105. In S42, the DCM 1 sends an authentication request and the identity confirmation certificate 154 to the server 4. Thereafter, the DCM 1 performs authentication processing (for example, TLS authentication) using the authentication information 153 between the DCM 1 and the server 4. In S44, the server 4 authenticates the DCM 1, and then starts providing services to the DCM 1. The server 4 determines the current owner of the vehicle 10 based on the identity confirmation certificate 154, and can provide services corresponding to the attributes of the owner of the vehicle 10, for example.

[0154] Fig.14 1 is a diagram showing an example of the transition of the profile information used in the vehicle 10. At the time of factory shipment, the default profile is stored in the eUICC 105 and is enabled. During the period from factory shipment to purchase and subscribing to the service of the communication system 2, the default profile is enabled, and the DCM 1 uses the default profile to connect to the communication system 2. In the HSS 21 of the communication system 2, the information of the default profile is registered (for example, refer to Figure 6 ).

[0155] When the subscription contract to the service of the communication system 2 is established, the configuration file for owner A is downloaded and activated. As a result, the default configuration file is disabled. During the period from the subscription contract to the service of the communication system 2 to the sale, the DCM 1 uses the configuration file for owner A to connect to the communication system 2. After the configuration file for owner A is activated, the user authentication certificate 154 is also obtained. In the HSS 21 of the communication system 2, the information of owner A and the information of the configuration file for owner A (for example, refer to Figure 6 ). In addition, the information of the default configuration file remains in the HSS 21.

[0156] When the vehicle 10 is sold to a used car dealer, the default profile is enabled and the owner A profile is disabled. At the same time, the identity verification certificate 154 in the owner profile ISD-P 15 is also disabled. In addition, since the contract between the owner of the vehicle 10 and the communication system 2 service is terminated, the information of the owner A and the information of the owner A profile are deleted from the HSS 21 of the communication system 2. After that, when the vehicle 10 is purchased and the new owner signs a contract for the communication system 2 service, the DCM 1 uses the default profile to connect to the communication system 2.

[0157] When the vehicle 10 is purchased again and the new purchaser B signs a contract for the service of the communication system 2, the configuration file for owner B is downloaded and activated, and the default configuration file is invalidated. Thereafter, the DCM 1 uses the configuration file for owner B to connect to the communication system 2. After the configuration file for owner B is activated, the DCM 1 also obtains the identity verification certificate 154 corresponding to the configuration file for owner B. In the HSS 21 of the communication system 2, the information of owner B and the information of the configuration file for owner B (for example, refer to Figure 6 ).

[0158] <Effects of the First Embodiment>

[0159] In the first embodiment, since the person confirmation certificate 154 is generated from the profile information 151 and is stored in the owner profile ISD-P 15, Fig.14 As shown, the owner profile information and the owner profile ISD-P 15 also change along with the change of the owner of the vehicle 10. Even if the owner of the vehicle 10 changes, the server 4 that performs authentication using the person confirmation certificate 154 can identify the new owner based on the person confirmation certificate 154. Thus, the server 4 can provide services corresponding to the attributes of the current owner of the vehicle 10, for example.

[0160] Furthermore, in the first embodiment, if Fig.14 As shown, even when the DCM 1 is not owned by a specific individual, that is, when the vehicle 10 is being sold as a new car or a used car, the DCM 1 can be connected to the communication system 2 using the default profile. Thus, even when the vehicle 10 is being sold as a new car or a used car, the communication system 2 can collect and control information related to the communication of the vehicle 10.

[0161] Furthermore, in the first embodiment, in addition to the change of the owner, the owner configuration file is updated due to the detection of the vulnerability of the person confirmation certificate 154 or the owner configuration file, and the person confirmation certificate 154 is also updated. This can compensate for the vulnerability of the person confirmation certificate 154 or the owner configuration file, and can further improve security.

[0162] <Other Changes>

[0163] The above-described embodiment is merely an example, and the present disclosure can be implemented with appropriate modifications without departing from the gist of the disclosure.

[0164] In the first embodiment, the communication system 2 is assumed to be a system corresponding to 4G. However, the present invention is not limited thereto, and the communication system 2 may be a system corresponding to 5G, 3G, and mobile communication methods after 6G. When the communication system 2 corresponds to 5G, the communication system 2 has UDM (Unified Data Management) instead of HSS, for example.

[0165] In the first embodiment, the communication system 2 is described as an example in which the communication system 2 is a system managed by the manufacturing business of the vehicle 10 and implements the collection and control of information related to the communication of the vehicle 10, but the application target of the technology described in the first embodiment is not limited to the vehicle 10 and the communication system 2. For example, it can also be applied to communication terminals such as smartphones or IoT terminals, and communication systems of their manufacturers. In addition, the manager of the communication system 2 can also accept the commission of the collection of communication-related information from the subscribers of the service of the communication system 2 from a third party, collect the communication-related information of the terminal connected to the communication system 2, and provide it to the third party. In this case, the collection target of the communication fee when the default profile is used becomes the third party.

[0166] The processes and means described in the present disclosure can be freely combined and implemented as long as no technical contradiction occurs.

[0167] Furthermore, a process described as being performed by one device may be shared and executed by a plurality of devices. Alternatively, a process described as being performed by different devices may be performed by one device. In a computer system, the hardware structure (server structure) used to implement each function can be flexibly changed.

[0168] The present disclosure can also be implemented by providing a computer program with the functions described in the above embodiments, and enabling one or more processors of the computer to read and execute the program. Such a computer program can be provided to the computer via a non-temporary computer-readable storage medium that can be connected to the system bus of the computer, or it can be provided to the computer via a network. Non-temporary computer-readable storage media include, for example, any type of disk (Floopy, registered trademark), hard disk drive (HDD), optical disk (CD-ROM, DVD, Blu-ray disc, etc.), read-only memory (ROM), random access memory (RAM), EPROM, EEPROM, magnetic card, flash memory, optical card, and any type of medium suitable for storing electronic instructions.

[0169] Explanation of symbols

[0170] 1…DCM;

[0171] 2…Communication system;

[0172] 3…SM-DP+;

[0173] 4…Server;

[0174] 5…Certification Bureau;

[0175] 6…Information processing device;

[0176] 10…Vehicles;

[0177] 11…communication control unit;

[0178] 12…LPAd;

[0179] 13…ISD-R;

[0180] 14…The default profile uses ISD-P;

[0181] 15…Owner uses profile using ISD-P;

[0182] 16…Service Control Department;

[0183] 21…HSS;

[0184] 22…AAA;

[0185] 41…Certification Department;

[0186] 42…Service provision department;

[0187] 43…user information DB;

[0188] 101…CPU;

[0189] 102…Memory;

[0190] 103… auxiliary storage device;

[0191] 104A…a first communication unit;

[0192] 104B…a second communication unit;

[0193] 105…eUICC;

[0194] 151…Configuration file information;

[0195] 152…Authentication information generation applet;

[0196] 153…Authentication information;

[0197] 154…Personal confirmation certificate;

[0198] 211…Control Department;

[0199] 212 ...Subscriber information DB;

[0200] 213 ...Terminal connection information DB.

Claims

1. An information processing device comprising: An embedded universal integrated circuit card that stores first profile information used in connection to a first communication system and in which a correspondence relationship is established with a first owner of the information processing device; a control unit configured to execute an operation of connecting to the first communication system using the first profile information, The control unit also performs the following operations, namely: Obtaining a first electronic certificate from a predetermined certification authority, the first electronic certificate being an electronic certificate that proves that first authentication information corresponding to the first profile information used in authentication performed by a first server trusted by the first communication system is information of the first owner; storing the first authentication information and the first electronic certificate in the embedded universal integrated circuit card; and The first server performs authentication using the first authentication information and the first electronic certificate.

2. The information processing device according to claim 1, wherein: A small application is also maintained, wherein the small application uses the first profile information as a key to generate the first authentication information, The control unit performs the following operations, namely: The applet is started and the first authentication information is generated.

3. The information processing device according to claim 2, wherein: The control unit also performs the following operations, namely: Obtaining the first profile information and the applet from a second server that manages profile information; and The first configuration file information and the applet are stored in the embedded universal integrated circuit card.

4. The information processing device according to claim 3, wherein: The control unit performs the following operations, namely: When the applet is updated, at least the updated applet is obtained from the second server and stored in the embedded universal integrated circuit card. Launch the updated applet and regenerate the first authentication information, and The first electronic certificate is obtained from the predetermined certification authority for the regenerated first authentication information, and the regenerated first authentication information and the reobtained first electronic certificate are stored in the embedded universal integrated circuit card.

5. The information processing device according to claim 1, wherein: The control unit performs the following operations, namely: When the second profile information, which is retained in the embedded universal integrated circuit card and used in the connection to the first communication system and which is associated with the second owner of the information processing device, is set to a valid state, a second electronic certificate is obtained from the predetermined certification authority, the second electronic certificate being an electronic certificate that proves that the second authentication information corresponding to the second profile information is information of the second owner, storing the second authentication information and the second electronic certificate in the embedded universal integrated circuit card, accepting authentication performed by the first server using the second authentication information and the second electronic certificate, and The first profile information and the first electronic certificate are invalidated or deleted.

6. The information processing device according to claim 1, wherein: The control unit specifies the first owner based on the first electronic certificate through the first server after the authentication is performed by the first server, and receives provision of a service of content corresponding to the first owner from the first server.

7. The information processing device according to claim 1, wherein: The embedded universal integrated circuit card does not retain the first configuration file information when it is shipped from the factory, but retains the default configuration file information used in the connection to the first communication system. The control unit performs the following operations, namely: Setting the default profile information to a valid state and connecting to the first communication system, When the first profile information is obtained from a second server that manages profile information and stored in the embedded universal integrated circuit card, the default profile information is invalidated and the first profile information is set to a valid state. When the information processing device is sold as a second-hand device by a predetermined second-hand sales business, the first profile information is invalidated or deleted, and the default profile information is set to a valid state.

8. The information processing device according to any one of claims 1 to 7, wherein: The information processing device is mounted on a vehicle. The first communication system is a system managed by a manufacturing business of the vehicle, When the vehicle is purchased by the first owner, the first profile information is issued via the first communication system.

9. A method, wherein an operation is performed by a computer, the computer having an embedded universal integrated circuit card for storing first profile information, the first profile information being information used in connection with a first communication system and associated with a first owner of an information processing device, The computer performs the following operations, namely: connecting to the first communication system using the first profile information; Obtaining a first electronic certificate from a predetermined certification authority, the first electronic certificate being an electronic certificate that proves that first authentication information corresponding to the first profile information used in authentication performed by a first server trusted by the first communication system is information of the first owner; storing the first authentication information and the first electronic certificate in the embedded universal integrated circuit card; and The first server performs authentication using the first authentication information and the first electronic certificate.

10. The method of claim 9, wherein: The computer further maintains a small application program, wherein the small application program uses the first configuration file information as a key to generate the first authentication information. The computer performs the following operations, namely: The applet is started and the first authentication information is generated.

11. The method of claim 10, wherein: The computer also performs the following operations, namely: Obtaining the first profile information and the applet from a second server that manages profile information; and The first configuration file information and the applet are stored in the embedded universal integrated circuit card.

12. The method of claim 11, wherein: The computer performs the following operations, namely: When the applet is updated, at least the updated applet is obtained from the second server and stored in the embedded universal integrated circuit card. Launch the updated applet and regenerate the first authentication information, and The first electronic certificate is obtained from the predetermined certification authority for the regenerated first authentication information, and the regenerated first authentication information and the reobtained first electronic certificate are stored in the embedded universal integrated circuit card.

13. The method of claim 9, wherein: The computer performs the following operations, namely: When the second profile information, which is retained in the embedded universal integrated circuit card and used in the connection to the first communication system and which is associated with the second owner of the information processing device, is set to a valid state, a second electronic certificate is obtained from the predetermined certification authority, the second electronic certificate being an electronic certificate that proves that the second authentication information corresponding to the second profile information is information of the second owner, storing the second authentication information and the second electronic certificate in the embedded universal integrated circuit card, accepting authentication performed by the first server using the second authentication information and the second electronic certificate, and The first profile information and the first electronic certificate are invalidated or deleted.

14. The method of claim 9, wherein: The embedded universal integrated circuit card does not retain the first configuration file information when it is shipped from the factory, but retains the default configuration file information used in the connection to the first communication system. The computer performs the following operations, namely: Setting the default profile information to a valid state and connecting to the first communication system, When the first configuration file information is obtained from a second server that manages configuration file information and the first configuration file information is stored in the embedded universal integrated circuit card, the default configuration file information is invalidated and the first configuration file information is set to a valid state. When the information processing device is sold as a second-hand device by a predetermined second-hand sales business, the first profile information is invalidated or deleted, and the default profile information is set to a valid state.

15. The method according to any one of claims 9 to 14, wherein: The computer is mounted on the vehicle. The first communication system is a system managed by a manufacturing business of the vehicle, When the vehicle is purchased by the first owner, the first profile information is issued via the first communication system.

16. An information processing device comprising: An embedded universal integrated circuit card capable of maintaining a plurality of profile information used in connection to a communication network; a control unit configured to set any one of the plurality of profile information to an effective state and connect to the communication network using the effective profile information, In the information processing device, The embedded universal integrated circuit card stores the default configuration file information used in the connection to the first communication system when the information processing device is shipped from the factory. The control unit performs the following operations, namely: When the information processing device is shipped from a factory, the default profile information is set to a valid state, and the default profile information is used to connect to the first communication system. When first profile information corresponding to a first owner of the information processing device is stored in the embedded universal integrated circuit card, the default profile information is invalidated, the first profile information is set to a valid state, and the first communication system is connected using the first profile information.

17. The information processing device according to claim 16, wherein: The default profile information is set with the content of charging communication fees to a predetermined operator.

18. The information processing device according to claim 16, wherein: When the information processing device is sold as a second-hand salesperson, the control unit invalidates or deletes the first profile information, sets the default profile information to a valid state, and connects to the first communication system using the default profile information.

19. The information processing device according to claim 16, wherein: The control unit also performs the following operations, namely: Obtaining a first electronic certificate from a predetermined certification authority, the first electronic certificate being an electronic certificate that proves that first authentication information corresponding to the first profile information used in authentication performed by a first server trusted by the first communication system is information of the first owner; storing the first authentication information and the first electronic certificate in the embedded universal integrated circuit card; and The first server performs authentication using the first authentication information and the first electronic certificate.

20. A system comprising: The information processing device according to any one of claims 16 to 19; A third server stores information indicating whether the profile information used in the connection to the first communication system performed by the information processing device is the default profile information.

Images