VEHICLE-BASED SYSTEM AND COMMUNICATION PROCEDURES

Abstract

Vehicle-mounted system (1) for communicating with an external tool (2), wherein the vehicle-mounted system (1) comprises: a communication device (16); a tool key recovery device (11, S62-S64); and a communication controller (11, S65), wherein the vehicle-integrated system (1) and an external server (3) provide a vehicle communication system, wherein the external tool (2) stores a secret tool key, where the external server (3) stores information about an external tool, where the information about an external tool provides a public tool key and key identification information that are linked together, wherein the public tool key provides a public key that forms a pair with the secret tool key, wherein the key identification information provides identification information about the public tool key, wherein the communication device (16) communicates with the external server (3), wherein, when the external tool (2) requests a communication connection with the vehicle-bound system (1), the tool key acquisition device (11, S62-S64) sends the key identification information according to the external tool (2), which is a request source, to the external server (3) via the communication device (16), so that the tool key acquisition device (11, S62-S64) obtains the public tool key associated with the key identification information from the external server (3) via the communication device (16), wherein the communication controller (11, S65) performs cryptographic communication with the external tool (2) representing the request source using the public tool key obtained through the tool key acquisition device (11, S62-S64), wherein the communication controller (11, S65) performs the cryptographic communication with the external tool (2) in a public key encryption system using the public tool key, such that the communication controller (11, S65) shares a common key with the external tool (2), where the shared key provides cryptographic communication in a shared key encryption system, wherein the vehicle-mounted system (1) further comprises an update device (11, S67) for updating the common key, and wherein the update device (11, S67) generates an updated common key based on vehicle information.

Description

[0001] The present disclosure relates to a method of encrypted communication between a vehicle-bound system and an external tool.

[0002] In recent times, with the advent of electronically controlled vehicles, electronic components control various vehicle components, such as the engine and brakes. There is an increasing number of electronic control units (ECUs) connected to these electronic components. The ECUs can cooperate and share information with each other, thus forming a network (onboard system). The onboard system (vehicle-integrated system) is connected to an external tool via a connector. Using the external tool, the onboard system can diagnose vehicle states through the ECU or rewrite (reprogram) a program stored in the ECU.

[0003] There is a known technology (see JP 2009 - 81 755 A) that encrypts transmitted data to improve the security of the information being transmitted. Cryptographic communication between the external tool and the onboard system can prevent unauthorized access to communication data.

[0004] The aforementioned on-board system may be subject to unauthorized access (for example, unauthorized sabotage with the ECU program) using an unauthorized external tool.

[0005] Reference is also made to US 7 181 615 B2; to Menezes, A., Van Oorschot, P., Vanstone, S.: Handbook of Applied Cryptography. Boca Raton, FL, USA: CRC Press, 1996. pp. 1-48, 489-541, 543-590. ISBN 0-8493-8523-7. URL: https: / / cacr.uwaterloo.ca / hac / [accessed on December 18, 2024]; to the Wikipedia entry "Pretty Good Privacy", October 11, 2011. URL: https: / / de.wikipedia.org / w / index.php?title=Pretty_Good_Privacy&oldid=94658973 [accessed on December 18, 2024]; and referred to DE 10 2009 037 193 A1, which was determined to be state of the art.

[0006] One of the purposes of this disclosure is to provide a technology that prevents an unauthorized external tool from communicating with a vehicle system.

[0007] The problem is solved by the subject matter and procedures of the independent claims. Advantageous further developments are found in the claims.

[0008] A vehicle-integrated system for communicating with an external tool includes: a communication device, a tool key acquisition device, and a communication controller. The vehicle-integrated system and an external server provide a vehicle communication system. The external tool stores a secret tool key. The external server stores information about the external tool. This information provides a public tool key and key identification information, which are linked together. The public tool key provides a public key that forms a pair with the secret tool key. The key identification information provides identification information about the public tool key. The communication device communicates with the external server.When the external tool requests a communication link with the vehicle-integrated system, the tool key acquisition device sends the key identification information corresponding to the external tool, which is the request source, to the external server via the communication device. The tool key acquisition device then obtains the public tool key associated with the key identification information from the external server via the communication device. The communication controller then performs cryptographic communication with the external tool, which is the request source, using the public tool key obtained by the tool key acquisition device.

[0009] The communication controller executes cryptographic communication with the external tool in a public-key encryption system using the tool's public key, so that the communication controller shares a common key with the external tool. This common key enables cryptographic communication in a common-key encryption system. The vehicle-integrated system also has an update mechanism for updating the common key. The update mechanism generates an updated common key based on vehicle information.

[0010] The aforementioned vehicle-mounted system performs cryptographic communication with the external tool using the public tool key stored (registered) on the server. An external tool used for cryptographic communication may be restricted to the external tool that stores the secret tool key, which pairs with the public tool key. For example, an external tool could improperly access identification information via the public tool key stored (registered) on a server that does not store (register) the external tool's public tool key. Even in such a case, an error in obtaining the secret tool key disables cryptographic communication using the public key.Only the authenticated external tool can register its public tool key with the server and prevent an unauthenticated external tool from establishing a communication connection with the vehicle-based system.

[0011] A communication method for communication between a vehicle-integrated system and an external tool includes: sending key identification information from the external tool to the vehicle-integrated system, wherein the key identification information provides identification information about a public tool key of the external tool; sending the key identification information from the vehicle-integrated system to a server, wherein the external server stores the public tool key and key identification information about the public key, which are linked together; sending the public tool key from the server to the vehicle-integrated system, wherein the public tool key is linked to the key identification information received by the server;Sending a shared key from the vehicle-integrated system to the external tool, the shared key being encrypted using the public tool key received by the vehicle-integrated system; and decrypting an encrypted shared key received by the external tool using a secret tool key paired with the external tool's public tool key; and performing cryptographic communication with the vehicle-integrated system using the shared key.

[0012] The communication procedure further includes: generating the external tool's secret tool key and public tool key; sending the external tool's public tool key and tool specification information to the external server, the tool specification information specifying the external tool; and verifying the tool specification information using the external server to determine whether the external tool that sent the tool specification information is authenticated.Storing the public key and key identification information on the external server when it is determined that the external tool that sent the tool specification information is authenticated, with the key identification information being associated with the public tool key so that the key identification information and the public tool key are linked; and sending the key identification information from the external server to the external tool that is a sending source when it is determined that the external tool that sent the tool specification information is authenticated.

[0013] In the above procedure, the public tool key stored (registered) on the server is used to encrypt the shared key. The vehicle-integrated system sends the shared key to the external tool to share it. The vehicle-integrated system can then perform cryptographic communication with the external tool using the shared key. In such a case, the vehicle-integrated system can restrict the targeted external tool to the one that stores a secret tool key paired with the public tool key. For example, an external tool could illegitimately access identification information via the public tool key stored (registered) on the server that does not store (register) the external tool's public tool key.Even in such a case, an error in obtaining the secret tool key disables cryptographic communication (decryption of the encrypted shared key) using the public tool key. Cryptographic communication using the shared key is unavailable. Only the authenticated external tool can register its public tool key with the server, preventing an unauthenticated external tool from establishing communication links with the vehicle-integrated system. Once the shared key is established, the vehicle communication system can perform cryptographic communication based on the shared-key encryption system with reduced processing overhead, instead of cryptographic communication based on the public-key encryption system.

[0014] The foregoing and further tasks, features and advantages of the present disclosure will become more apparent from the following detailed description in conjunction with the drawings.

[0015] They show: Fig. 1 a block diagram representing a vehicle communication system according to one embodiment; Fig. 2 a flowchart representing a processing operation performed by the vehicle-integrated communication system; Fig. 3 a flowchart representing a tool registration process performed by a controller of an external tool; Fig. Figure 4 is a flowchart representing tool communication processing performed by the controller of an external tool; Fig. Figure 5 is a flowchart depicting a key registration / management process performed by a central controller; Fig. Figure 6 is a flowchart representing key distribution processing performed by the central controller; Fig. Figure 7 is a flowchart depicting a vehicle registration process performed by a GW-ECU CPU; and Fig. Figure 8 is a flowchart representing vehicle communication processing performed by the GW-ECU CPU.

[0016] Embodiments of the present disclosure are explained in more detail with reference to the drawings. 1. Overall configuration

[0017] Fig. Figure 1 is a block diagram representing a vehicle communication system according to one embodiment. The vehicle communication system comprises an onboard system (i.e., vehicle-integrated system) 1, an external tool 2, and a central server 3. The onboard system 1 is installed in a vehicle. The external tool 2 is used to communicate with the onboard system 1. The central server 3 stores or manages information about more than one vehicle (onboard system 1) and information about more than one external tool 2.

[0018] The on-board system 1 includes more than one electronic control unit (ECU) intended for different sections of a vehicle. The ECUs include a network coupler ECU, also known as a gateway ECU (GW-ECU) 11, a CAN-BT ECU 12, and other ECUs 13 with different functions. The GW-ECU 11, the CAN-BT ECU 12, and the other ECUs 13 are connected via a bus, which is a shared communication line (multiplex communication line), to configure a vehicle-integrated LAN. The ECUs communicate with each other via bus 14 in accordance with the CAN (Controller Area Network) protocol. The on-board system 1 also includes a wireless on-board unit 16, equivalent to a data communication module (DCM), which is connected via the GW-ECU 11 and a dedicated communication line 15.In the present embodiments, although the ECUs communicate with each other in accordance with the CAN protocol, the ECUs can communicate with each other in accordance with another protocol.

[0019] The GW-ECU 11 is located between a data line connector (hereinafter referred to simply as the connector) 17, which connects the external tool 2 from outside the vehicle. In other words, the GW-ECU is provided for a communication path that connects the external tool 2 and the ECU 13. In the on-board system 1, the GW-ECU 11 communicates directly with the external tool 2. The ECU 13 communicates with the external tool 2 via the GW-ECU 11. That is, the external tool 2 is connected to the ECU 13 via the GW-ECU 11, but not directly to it. The GW-ECU functions as a conversion device or a so-called repeating device, which enables communication between the external tool 2 and the ECU.

[0020] In particular, the GW-ECU 11 includes a CPU 111 and a flash memory 112, that is, non-volatile memory capable of electronically rewriting stored content. The flash memory 12 stores a secret key Sv, a public key Pv, and a shared key C as key data for the on-board system 1. The public key Pv forms a pair with the secret key Sv. The key C is used for cryptographic communication based on a shared-key encryption system within the vehicle. The secret key Sv is managed as confidential information. As described later, the public key Pv is stored in the center 3 and managed in such a way that it is made available to the external tool. The shared key C is also stored in the CAN-BT-ECU 12 and the other ECUs 13 and is used to encrypt transmitted data and decrypt received data.

[0021] The CAN-BT-ECU 12 has two functions. One performs communication in accordance with the CAN protocol via bus 14. The other performs near-field communication in accordance with the Bluetooth (registered trademark) standard. As explained above, the CAN-BT-ECU 12 stores the same common key C as the one for the GW-ECU 11.

[0022] Each ECU 13 stores a software program that implements different functions. As explained above, each ECU 13 stores the same common key as the one intended for the GW-ECU 11.

[0023] The wireless onboard equipment 16 performs communication using mobile phone networks and internet communication networks and provides long-distance wireless communication using local mobile phone base stations. The onboard system 1 includes the wireless onboard equipment 16 and enables long-distance wireless communication with the center 3.

[0024] While the external tool 2 is connected to the connector 17, the external tool 2 diagnoses vehicle conditions through the ECU 13 installed in the vehicle, reads data, controls controller parts based on the function of the ECU 13, and writes or reprograms a program stored in the ECU 13.

[0025] In particular, the external tool 2 includes a controller 21, a memory section 22, and a communication section 23. The memory section 22 stores a secret key St and a public key Pt, which forms a pair with the secret key, as key data for the external tool 2. The secret key St is managed as confidential information. As will be explained later, the public key Pt is stored in the center 3 and is managed in such a way that it is made available to the onboard system 1. The communication section 23 has two functions. One performs wired communication with the GW-ECU 11 of the onboard system 1 via connector 17. The other performs wireless communication with the center using mobile phone networks and internet communication networks.

[0026] Center 3 is equivalent to a server managed by an organization such as a vehicle manufacturer or a government agency, which manages the connection between external tool 2 and onboard system 1. Center 3 stores or manages the public key Pv of onboard system 1 and the public key Pt of external tool 2.

[0027] Specifically, the center 3 includes a controller 31, a memory section 32, and a communication section 33. The memory section stores a tool list and a vehicle list. The tool list manages public keys Pt(1), Pt(2), ..., and Pt(M) for more than one external tool. The vehicle list manages public keys Pv(1), Pv(2), ..., and Pv(N) for more than one onboard system 1. The tool list stores the public key Pt, which is associated with the tool specification information. The tool specification information specifies an ID (key identification information) for the public key Pt and the external tool 2. For example, the tool specification information includes a serial number of the tool and user information such as the user's name, date of birth, address, and telephone number.Similarly, the vehicle list stores the public key Pv, which is linked to the vehicle specification information that identifies the vehicle (Onboard System 1). For example, the vehicle specification information includes a license number and a serial number of the vehicle. Communications Section 33 performs wireless communication with Onboard System 1 and External Tool 2 using cellular and internet communication networks. 2. Overview of the processing

[0028] According to Fig. 2. The following section explains the process sequences (communication procedures) that are executed by the vehicle communication system according to the embodiment. Steps S11 and S12, etc., which are described in Fig. The diagrams shown in section 2 correspond to those used for flowcharts, which are in Fig. 3 to Fig. 8 are shown. (1) Preparation of the secret key and the public key and authentication of the external tool

[0029] In the on-board system 1, the GW-ECU 11 generates the secret key Sv and the public key Pv according to the public-key encryption system provided in the vehicle communication system according to the embodiment, and stores the generated shared keys in its memory section (flash memory 112) (S51 and S52). A known encryption system (for example, RSA) can be used as the public-key encryption system. The GW-ECU 11 sends the generated public key Pv and the vehicle specification information to the center 3 and requests registration of the public key Pv (S53). The center 3 associates the public key Pv with the vehicle specification information received from the on-board system 1 and registers or stores it in the vehicle list (S31 and S32). The center 3 can store the public key Pv before the vehicles are delivered.In such a case, the public key can be registered or updated after delivery following an ECU replacement or changes made by the user.

[0030] In on-board system 1, the GW-ECU 11 generates the shared key C and sends the generated shared key C to the other ECUs (CAN-BT-ECU 12 and ECU 13) in the vehicle (S54). The ECUs (GW-ECU 11, CAN-BT-ECU 12, and ECU 13) included in on-board system 1 share the shared key C and conduct cryptographic communication according to the shared-key encryption system using the shared key C.

[0031] The external tool 2 also generates the secret key St and the public key Pt according to the same public-key encryption system provided for the GW-ECU 11 and stores the generated secret keys in its memory section 22 (S11 and S12). The external tool sends the generated public key Pt and the tool specification information to the center 3 and requests registration of the public key Pt (S13).

[0032] Center 3 generates an ID for the public key Pt, which is received by external tool 2. Center 3 then adds the public key Pt, the ID, and the associated tool specification information to the tool list or stores them (S33 to S35) and informs external tool 2 of the public key ID (S36 and S37). External tool 2 receives the public key ID from Center 3 and stores the ID in its memory section (S14 and S15). At this stage, Center 3 authenticates external tool 2 (authenticated tool). (2) Cryptographic communication using the secret key and the public key (sharing the shared key)

[0033] The authenticated external tool 2 has obtained the ID of the public key Pt from center 3. To connect to the vehicle (onboard system 1) for communication, external tool 2 sends the vehicle specification information to center 3 and requests the vehicle's public key Pv (S21). Center 3 receives the vehicle specification information from external tool 2 and then transmits the vehicle's public key Pv to establish the connection with external tool 2 (S41 to S44). The vehicle list stores the public key Pv in association with the vehicle specification information. External tool 2 receives the vehicle's public key Pv to establish the connection.The external tool 2 then encrypts its public key ID Pt using the public key Pv and sends the public key ID Pt to the GW-ECU 11 through connector 17 to request the communication link (S22 and S23).

[0034] The GW-ECU 11 receives the encryption data (encrypted ID) in response to the communication link request from external tool 2. Using its secret key Sv, the GW-ECU 11 decrypts the received encryption data to obtain the ID of the public key Pt for the requesting external tool 2 (S61 and S62). The GW-ECU 11 sends the ID to center 3 and requests the public key Pt associated with the ID, i.e., the public key Pt for external tool 2 (S63). Center 3 receives the public key Pt associated with the ID from onboard system 1 and sends the public key Pt to onboard system 1 (S45 and S46). The GW-ECU 11 receives or obtains the public key Pt from center 3 and encrypts the shared key C using the public key Pt.Using connector 17, the GW-ECU 11 sends the shared key C to the external tool 2, which requested the communication link (S64 and S65). In other words, the onboard system 1 performs cryptographic communication with the external tool 2 according to the public-key encryption system using the public key Pt. The external tool 2 receives the encryption data (encrypted shared key C) from the GW-ECU 11 and decrypts the encryption data using its secret key St to obtain the shared key C (S24 and S25). (3) Cryptographic communication using the shared key C

[0035] After obtaining the shared key C, external tool 2 uses it to encrypt data to be transmitted to ECU 13 and sends the data to GW-ECU 11 (S26). GW-ECU 11 receives the encrypted data from external tool 2 and either sends it directly or forwards it to ECU 13 (S66). ECU 13 receives the encrypted data from GW-ECU 11 and decrypts the data using the shared key C. ECU 13 sends data to external tool 2 in a similar manner. ECU 13 encrypts the data to be sent using the shared key C and transmits the encrypted data. External tool 2 decrypts the received data using the shared key C (S26). External tool 2 and ECU 23 perform cryptographic communication via GW-ECU 11 according to the shared-key encryption system using the shared key C.

[0036] After communication between external tool 2 and ECU 13 is complete, GW-ECU 11 generates a new shared key C and sends this shared key to the other ECUs (CAN-BT-ECU 12 and ECU 13) in the vehicle to update it and delete the old shared key C (S67). Subsequent cryptographic communication uses the new shared key C, which is not intended for external tool 2. External tool 2 then deletes the previously used shared key C (S27). 3. Specific processing procedures

[0037] The following describes specific processing procedures that are performed in the on-board system 1 (GW-ECU 11), the external tool 2 and the center 3. (1) Processing that is performed in the external tool 2

[0038] Fig. Figure 3 is a flowchart representing a tool registration process performed by the controller 21 of the external tool 2, so that the center 3 can authenticate the external tool 2.

[0039] Controller 21 generates the secret key St and the public key Pt according to a predetermined public-key encryption system (S11). Controller 21 stores the generated secret key St in memory section 22 of external tool 2 (S12). Controller 21 sends the tool specification information about the generated public key Pt and external tool 2 to center 3 and requests their registration (S13). The order of steps S12 and S13 is not restricted to these and can be reversed.

[0040] Controller 21 receives the ID of the public key Pt from the center (S14), stores the received ID in memory section 22 of external tool 2 (S15), and completes the tool registration processing. Fig. 3. According to the tool registration process, center 3 authenticates the external tool 2.

[0041] Fig. Figure 4 is a flowchart representing a tool communication processing operation performed by the controller 21 of the external tool 2, enabling the external tool 2 to communicate with the ECU 13 attached to a vehicle to diagnose vehicle conditions or rewrite a program.

[0042] Controller 21 sends the vehicle specification information for communication to Center 3 (S21). Controller 21 receives the public key Pv relating to the vehicle for communication from Center 3 (S22). Controller 21 encrypts its ID for the public key Pt using the public key Pv obtained from Center 3, i.e., the public key Pv relating to the vehicle for communication. Controller 21 sends the ID of the GW-ECU 11 of the on-board system 1 via connector 17 to request the communication connection (S23). Controller 21 receives the shared key C from the GW-ECU 11 of the on-board system 1 (S24). The public key Pt of the external tool 2 is used to encrypt the shared key C.Controller 21 decrypts the shared key C using its secret key St to obtain the shared key C (S25).

[0043] Controller 21 performs cryptographic communication with ECU 13 using the shared key C (S26). Specifically, Controller 21 uses the shared key C to encrypt data to be transmitted to ECU 13 and sends the data to ECU 13 via GW-ECU 11. Controller 21 uses the shared key C to decrypt the encrypted data received by ECU 13 via GW-ECU 11. After completing communication with ECU 13, Controller 21 discards the shared key C (S27) and closes the tool communication processing. Fig. 4 from. (2) Processing that is carried out in center 3

[0044] Fig. Figure 5 is a flowchart that represents a key registration / management process performed by the controller 31 of center 3 to manage the public key Pv of the onboard system 1 and the public key Pt of the external tool 2.

[0045] Controller 31 determines whether the on-board system 1 requests the registration of the public key Pv (S31). If registration of the public key Pv is requested (YES for S31), Controller 31 enters the public key Pv and the vehicle specification information received from the on-board system 1 into the vehicle list in conjunction with each other (S32).

[0046] Controller 31 determines whether external tool 2 requests registration of the public key Pt (S33). If registration of the public key Pt is requested (YES at S33), the controller uses the tool specification information received from external tool 2 to determine whether the requesting external tool 2 is authenticated (S34). In particular, for example, controller 31 determines whether the serial number included in the tool specification information received from external tool 2 matches the serial number of the authenticated tool specified by a vehicle manufacturer.

[0047] If the requesting external tool 2 is not authenticated (NO for S34), the controller 31 informs the requesting external tool 2 of an error indicating that authentication failed (S35). If the requesting external tool 2 is authenticated (YES for S34), the controller 31 generates an ID for the public key Pt received by the external tool 2 and registers (manages) the public key Pt, the ID, and the tool specification information in the tool list, linking them together (S36). The controller 31 sends the ID of the public key Pt to the external tool 2 (S37). The key registration / management processing in Fig. 5 repeats the steps S31 to S37 mentioned above.

[0048] Fig. Figure 6 is a flowchart that represents a key distribution process performed by the controller 31 of center 3 to distribute the public key Pv of the onboard system and the public key Pt of external tool 2 to the outside (onboard system 1 or external tool 2).

[0049] Controller 31 determines whether external tool 2 requests the transmission of the public key Pv to the onboard system 1 (S41). If transmission of the public key Pv is requested (YES for S41), controller 31 uses the ID received from external tool 2 to determine whether the sending external tool 2 is authenticated, that is, whether center 3 enters the ID of external tool 2 (S42). If the sending external tool 2 is not authenticated (NO for S42), controller 31 informs the sending external tool 2 of an error indicating that authentication failed (S43). If the sending external tool 2 is authenticated (YES for S42), controller 31 sends the public key Pv to the requesting external tool 2 (S44). The public key Pv is linked to the vehicle-specific information received by external tool 2.

[0050] Controller 31 determines whether onboard system 1 requests the sending of the public key Pt in external tool 2 (S45). If the sending of the public key Pt is requested (YES at S45), controller 31 sends the public key Pt, which is associated with the ID received from onboard system 1, to the requesting onboard system 1 (S46). The key distribution processing of Fig. 6 repeats the steps S41 to S46 explained above. (3) Processing performed in the on-board system 1 (GW-ECU 11)

[0051] Fig. Figure 7 is a flowchart representing a vehicle registration process performed by the CPU 111 of the GW-ECU 11 to register the public key Pv of the onboard system 1 in the center 3.

[0052] CPU 111 generates the secret key Sv and the public key Pv according to the public-key encryption system (S51). CPU 111 saves the generated secret key Sv in the flash memory 112 of GW-ECU 11 (S52). CPU 111 transmits the generated public key Pv and the vehicle specification information via the vehicle (onboard system 1) to the center 3 and requests registration (S53). The sequence of steps S52 and S53 is not restricted to these and can be reversed.

[0053] CPU 111 generates the shared key C and sends it to the other ECUs (CAN-BT-ECU 12 and ECU 13) in the vehicle (S54). CPU 111 then completes the vehicle registration processing. Fig. 7 from.

[0054] Fig. Figure 8 is a flowchart representing vehicle communication processing performed by the CPU 111 of the GW-ECU 11 to distribute communication between the external tool 2 connected to connector 17 and the ECU.

[0055] CPU 111 receives a request for a communication link from external tool 2 (S61). CPU 111 receives encryption data from external tool 2. The encryption data represents the ID of the public key Pt for external tool 2 and is encrypted using the public key Pv of onboard system 1. CPU 111 uses its secret key Sv to decrypt the encryption data to obtain the ID of the public key Pt (S62). CPU 111 sends the ID of the public key to center 3 and requests the return of the public key Pt associated with the ID, that is, the public key Pt for external tool 2, which requested the communication link (S63). CPU 111 receives the public key Pt from center 3 (S64).CPU 111 uses the public key Pt to decrypt the shared key C and sends it to the external tool 2 (S65).

[0056] CPU 111 distributes communication between external tool 2 and ECU 13 using the shared key C (S66). After communication between external tool 2 and ECU 13 is complete, CPU 111 generates a new shared key C to update the existing shared key C (S67). The shared key C is generated based on vehicle information with varying values ​​such as fuel level, distance traveled, and engine speed. CPU 111 sends the generated shared key C to the other ECUs (CAN-BT-ECU 12 and ECU 13) in the vehicle to update the shared key C (S67). CPU 111 then completes the vehicle communication processing. Fig. 8 from. 4. Effects

[0057] In the vehicle communication system according to the embodiment described above, the onboard system (GW-ECU 11) uses the public key Pt, which is stored in the center 3, to perform cryptographic communication with the external tool 2. Specifically, the onboard system 1 (GW-ECU 11) encrypts a shared key C using the public key Pt and sends the shared key C to the external tool 2 to share the shared key. The onboard system 1 (GW-ECU 11) can restrict the external tool 2 for cryptographic communication, which uses the public key Pt and the shared key C, to the external tool 2 that stores the secret key St, which forms a pair with the public key Pt.

[0058] It is now assumed that unauthorized access to the ID of the public key Pt, which is registered in center 3, has occurred if the public key Pt of external tool 2 is not registered in center 3. In such a case, an error in obtaining the secret key St disables cryptographic communication using the public key Pt (decryption of the encrypted shared key C) and also disables cryptographic communication using the shared key C. Only the authenticated external tool 2 is permitted to register the public key Pt in center 3, thereby preventing any external tool from establishing an unauthorized communication connection with the onboard system 1.

[0059] After the shared key C is shared, the vehicle communication system performs cryptographic communication based on the shared-key encryption system, resulting in a reduced processing load compared to cryptographic communication based on the public-key encryption system. This allows the vehicle communication system to reduce the processing load of the onboard system 1.

[0060] The onboard system 1 (GW-ECU 11) updates the shared key C (S67) each time it performs cryptographic communication with the external tool 2 based on the shared-key encryption system. A different shared key is used each time the onboard system 1 performs cryptographic communication with the external tool 2 based on the shared-key encryption system. The vehicle communication system can provide higher security than a configuration that does not update the shared key C. The onboard system 1 generates the updated key C based on vehicle information. The onboard system 1 can vary the shared key C according to the vehicle information in a largely unpredictable manner.

[0061] In onboard system 1, the GW-ECU 11 communicates directly with external tool 2. External tool 2 can request the onboard system to establish a communication link with ECU 13. In such a case, GW-ECU 11 obtains the public key of the requesting external tool 2 from center 3 (S63 and S64). Onboard system 1 performs cryptographic communication using the public key Pt (S65). As a representative of the other ECUs, GW-ECU determines whether a request from external tool 2 for a communication link with ECU 13 should be allowed. ECU 13, which serves as the communication target, does not need to perform this determination process individually. The functions of ECU 13 are not duplicated. Costs for onboard system 1 can be reduced.

[0062] Onboard system 1 (GW-ECU 11) uses the public key Pv to perform cryptographic communication with external tool 2 based on the public-key encryption system and obtains the public key ID Pt from external tool 2 (S62). Onboard system 1 can securely obtain the public key ID with the help of external tool 2.

[0063] Onboard system 1 (GW-ECU 11) itself generates the secret key Sv and the public key Pv (S51). Onboard system 1 stores the secret key Sv in flash memory 112 (S52) and sends the public key Pv to center 3 (S53). Once the secret key is generated, it does not need to be exchanged, unlike in a configuration that generates the secret key Sv using a device other than onboard system 1 (GW-ECU 11). This improves the confidentiality of the secret key Sv. By sending the public key Pv to center 3, it can be easily provided to external tool 2.

[0064] External tool 2 itself generates the private key St and the public key Pt (S11), stores the private key St in memory section 22 (S12), and sends the public key Pt to center 3 (S13). The confidentiality of the private key St can be improved compared to a configuration that generates the private key St using a device other than external tool 2. Center 3 decides whether external tool 2, which sends the public key Pt, is authenticated (S34). If it decides that external tool 2 is authenticated, center 3 stores the public key Pt and the associated ID (S36). Center 3 can prevent registration of the public key for an unauthenticated external tool.

[0065] When a public key ID Pt is sent to onboard system 1 (S23), external tool 2 encrypts the public key ID Pt using the public key Pv, which forms a pair with the private key Sv of onboard system 1. External tool 2 can then send the public key ID Pt securely.

[0066] External tool 2 sends the vehicle specification information to center 3 (S21). Center 3 receives the vehicle specification information at S21 and sends the public key Pv, which is associated with the received vehicle specification information, to external tool 2, which sent the vehicle specification information (S44). External tool 2 can easily obtain the public key Pv of the onboard system 1 for communication from center 3.

[0067] Onboard system 1 is equivalent to an example of an onboard system. The GW-ECU 11 is equivalent to a first electronic control unit. The flash memory 112 is equivalent to an example of a storage device. The ECU 13 is equivalent to a second electronic control unit. The wireless onboard device 16 is equivalent to an example of a communication device. The external tool 2 is equivalent to an example of an external tool. The center 3 is equivalent to an example of a server. The secret key Sv is equivalent to an example of a secret vehicle key. The public key Pv is equivalent to an example of a public vehicle key. The secret key St is equivalent to an example of a secret tool key. The public key Pt is equivalent to an example of a public vehicle specification information key.The shared key C is equivalent to an example of a shared key.

[0068] S11 is equivalent to an example of a tool key generation step. S13 is equivalent to an example of a tool key registration step. S21 is equivalent to an example of a vehicle information transmission step. S23 is equivalent to an example of a tool information transmission step. S25 and S26 are equivalent to an example of a cryptographic communication step.

[0069] S32 is equivalent to an example of a vehicle key storage step. S34 is equivalent to an example of a decision step. S36 is equivalent to an example of a tool key storage step. S37 is equivalent to an example of a tool information instruction step. S44 is equivalent to an example of a vehicle key transmission step. S46 is equivalent to an example of a tool key transmission step.

[0070] S51 is equivalent to an example of processing for a vehicle key generation device and a vehicle key generation step. S52 is equivalent to an example of processing for a memory controller. S53 is equivalent to an example of processing for a vehicle key transmission device and a vehicle key registration step. S62 to S64 are equivalent to an example of processing for a tool key acquisition device. In particular, S62 is equivalent to an example of processing for a tool information acquisition device. S63 is equivalent to an example of a tool information transmission step. S65 is equivalent to an example of processing for a communications controller and a step to transmit a shared key. S67 is equivalent to an example of processing for an update device and an update step. 5. Other embodiments

[0071] While the specific preferred embodiment of the present disclosure has been explained, it is clearly pointed out that the present embodiment is not limited to it, but may be designed differently within the scope and spirit of the disclosure. (1) According to the embodiment described above, the GW-ECU 11 itself generates the secret key Sv and the public key Pv and stores the secret key Sv in the flash memory 112 (S51 and S52). The disclosure is not limited thereto. For example, other devices such as a personal computer and a web server can generate the secret key Sv and store it in the flash memory 112. In this case, the secret key Sv can be exchanged automatically or manually (by user operation). (2) According to the embodiment described above, the external tool 2 itself generates the private key St and the public key Pt and stores the private key St in memory section 22 (S11 and S12). The disclosure is not limited thereto. For example, other devices, such as a personal computer and a web server, can generate the private key St and store it in memory section 22. In this case, the private key St can be exchanged automatically or manually (by user operation). (3) According to the embodiment described above, the external tool 2 has the capability to perform wireless communication with the center 3 using the mobile phone network or the internet communication network. The disclosure is not limited thereto. The external tool 2 need not have the wireless communication capability. In this case, a user of the external tool can exchange information between the external tool 2 and the center 3 using a postal service or other communication means. (4) According to the embodiment described above, the on-board system 1 (in the vehicle) performs cryptographic communication based on the shared-key encryption system using the shared key C. The disclosure is not limited thereto. Cryptographic communication need not be performed in the vehicle. (5) According to the embodiment described above, the external tool 2 requests the center 3 to send the public key Pv of the onboard system 1 (S41). The center 3 sends the public key Pv if it decides that the external tool 2 will be authenticated (YES at S42 and S44). The disclosure is not limited to this. The public key Pv can be sent without making this decision. Security is ensured even if an unauthenticated external tool obtains the public key Pv of the onboard system 1. This is because the external tool 2 can only perform cryptographic communication with the onboard system 1 using the public key Pt if the external tool 2 obtains the secret key St, which forms a pair with the public key Pt that is stored at the center 3. (6) According to the embodiment described above, the GW-ECU 11 is requested by the external tool 2 for a communication link, obtains the public key Pt of the requesting external tool 2 from the center (S63 and S64), and performs cryptographic communication using the public key Pt (S65). The disclosure is not limited thereto. For example, the public key Pt of the requesting external tool 2 may already be stored due to previous communication. In such a case, obtaining the public key Pt from the center 3 can be omitted. In particular, sending the shared key C to the external tool 2 can be omitted by using the same shared key C that was used for the previous communication. (7) According to the embodiment described above, the external tool 2 performs wired communication with the on-board system 1 using the connector 17. The disclosure is not limited thereto. For example, an external tool may have the function of performing near-field communication with the CAN-BT ECU 12. Such an external tool may perform processing similar to the embodiment described above. The foregoing revelation has the following aspects.

[0072] According to a first aspect of the present disclosure, a vehicle-mounted system for communicating with an external tool includes: a communication device, a tool key acquisition device, and a communication controller. The vehicle-mounted system and an external server provide a vehicle communication system. The external tool stores a secret tool key. The external server stores information about an external tool. The information about an external tool provides a public tool key and key identification information, which are linked together. The public tool key provides a public key that forms a pair with the secret tool key. The key identification information provides identification information about the public tool key. The communication device communicates with the external server.When the external tool requests a communication link with the vehicle-integrated system, the tool key acquisition device sends the key identification information corresponding to the external tool, which is the request source, to the external server via the communication device. The tool key acquisition device then obtains the public tool key associated with the key identification information from the external server via the communication device. The communication controller then performs cryptographic communication with the external tool, which is the request source, using the public tool key obtained by the tool key acquisition device.

[0073] The aforementioned vehicle-mounted system performs cryptographic communication with the external tool using the public tool key stored (registered) on the server. An external tool used for cryptographic communication may be restricted to the external tool that stores the secret tool key, which pairs with the public tool key. For example, an external tool could improperly access identification information via the public tool key stored (registered) on a server that does not store (register) the external tool's public tool key. Even in such a case, an error in obtaining the secret tool key disables cryptographic communication using the public key.Only the authenticated external tool can register its public tool key with the server and prevent an unauthenticated external tool from establishing a communication connection with the vehicle-based system.

[0074] Alternatively, the communication controller can perform cryptographic communication with the external tool using a public-key encryption system and the tool's public key, thus sharing a common key with the external tool. This common key enables cryptographic communication using a common-key encryption system. In this case, once the common key is shared, the vehicle communication system can perform cryptographic communication based on the common-key encryption system with a reduced processing load compared to cryptographic communication based on the public-key encryption system.

[0075] Alternatively, the vehicle-integrated system can also include an update device for updating the shared key. In this case, the vehicle communication system can provide higher security than a configuration that does not update the shared key.

[0076] Furthermore, the update mechanism can update the shared key each time the external tool and the vehicle-integrated system complete cryptographic communication using the shared-key encryption system. In this case, security can be significantly improved because a different shared key is used each time cryptographic communication between the external tool and the vehicle-integrated system is performed using the shared-key encryption system.

[0077] Alternatively, the update device can generate an updated shared key based on vehicle information. In this case, the shared key can vary depending on the vehicle information.

[0078] It is assumed that the vehicle-integrated system includes more than one electronic control unit, each of which can connect to the external tool. In such a case, each electronic control unit can include the tool key acquisition device and the communication controller. Alternatively, the vehicle-integrated system can further include: a first electronic control unit for direct communication with the external tool and a second electronic control unit for communication with the external tool via the first electronic control unit. The first electronic control unit includes the tool key acquisition device and the communication controller.In this case, the vehicle-integrated system, according to this configuration, can prevent the electronic control units from duplicating their functions, compared to the configuration that each electronic control unit uses with the tool key acquisition device and the communication controller.

[0079] Alternatively, the vehicle-integrated system may further include: a storage device for storing a secret vehicle key as a secret key of the vehicle-integrated system. The tool key acquisition device includes a tool information acquisition device that performs cryptographic communication with the external tool in a public-key encryption system using a public vehicle key that forms a pair with the secret vehicle key, such that the tool information acquisition device obtains the key identification information about the external tool from the external tool. In this case, this vehicle communication system can securely obtain key identification information about the external tool.

[0080] Alternatively, the vehicle-integrated system can further include: a vehicle key generation device that generates the secret vehicle key and the public vehicle key; a storage controller that manages the storage device to store the secret vehicle key generated by the vehicle key generation device; and a vehicle key sending device that sends the public vehicle key generated by the vehicle key generation device to the external server. In this case, this vehicle-integrated system can securely store the secret vehicle key compared to a configuration that generates the secret vehicle key using a device other than the vehicle-integrated system. Furthermore, sending the public vehicle key to the server easily provides the external tool with the public vehicle key.

[0081] According to a second aspect of the present disclosure, a communication method for communication between a vehicle-mounted system and an external tool includes: sending key identification information from the external tool to the vehicle-mounted system, wherein the key identification information provides identification information about a public tool key of the external tool; sending the key identification information from the vehicle-mounted system to a server, wherein the external server stores the public tool key and key identification information about the public key, which are linked together; sending the public tool key from the server to the vehicle-mounted system, wherein the public tool key is linked to the key identification information received by the server;Sending a shared key from the vehicle-integrated system to the external tool, the shared key being encrypted using the public tool key received by the vehicle-integrated system; and decrypting an encrypted shared key received by the external tool using a secret tool key paired with the external tool's public tool key; and performing cryptographic communication with the vehicle-integrated system using the shared key.

[0082] In the above procedure, the public tool key stored (registered) on the server is used to encrypt the shared key. The vehicle-integrated system sends the shared key to the external tool to share it. The vehicle-integrated system can then perform cryptographic communication with the external tool using the shared key. In such a case, the vehicle-integrated system can restrict the targeted external tool to the one that stores a secret tool key paired with the public tool key. For example, an external tool could illegitimately access identification information via the public tool key stored (registered) on the server that does not store (register) the external tool's public tool key.Even in such a case, an error in obtaining the secret tool key disables cryptographic communication (decryption of the encrypted shared key) using the public tool key. Cryptographic communication using the shared key is unavailable. Only the authenticated external tool can register its public tool key with the server, preventing an unauthenticated external tool from establishing communication links with the vehicle-integrated system. Once the shared key is established, the vehicle communication system can perform cryptographic communication based on the shared-key encryption system with reduced processing overhead, instead of cryptographic communication based on the public-key encryption system.

[0083] Alternatively, the procedure can also include: updating the shared key using the vehicle-integrated system after cryptographic communication is complete. In this case, the vehicle communication system can provide higher security than a configuration that does not update the shared key.

[0084] Alternatively, the procedure may further include: generating the external tool's secret tool key and public tool key; sending the external tool's public tool key and tool specification information to the external server, the tool specification information specifying the external tool; and verifying the tool specification information using the external server to determine whether the external tool that sent the tool specification information is authenticated.Storing the public key and key identification information on the external server when it is determined that the external tool that sent the tool specification information is authenticated, with the key identification information being associated with the public tool key so that the key identification information and the public tool key are linked together;and sending the key identification information from the external server to the external tool, which is a sending source, when it is determined that the external tool that sent the tool specification information is authenticated. In this case, the server can store (register) the public key for an authenticated external tool and provide the key identification information. The server can prevent the public key from being stored (registered) for an unauthenticated external tool.

[0085] Alternatively, when transferring the key identification information from the external tool to the vehicle-integrated system, the key identification information can be encrypted with a public vehicle key that forms a pair with a secret vehicle key of the vehicle-integrated system. Encrypted identification information is then sent from the external tool to the vehicle-integrated system. When the vehicle-integrated system sends the key identification information to the external server, it decrypts the encrypted key identification information and sends the decrypted key identification information to the external server. In this case, the external tool can securely transmit the key identification information to the vehicle-integrated system.

[0086] Alternatively, the communication procedure may further include: generating the vehicle-bound system's secret vehicle key and public vehicle key; sending the vehicle-bound system's public vehicle key and vehicle specification information to the server, wherein the public vehicle key is generated when the vehicle-bound system's secret vehicle key is generated, and the vehicle specification information specifies the vehicle-bound system; storing the linked public vehicle key and vehicle specification information in the server, wherein the server receives the public vehicle key and vehicle specification information when it sends the public vehicle key and vehicle specification information;Sending the vehicle specification information from the external tool to the server; and sending the public tool key from the external server to the external tool, which acts as a sending source for the vehicle specification information, wherein the public vehicle key is associated with the vehicle specification information received by the external server when sending the vehicle specification information. In this case, the external tool can obtain the public key for the vehicle-bound system from the server.

[0087] While the present disclosure has been explained with reference to its embodiments, it should be noted that the disclosure is not limited to embodiments and constructions. Furthermore, in addition to the various combinations and configurations, other combinations and configurations with more, fewer, or only a single element are to be considered as equally within the spirit and scope of the present disclosure.

[0088] The invention can be summarized as follows. A vehicle-mounted system for communicating with an external tool for storing a secret tool key comprises: a communication device; a tool key acquisition device; and a communication controller. The vehicle-mounted system and an external server for storing information from an external tool provide a vehicle communication system. The information from an external tool provides a public tool key and key identification information. The public tool key forms a pair with the secret tool key.When the external tool requests a communication connection with the vehicle-integrated system, the tool key acquisition device sends the key identification information to the external server, enabling the tool key acquisition device to obtain the public tool key from the external server. The communication controller then performs cryptographic communication with the external tool using the public tool key.

Claims

[1] Vehicle-mounted system (1) for communicating with an external tool (2), wherein the vehicle-mounted system (1) comprises: a communication device (16); a tool key recovery device (11, S62-S64); and a communication controller (11, S65), wherein the vehicle-integrated system (1) and an external server (3) provide a vehicle communication system, wherein the external tool (2) stores a secret tool key, where the external server (3) stores information about an external tool, where the information about an external tool provides a public tool key and key identification information that are linked together, wherein the public tool key provides a public key that forms a pair with the secret tool key, wherein the key identification information provides identification information about the public tool key, wherein the communication device (16) communicates with the external server (3), wherein, when the external tool (2) requests a communication connection with the vehicle-bound system (1), the tool key acquisition device (11, S62-S64) sends the key identification information according to the external tool (2), which is a request source, to the external server (3) via the communication device (16), so that the tool key acquisition device (11, S62-S64) obtains the public tool key associated with the key identification information from the external server (3) via the communication device (16), wherein the communication controller (11, S65) performs cryptographic communication with the external tool (2) representing the request source using the public tool key obtained through the tool key acquisition device (11, S62-S64), wherein the communication controller (11, S65) performs the cryptographic communication with the external tool (2) in a public key encryption system using the public tool key, such that the communication controller (11, S65) shares a common key with the external tool (2), where the shared key provides cryptographic communication in a shared key encryption system, wherein the vehicle-mounted system (1) further comprises an update device (11, S67) for updating the common key, and wherein the update device (11, S67) generates an updated common key based on vehicle information. [2] Vehicle-mounted system (1) according to claim 1, characterized by , that the update device (11, S67) updates the shared key each time the external tool (2) and the vehicle-mounted system (1) complete the cryptographic communication in the shared key encryption system. [3] Vehicle-mounted system (1) according to one of claims 1 or 2, further comprising: a first electronic control unit (11) for direct communication with the external tool (2); and a second electronic control unit (13) for communicating with the external tool (2) through the first electronic control unit (11), wherein the first electronic control unit (11) includes the tool key acquisition device (11, S62-S64) and the communication controller (11, S65). [4] Vehicle-mounted system (1) according to one of claims 1-3, further comprising: a storage device (112) for storing a secret vehicle key as a secret key of the vehicle-bound system (1), wherein the tool key acquisition device (11, S62-S64) includes a tool information acquisition device (11, S62) which performs cryptographic communication with the external tool (2) in a public key encryption system using a public vehicle key that forms a pair with the secret vehicle key, such that the tool information acquisition device (11, S62) obtains the key identification information about the external tool (2) from the external tool (2). [5] Vehicle-mounted system (1) according to claim 4, furthermore characterized by : a vehicle key generation device, (11, S51) which generates the secret vehicle key and the public vehicle key; a memory controller (11, S52) that controls the memory device (112) to store the secret vehicle key generated by the vehicle key generation device (11, S51); and a vehicle key sending device (11, S53) that sends the public vehicle key generated by the vehicle key generation device (11, S51) to the external server (3). [6] Communication method for communication between a vehicle-integrated system (1) and an external tool (2), comprising: Sending a key identification information from the external tool (2) to the vehicle-bound system (1), wherein the key identification information provides identification information about a public tool key of the external tool (2); Sending the key identification information from the vehicle-connected system (1) to an external server (3), wherein the external server (3) stores the public tool key and key identification information about the public key, which are linked together; Sending the public tool key from the external server (3) to the vehicle-bound system (1), wherein the public tool key is linked to the key identification information received by the external server (3); Sending a shared key from the vehicle-mounted system (1) to the external tool (2), wherein the shared key is encrypted using the public tool key received by the vehicle-mounted system (1); Decrypting an encrypted shared key received by the external tool (2) using a secret tool key that forms a pair with the public tool key of the external tool (2); Performing cryptographic communication with the vehicle-integrated system (1) using the shared key; Generating the secret tool key and the public tool key of the external tool (2); Sending the public tool key and tool specification information from the external tool (2) to the external server (3), wherein the tool specification information specifies the external tool (2); Checking the tool specification information using the external server (3) to determine whether the external tool (2) that sent the tool specification information is authenticated; Storing the public key and key identification information in the external server (3) when it is determined that the external tool (2) that sent the tool specification information is authenticated, the key identification information being associated with the public tool key so that the key identification information and the public tool key are linked; and Sending the key identification information from the external server (3) to the external tool (2), which is a sending source, when it is determined that the external tool (2) that sent the tool specification information is authenticated. [7] Communication method according to claim 6, further comprising: Updating the shared key using the vehicle-mounted system (1) after cryptographic communication is complete. [8] Communication method for communication between a vehicle-integrated system (1) and an external tool (2), comprising: Sending a key identification information from the external tool (2) to the vehicle-bound system (1), wherein the key identification information provides identification information about a public tool key of the external tool (2); Sending the key identification information from the vehicle-connected system (1) to an external server (3), wherein the external server (3) stores the public tool key and key identification information about the public key, which are linked together; Sending the public tool key from the external server (3) to the vehicle-bound system (1), wherein the public tool key is linked to the key identification information received by the external server (3); Sending a shared key from the vehicle-mounted system (1) to the external tool (2), wherein the shared key is encrypted using the public tool key received by the vehicle-mounted system (1); Decrypting an encrypted shared key received by the external tool (2) using a secret tool key that forms a pair with the public tool key of the external tool (2); and Performing cryptographic communication with the vehicle-integrated system (1) using the shared key, wherein, when transmitting the key identification information from the external tool (2) to the vehicle-bound system (1), the key identification information is encrypted with a public vehicle key that forms a pair with a secret vehicle key of the vehicle-bound system (1), and encrypted identification information is sent from the external tool (2) to the vehicle-bound system (1), and wherein when the key identification information is sent from the vehicle-bound system (1) to the external server (3), the vehicle-bound system (1) decrypts the encrypted key identification information and a decrypted key identification information is sent from the vehicle-bound system (1) to the external server (3). [9] Communication method according to claim 8, further comprising: Generating the secret vehicle key and the public vehicle key of the vehicle-bound system (1) using the vehicle-bound system (1); Sending the public vehicle key and vehicle specification information from the vehicle-bound system (1) to the external server (3), wherein the public vehicle key is generated when the secret vehicle key and the public vehicle key are generated and the vehicle specification information specifies the vehicle-bound system (1); Storing the public vehicle key and the vehicle specification information linked together in the external server (3), wherein the public vehicle key and the vehicle specification information are received by the external server (3) when the public vehicle key and the vehicle specification information are sent; Sending the vehicle specification information from the external tool (2) to the external server (3); and Sending the public tool key from the external server (3) to the external tool (2), which is a sending source of the vehicle specification information, wherein the public vehicle key is associated with the vehicle specification information received by the external server (3) when sending the vehicle specification information.

Images