Control system and vehicle

Abstract

A control system according to one embodiment of the present invention is provided with: a first control device having a first security circuit that stores a first encryption key and restricts access from the outside, and a first storage circuit; and a second control device that has a second security circuit that stores a second encryption key and restricts access from the outside, and a second storage circuit. The first control device is capable of generating an authentication key used for authentication processing between the first control device and the second control device, is capable of generating a first authentication key by encrypting the authentication key using a first encryption key, and is capable of storing the first authentication key in a first storage circuit. The first control device can supply the generated authentication key to the second control device. The second control device can generate a second authentication key by encrypting the authentication key supplied from the first control device using the second encryption key, and can store the second authentication key in the second storage circuit.

Description

Technical Field

[0001] The present invention relates to a control system that performs authentication processing using an authentication key, and a vehicle equipped with such a control system. Background Art

[0002] Technology for improving security by using encryption keys is often used in electronic devices. For example, Patent Document 1 discloses a technology for a method of managing security access keys in a vehicle host device.

[0003] Prior art literature Patent Literature Patent Document 1: Japanese Patent Application Publication No. 2020-028120 Summary of the invention

[0004] A control system according to one embodiment of the present invention comprises a first control device and a second control device. The first control device comprises a first security circuit and a first storage circuit, wherein the first security circuit stores a first encryption key and restricts access from the outside. The second control device comprises a second security circuit and a second storage circuit, wherein the second security circuit stores a second encryption key and restricts access from the outside. The first control device is capable of generating an authentication key used in an authentication process between the first control device and the second control device, and is capable of generating a first authentication key by encrypting the authentication key using the first encryption key, and is capable of storing the first authentication key in the first storage circuit. The first control device is capable of supplying the generated authentication key to the second control device. The second control device is capable of generating a second authentication key by encrypting the authentication key supplied from the first control device using the second encryption key, and is capable of storing the second authentication key in the second storage circuit.

[0005] A vehicle according to an embodiment of the present invention includes the above-mentioned control system. The first control device includes an electronic control unit that controls the vehicle. BRIEF DESCRIPTION OF THE DRAWINGS

[0006] The accompanying drawings are designed to provide a further understanding of the present invention and are incorporated into this specification and constitute a part of this specification. The accompanying drawings serve to illustrate one embodiment and, together with the description, to explain the principle of the present invention.

[0007] Figure 1 It is an explanatory diagram showing a configuration example of a control system according to an embodiment of the present invention.

[0008] Figure 2 Yes means Figure 1 A block diagram of a structural example of a central electronic control unit and a communication module is shown.

[0009] Figure 3 Yes means Figure 1 An explanatory diagram of an operation example of the control system shown.

[0010] Figure 4 Yes means Figure 3 A sequence diagram showing an operation example of the control system.

[0011] Figure 5 Yes means Figure 1 An explanatory diagram of another operation example of the control system shown.

[0012] Fig. 6A Yes means Figure 5 A sequence diagram showing an operation example of the control system.

[0013] Figure 6B Yes means Figure 5 Another sequence diagram of an operation example of the control system shown. DETAILED DESCRIPTION

[0015] In control systems, it is desired to improve convenience while improving safety, and further improvement of convenience is expected.

[0016] It is desirable to provide a control system and a vehicle that can improve safety while improving convenience.

[0017] Hereinafter, several illustrative embodiments of the present invention will be described in detail with reference to the accompanying drawings. It should be noted that the following description shows a specific example of the present invention and cannot be interpreted as limiting the present invention. For example, each element including numerical values, shapes, materials, components, positions of each component, and connection methods of each component is only an example and cannot be interpreted as limiting the present invention. In addition, in the following illustrative embodiments, the structural elements not recorded in the independent claims based on the top-level concept of the present invention are arbitrary and can be set as needed. The accompanying drawings are schematic and do not mean illustrations according to the original size. In the entirety of this specification and the accompanying drawings, the same reference symbols are marked for structural elements with substantially the same functions and substantially the same structures, and repeated descriptions are omitted. In addition, structural elements that are not directly related to an embodiment of the present invention are not illustrated in the accompanying drawings.

[0018] <Implementation Method> [Structure example] Figure 1 A configuration example of a control system (control system 1 ) according to an embodiment is shown. The control system 1 is provided in a vehicle 9 . The vehicle 9 is a vehicle such as an automobile. The control system 1 includes a central electronic control unit (ECU: Electronic Control Unit) 10 , a plurality of electronic control units 19 , and a communication module 20 .

[0019] The central electronic control unit 10 is configured to control the operation of the vehicle 9 by controlling the operation of a plurality of electronic control units 19. In addition, the central electronic control unit 10 is connected to a diagnostic device 30 (described later) outside the vehicle, for example, via a communication cable, and can communicate with the diagnostic device 30. In addition, the central electronic control unit 10 is connected to a CAN (Controller Area Network) 9, and communicates with a communication module 20 via the CAN 9.

[0020] The plurality of electronic control units 19 are configured to control the operation of each device in the vehicle 9 based on instructions from the central electronic control unit 10. The plurality of electronic control units 19 include, for example, an electronic control unit 19 that controls a power transmission device such as an engine, an electronic control unit 19 that controls a steering device and / or a braking device, an electronic control unit 19 that controls lighting, doors, wipers, etc. inside and outside the vehicle, and an electronic control unit 19 that controls a driving assistance system.

[0021] The communication module 20 is configured to communicate with a base station by performing mobile communication such as 4G (4th Generation) or 5G (5th Generation). Thus, the communication module 20 can communicate with a server 40 (described later) connected to the Internet via the base station. In addition, the communication module 20 is connected to the CAN 9 and can communicate with the central electronic control unit 10 via the CAN 9.

[0022] In the control system 1, an authentication process can be performed between the central electronic control unit 10 and the communication module 20. In the central electronic control unit 10, for example, an encrypted authentication key KB1 is stored in a nonvolatile memory 14 described later, and in the communication module 20, for example, an encrypted authentication key KB2 is stored in a nonvolatile memory 24 described later. The central electronic control unit 10 and the communication module 20 can perform an authentication process using these authentication keys KB1 and KB2.

[0023] Figure 2 FIG. 2 shows an example of the configuration of the central electronic control unit 10 and the communication module 20 .

[0024] The central electronic control unit 10 includes a communication unit 11 , a storage unit 12 , a security module 15 , an external communication unit 16 , and a processing unit 17 .

[0025] The communication unit 11 is configured to communicate with the communication module 20 via the CAN 9 .

[0026] The storage unit 12 is configured to store data. The storage unit 12 includes a RAM 13 and a non-volatile memory 14. The RAM 13 is configured using, for example, a DRAM (Dynamic Random Access Memory) and is configured to temporarily store the processing content of the central electronic control unit 10. The non-volatile memory 14 is configured using, for example, a flash memory and is configured to store software executed by the central electronic control unit 10 and / or an encrypted authentication key KB1. The memory areas of the RAM 13 and the non-volatile memory 14 can be accessed from outside the central electronic control unit 10 via the communication unit 14 and the processing unit 17.

[0027] The security module 15 is a so-called HSM (Hardware Security Module) and is configured to store data in a secure memory area. In this example, the encryption key KA1 is stored in the security module 15. The security module 15 is configured to restrict access from outside the central electronic control unit 10. Thus, the security module 15 protects the stored data in a manner that cannot be easily rewritten and in a manner that does not leak the stored data.

[0028] The external communication unit 16 is configured to communicate with a diagnostic device 30 (described later) using a communication cable, for example, when the vehicle 9 breaks down.

[0029] The processing unit 17 is configured using, for example, one or more processors, and is configured to control the operation of the central electronic control unit 10 by executing software.

[0030] The communication module 20 includes a communication unit 21 , a storage unit 22 , a security module 25 , a wireless communication unit 26 , and a processing unit 27 .

[0031] The communication unit 21 is configured to communicate with the central electronic control unit 10 via the CAN 9 .

[0032] The storage unit 22 is configured to store data. The storage unit 22 has a RAM 23 and a non-volatile memory 24. The RAM 23 is configured using, for example, a DRAM, and is configured to temporarily store the processing content of the communication module 20. The non-volatile memory 24 is configured using, for example, a flash memory, and is configured to store software executed by the communication module 20 and / or an encrypted authentication key KB2. The memory areas of the RAM 23 and the non-volatile memory 24 can be accessed from the outside of the communication module 20 via the communication unit 21 and the processing unit 27.

[0033] The security module 25 is a so-called HSM, and is configured to store data in a secure memory area. In this example, the encryption key KA2 is stored in the security module 25. The security module 25 is configured to restrict access from outside the communication module 20. Thus, the security module 25 protects the data in a manner that the stored data cannot be easily rewritten and in a manner that the stored data is not leaked.

[0034] The wireless communication unit 26 is configured to communicate with a base station by performing mobile communication such as 4G or 5G. Thus, the wireless communication unit 26 can communicate with a server 40 (described later) connected to the Internet via the base station. The wireless communication unit 26 can download update software from the server 40, for example.

[0035] The processing unit 27 is configured using, for example, one or more processors, and is configured to control the operation of the communication module 20 by executing software.

[0036] In the control system 1, the central electronic control unit 10 generates an authentication key KB based on an instruction from the diagnostic device 30. Then, the central electronic control unit 10 sends the authentication key KB to the communication module 20. The central electronic control unit 10 generates an authentication key KB1 by encrypting the authentication key KB using the encryption key KA1, and stores the authentication key KB1 in the non-volatile memory 14. Similarly, the communication module 20 generates an authentication key KB2 by encrypting the authentication key KB using the encryption key KA2, and stores the authentication key KB2 in the non-volatile memory 24. Thereafter, the central electronic control unit 10 and the communication module 20 can perform authentication processing using the authentication keys KB1 and KB2 stored in the non-volatile memories 14 and 24.

[0037] Here, the central electronic control unit 10 corresponds to a specific example of the “first control device” of one embodiment of the present invention. The encryption key KA1 corresponds to a specific example of the “first encryption key” of one embodiment of the present invention. The security module 15 corresponds to a specific example of the “first safety circuit” of one embodiment of the present invention. The storage unit 12 corresponds to a specific example of the “first storage circuit” of one embodiment of the present invention. The communication module 20 corresponds to a specific example of the “second control device” of one embodiment of the present invention. The encryption key KA2 corresponds to a specific example of the “second encryption key” of one embodiment of the present invention. The security module 25 corresponds to a specific example of the “second safety circuit” of one embodiment of the present invention. The storage unit 22 corresponds to a specific example of the “second storage circuit” of one embodiment of the present invention. The authentication key KB corresponds to a specific example of the “authentication key” of one embodiment of the present invention. The authentication key KB1 corresponds to a specific example of the “first authentication key” of one embodiment of the present invention. The authentication key KB2 corresponds to a specific example of the “second authentication key” of one embodiment of the present invention.

[0038] [Action and function] Next, the operation and effect of the control system 1 of the present embodiment will be described.

[0039] (Overall action summary) First, refer to Figure 1 , 2 , the operation of the control system 1 is described. In the central electronic control unit 10, the communication unit 11 communicates with the communication module 20 via the CAN 9. The storage unit 12 stores data. The security module 15 stores the data in a secure memory area. The security module 15 stores the encryption key KA1. The external communication unit 16 communicates with the diagnostic device 30 using a communication cable, for example, when the vehicle 9 has a fault. The processing unit 17 controls the operation of the central electronic control unit 10.

[0040] In the communication module 20, the communication unit 21 communicates with the central electronic control unit 10 via the CAN 9. The storage unit 22 stores data. The security module 25 stores data in a secure memory area. The security module 25 stores an encryption key KA2. The wireless communication unit 26 communicates with the server 40 connected to the Internet via a base station by performing mobile communication. The wireless communication unit 26 can, for example, download software for updating from the server 40. The processing unit 27 controls the operation of the communication module 20.

[0041] (Detailed actions) Hereinafter, the operation of the control system 1 will be described in detail.

[0042] The control system 1 registers the authentication keys KB1 and KB2 used in the authentication process between the central electronic control unit 10 and the communication module 20. This operation will be described in detail below.

[0043] Figure 3 1 is an example of a vehicle 9 in which authentication keys KB1 and KB2 are stored. For example, when the vehicle 9 has a fault, the owner of the vehicle 9 takes the vehicle 9 to a dealer. In this example, the operator of the dealer connects the diagnostic device 30 to the central electronic control unit 10 of the vehicle 9 via the communication cable 8, and causes the diagnostic device 30 to diagnose the vehicle 9. In this example, the diagnostic device 30 detects a fault in the central electronic control unit 10. The operator of the dealer replaces the central electronic control unit 10. In this case, the control system 1 registers the authentication keys KB1 and KB2 used in the authentication process between the central electronic control unit 10 and the communication module 20 based on the instruction from the diagnostic device 30.

[0044] Figure 4 An example of the registration process of the authentication keys KB1 and KB2 of the control system 1 is shown.

[0045] First, the diagnostic device 30 makes a registration request for the authentication key to the central electronic control unit 10 of the vehicle 9 (step S101 ). The external communication unit 16 of the central electronic control unit 10 receives the registration request.

[0046] Next, the processing unit 17 of the central electronic control unit 10 generates an authentication key KB based on the authentication key registration request from the diagnostic device 30 , and stores the authentication key KB in the RAM 13 (step S102 ).

[0047] Next, the communication unit 11 of the central electronic control unit 10 supplies the authentication key KB generated in step S102 to the communication module 20 (step S103 ). The communication unit 21 of the communication module 20 receives the authentication key KB.

[0048] Then, the processing unit 27 of the communication module 20 stores the received authentication key KB in the RAM 23 (step S104 ).

[0049] The processing unit 17 of the central electronic control unit 10 generates an authentication key KB1 by encrypting the authentication key KB stored in the RAM 13 using the encryption key KA1 stored in the security module 15 , and stores the authentication key KB1 in the nonvolatile memory 14 (step S105 ).

[0050] Then, the processing unit 17 of the central electronic control unit 10 deletes the authentication key KB stored in the RAM 13 (step S106 ).

[0051] Similarly, the processing unit 27 of the communication module 20 generates the authentication key KB2 by encrypting the authentication key KB stored in the RAM 23 using the encryption key KA2 stored in the security module 25 , and stores the authentication key KB2 in the nonvolatile memory 24 (step S107 ).

[0052] Then, the processing unit 27 of the communication module 20 deletes the authentication key KB stored in the RAM 23 (step S108 ).

[0053] This completes the process.

[0054] Thus, the authentication key KB1 encrypted using the encryption key KA1 is stored in the nonvolatile memory 14 of the central electronic control unit 10 , and the authentication key KB2 encrypted using the encryption key KA2 is stored in the nonvolatile memory 24 of the communication module 20 .

[0055] In the control system 1, the central electronic control unit 10 and the communication module 20 can then perform authentication processing using the authentication keys KB1 and KB2. This operation will be described below.

[0056] Figure 5 An example of a vehicle 9 in which authentication processing using authentication keys KB1 and KB2 is performed is shown. For example, when software for updating software executed in a certain electronic control unit 19 among a plurality of electronic control units 19 is ready, the communication module 20 of the vehicle 9 downloads the update software from the server 40. Then, the central electronic control unit 10 and the communication module 20 of the vehicle 9 perform authentication processing using authentication keys KB1 and KB2, and when the authentication processing is successful, the central electronic control unit 10 updates the software of the electronic control unit 19 using the update software.

[0057] Fig. 6A , 6B An example of authentication processing using authentication keys KB1 and KB2 in the control system 1 is shown.

[0058] First, the server 40 transmits update software to the communication module 20 of the vehicle 9 (step S201 ). The wireless communication unit 26 of the communication module 20 receives the update software.

[0059] Next, the communication unit 21 of the communication module 20 makes an authentication request to the central electronic control unit 10 (step S202 ). The communication unit 11 of the central electronic control unit 10 receives the authentication request.

[0060] The processing unit 27 of the communication module 20 restricts access to the RAM 23 (step S203 ). Thus, for example, access to the memory area of ​​the RAM 23 from outside the communication module 20 is temporarily restricted.

[0061] Similarly, the processing unit 17 of the central electronic control unit 10 restricts access to the RAM 13 (step S204 ). Thus, for example, access to the memory area of ​​the RAM 13 from outside the central electronic control unit 10 is temporarily restricted.

[0062] Next, the processing unit 17 of the central electronic control unit 10 generates random number data including a multi-bit random number, and stores the generated random number data in the RAM 13 (step S205 ).

[0063] Next, the communication unit 11 of the central electronic control unit 10 supplies the random number data to the communication module 20 (step S206 ). The communication unit 11 of the communication module 20 receives the random number data.

[0064] Next, the processing unit 27 of the communication module 20 stores the random number data received in step S206 in the RAM 23 (step S207 ).

[0065] Next, the processing unit 27 of the communication module 20 generates an authentication key KB21 by decrypting the authentication key KB2 stored in the nonvolatile memory 24 using the encryption key KA2 stored in the security module 25, and stores the authentication key KB21 in the RAM 13 (step S208). The authentication key KB21 is the same as the authentication key KB generated in step S102.

[0066] Then, the processing unit 27 of the communication module 20 encrypts the random number data stored in the RAM 23 in step S207 using the decrypted authentication key KB21 (step S209 ).

[0067] Similarly, the processing unit 17 of the central electronic control unit 10 generates an authentication key KB11 by decrypting the authentication key KB1 stored in the nonvolatile memory 14 using the encryption key KA1 stored in the security module 15, and stores the authentication key KB11 in the RAM 13 (step S210). The authentication key KB11 is the same as the authentication key KB generated in step S102.

[0068] Then, the processing unit 17 of the central electronic control unit 10 encrypts the random number data stored in the RAM 13 in step S205 using the decrypted authentication key KB11 (step S211 ).

[0069] Next, the communication unit 11 of the communication module 20 supplies the random number data encrypted in step S209 to the central electronic control unit 10 (step S212 ). The communication unit 11 of the central electronic control unit 10 receives the encrypted random number data.

[0070] Next, the processing unit 17 of the central electronic control unit 10 performs authentication processing by comparing the random number data encrypted in step S211 with the encrypted random number data received from the communication module 20 in step S212 (step S213). That is, when these random number data are the same, it means that the authentication key KB21 used in the communication module 20 and the authentication key KB11 used in the central electronic control unit 10 are the same, so the processing unit 17 can perform authentication processing by comparing these random number data.

[0071] If the authentication process is successful, the communication unit 11 of the central electronic control unit 10 notifies the communication module 20 of software update permission (step S214 ). The communication unit 11 of the communication module 20 receives the update permission notification.

[0072] Next, the processing unit 27 of the communication module 20 deletes the authentication key KB21 and the random number data stored in the RAM 23 (step S215). Then, the processing unit 27 of the communication module 20 releases the access restriction of the RAM 23 performed in step S203 (step S216). Thus, for example, access to the memory area of ​​the RAM 23 from outside the communication module 20 is permitted.

[0073] Similarly, the processing unit 17 of the central electronic control unit 10 deletes the authentication key KB11 and the random number data stored in the RAM 13 (step S217). Then, the processing unit 17 of the central electronic control unit 10 releases the access restriction of the RAM 13 performed in step S204 (step S218). Thus, for example, access to the memory area of ​​the RAM 13 from outside the central electronic control unit 10 is permitted.

[0074] Next, the communication unit 21 of the communication module 20 supplies the update software received in step S201 to the central electronic control unit 10 (step S219 ). The communication unit 11 of the central electronic control unit 10 receives the update software.

[0075] Then, the processing unit 17 of the central electronic control unit 10 updates the software of the electronic control unit 19 to be updated using the received update software in step S220 (step S220 ).

[0076] As described above, the processing ends. Here, the authentication key KB11 corresponds to a specific example of the "third authentication key" of one embodiment of the present invention. The authentication key KB21 corresponds to a specific example of the "fourth authentication key" of one embodiment of the present invention.

[0077] Thus, the control system 1 includes: a central electronic control unit 10 having a first security circuit (security module 15) and a first storage circuit (storage unit 12), wherein the first security circuit (security module 15) stores a first encryption key (encryption key KA1) and restricts access from the outside; and a communication module 20 having a second security circuit (security module 25) and a second storage circuit (storage unit 22), wherein the second security circuit (security module 25) stores a second encryption key (encryption key KA2) and restricts access from the outside. The central electronic control unit 10 can generate an authentication key KB used in the authentication process between the central electronic control unit 10 and the communication module 20, can generate a first authentication key (authentication key KB1) by encrypting the authentication key KB using the first encryption key (encryption key KA1), and can store the first authentication key (authentication key KB1) in the first storage circuit (storage unit 12). The central electronic control unit 10 can supply the generated authentication key KB to the communication module 20. The communication module 20 can generate a second authentication key (authentication key KB2) by encrypting the authentication key KB supplied from the central electronic control unit 10 using the second encryption key (encryption key KA2), and can store the second authentication key (authentication key KB2) in the second storage circuit (storage unit 22). This can improve security and convenience.

[0078] That is, in order to improve security, a method may be used in which the generated authentication key is stored in the security module 15, 25. In this case, for example, in order to store the authentication key in the security module 15, the diagnostic device 30 needs to use the encryption key KA1 stored in the security module 15. Therefore, the diagnostic device 30 needs to store the encryption key KA1. That is, since the diagnostic device 30 needs to manage the encryption keys KA1 of the plurality of vehicles 9 respectively, management costs are incurred and convenience is impaired.

[0079] On the other hand, in the control system 1 of the present embodiment, instead of storing the authentication key in the security module 15, the authentication key KB is encrypted using the encryption key KA1 stored in the security module 15 to generate the authentication key KB1, and the authentication key KB1 is stored in the storage unit 12. Similarly, in the control system 1, the authentication key KB is encrypted using the encryption key KA2 stored in the security module 25 to generate the authentication key KB2, and the authentication key KB2 is stored in the storage unit 22. Thus, since the diagnostic device 30 does not need to store the encryption keys KA1 and KA2, the management cost can be suppressed and the convenience can be improved.

[0080] In the control system 1, the central electronic control unit 10 can temporarily store the generated authentication key (authentication key KB) in the first storage circuit (storage unit 12), and after storing the first authentication key (authentication key KB1) in the first storage circuit (storage unit 12), delete the authentication key (authentication key KB) stored in the first storage circuit (storage unit 12). The communication module 20 can temporarily store the authentication key (authentication key KB) supplied from the central electronic control unit 10 in the second storage circuit (storage unit 22), and after storing the second authentication key (authentication key KB2) in the second storage circuit (storage unit 22), delete the authentication key (authentication key KB) stored in the second storage circuit (storage unit 22). Thus, in the control system 1, since the encrypted authentication key KB1 is stored in the storage unit 12 and the unencrypted authentication key KB is deleted, and the encrypted authentication key KB2 is stored in the storage unit 22 and the unencrypted authentication key KB is deleted, the security can be improved.

[0081] In addition, in the control system 1, the central electronic control unit 10 can generate the authentication key KB based on the instruction from the diagnostic device 30. That is, for example, when a failure occurs in the central electronic control unit 10, the authentication key KB is generated based on the instruction from the diagnostic device 30. Thus, for example, since the authentication key KB can be generated again without continuously using the previous authentication key KB, the security can be improved.

[0082] In addition, in the control system 1, the central electronic control unit 10 can generate a third authentication key (authentication key KB11) by decrypting the first authentication key (authentication key KB1) using the first encryption key (encryption key KA1), and can perform a first process based on the third authentication key (authentication key KB11). In addition, the communication module 20 can generate a fourth authentication key (authentication key KB21) by decrypting the second authentication key (authentication key KB2) using the second encryption key (encryption key KA2), and can perform a second process based on the fourth authentication key (authentication key KB21). Then, the central electronic control unit 10 and the communication module 20 perform the authentication process by performing the first process and the second process. As a result, for example, the authentication process can be successful when the authentication key KB11 and the authentication key KB21 are identical to each other, and a predetermined process can be performed when the authentication process is successful, so that security can be improved.

[0083] [Effect] As described above, in this embodiment, there is provided: a central electronic control unit having a first security circuit and a first storage circuit, wherein the first security circuit stores a first encryption key and restricts access from the outside; and a communication module having a second security circuit and a second storage circuit, wherein the second security circuit stores a second encryption key and restricts access from the outside. The central electronic control unit can generate an authentication key used in the authentication process between the central electronic control unit and the communication module, can generate a first authentication key by encrypting the authentication key using the first encryption key, and can store the first authentication key in the first storage circuit. The central electronic control unit can supply the generated authentication key to the communication module. The communication module can generate a second authentication key by encrypting the authentication key supplied from the central electronic control unit using the second encryption key, and can store the second authentication key in the second storage circuit. Thus, it is possible to improve convenience while improving security.

[0084] In this embodiment, the central electronic control unit can temporarily store the generated authentication key in the first storage circuit, and after storing the first authentication key in the first storage circuit, can delete the authentication key stored in the first storage circuit. The communication module can temporarily store the authentication key supplied from the central electronic control unit in the second storage circuit, and after storing the second authentication key in the second storage circuit, can delete the authentication key stored in the second storage circuit. Thus, security can be improved.

[0085] In the present embodiment, since the central electronic control unit can generate the authentication key based on the instruction from the diagnostic device, security can be improved.

[0086] In this embodiment, the central electronic control unit can generate a third authentication key by decrypting the first authentication key using the first encryption key, and can perform the first process based on the third authentication key. The communication module can generate a fourth authentication key by decrypting the second authentication key using the second encryption key, and can perform the second process based on the fourth authentication key. Then, the central electronic control unit and the communication module perform the authentication process by performing the first process and the second process. In this way, security can be improved.

[0087] In the above, although an example of the embodiment of the present invention is described with reference to the accompanying drawings, the present invention is by no means limited to the above-mentioned embodiment. Those skilled in the art will understand that various modifications and / or changes can be made without departing from the scope defined by the attached claims. The present invention is intended to include these modifications and / or changes as long as these modifications or changes fall within the scope of the attached claims and their equivalents.

[0088] For example, in the above embodiment, although Fig. 6A , 6B The method shown performs authentication processing, but is not limited to this. Any authentication method may be used as long as the authentication key KB1 stored in the storage unit 22 of the central electronic control unit 10 and the authentication key KB2 stored in the storage unit 22 of the communication module 20 are used.

[0089] For example, in the above-described embodiment, although the central electronic control unit 10 and the communication module 20 perform the authentication process, the present invention is not limited thereto, and the authentication process may be performed by other various circuits in the vehicle 9 .

[0090] For example, in the above-described embodiment, although the present technology is applied to the vehicle 9 , the present technology is not limited thereto and may be applied to vehicles other than the vehicle 9 .

[0091] The effects described in this specification are merely examples, and the effects of the present invention are not limited to the effects described in this specification. Therefore, other effects can also be obtained with respect to the present invention.

[0092] Next, the present invention takes the following forms. (1) A control system comprising: A first control device having a first security circuit and a first storage circuit, wherein the first security circuit stores a first encryption key and restricts access from the outside; and a second control device having a second security circuit and a second storage circuit, wherein the second security circuit stores a second encryption key and restricts access from the outside, the first control device is capable of generating an authentication key used in an authentication process between the first control device and the second control device, generating a first authentication key by encrypting the authentication key using the first encryption key, and storing the first authentication key in the first storage circuit; The first control device is capable of supplying the generated authentication key to the second control device, The second control device can generate a second authentication key by encrypting the authentication key supplied from the first control device using the second encryption key, and can store the second authentication key in the second storage circuit. (2) According to the control system described in (1), the first control device can temporarily store the generated authentication key in the first storage circuit, and after storing the first authentication key in the first storage circuit, can delete the authentication key stored in the first storage circuit. The second control device can temporarily store the authentication key supplied from the first control device in the second storage circuit, and after storing the second authentication key in the second storage circuit, can delete the authentication key stored in the second storage circuit. (3) According to the control system described in (1) or (2) above, the first control device can generate the authentication key based on an instruction from an external device. (4) According to the control system described in any one of (1) to (3), the first control device can generate a third authentication key by decrypting the first authentication key using the first encryption key, and can perform the first process based on the third authentication key. the second control device can generate a fourth authentication key by decrypting the second authentication key using the second encryption key, and can perform the second process based on the fourth authentication key, The first control device and the second control device perform the authentication process by performing the first process and the second process. (5) A vehicle, comprising a control system according to any one of claims 1 to 4, The first control device includes an electronic control unit for controlling the vehicle.

[0098] Figure 2The processing unit 17 shown can be implemented by a circuit including at least one processor (e.g., a central processing unit (CPU)), at least one application-specific integrated circuit (ASIC) and / or at least one semiconductor integrated circuit including at least one field programmable gate array (FPGA). The at least one processor can be configured to execute by reading instructions from at least one non-transitory and tangible computer-readable medium. Figure 2 Such a medium may take various forms including, but not limited to, various magnetic media such as hard disks, various optical media such as CDs or DVDs, and various semiconductor memories (i.e., semiconductor circuits) such as volatile memories or nonvolatile memories. Volatile memories may include DRAM and SRAM. Nonvolatile memories may include ROM and NVRAM. ASICs are dedicated to executing Figure 2 The FPGA is designed to be able to be configured as an integrated circuit (IC) after manufacturing. Figure 2 The integrated circuit of all or part of the various functions in the processing unit 17 shown. It should be noted that although the processing unit 17 is described above as an example, it is not limited to this, and the processing unit 27 is also the same.

Claims

1. A control system, characterized in that: have: A first control device having a first security circuit and a first storage circuit, wherein the first security circuit stores a first encryption key and restricts access from the outside; as well as a second control device having a second security circuit and a second storage circuit, wherein the second security circuit stores a second encryption key and restricts access from the outside, the first control device is capable of generating an authentication key used in an authentication process between the first control device and the second control device, generating a first authentication key by encrypting the authentication key using the first encryption key, and storing the first authentication key in the first storage circuit; The first control device is capable of supplying the generated authentication key to the second control device, The second control device can generate a second authentication key by encrypting the authentication key supplied from the first control device using the second encryption key, and can store the second authentication key in the second storage circuit.

2. The control system according to claim 1, characterized in that: The first control device can temporarily store the generated authentication key in the first storage circuit, and after storing the first authentication key in the first storage circuit, can delete the authentication key stored in the first storage circuit. The second control device can temporarily store the authentication key supplied from the first control device in the second storage circuit, and after storing the second authentication key in the second storage circuit, can delete the authentication key stored in the second storage circuit.

3. The control system according to claim 1, characterized in that: The first control device can generate the authentication key based on an instruction from an external device.

4. The control system according to claim 1, characterized in that: The first control device can generate a third authentication key by decrypting the first authentication key using the first encryption key, and can perform the first process based on the third authentication key. the second control device can generate a fourth authentication key by decrypting the second authentication key using the second encryption key, and can perform the second process based on the fourth authentication key, The first control device and the second control device perform the authentication process by performing the first process and the second process.

5. A vehicle, characterized in that: A control system according to any one of claims 1 to 4, The first control device includes an electronic control unit for controlling the vehicle.

Images