Information processing device, method, and system

Abstract

To enable a server providing a prescribed service to identify a present owner of an information processing device.SOLUTION: An information processing device includes: an embedded Universal Integrated Circuit Card (eUICC) holding first profile information to be used for connection to a first communication system; and a control unit for executing the connection to the first communication system by using the first profile information. The control unit executes processing of: acquiring, from a prescribed certificate authority, a first electronic certificate that certifies that first authentication information that is used for authentication by a first server is for a first owner; storing the first authentication information and the first electronic certificate in the eUICC; and receiving authentication by the first server by using the first authentication information and the first electronic certificate. A default profile is stored in the eUICC, and the information processing device connects the first communication system by using the default profile while the information processing device is being sold as a new product or used product.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to wireless communication in which a SIM is used in a terminal. [Background technology]

[0002] A technique is disclosed in which an operational profile including settings for connecting to a first wireless communication network, a bootstrap profile for connecting to a second wireless communication network, and an applet are stored in a UICC, and when the applet detects loss of operational connectivity with the first wireless communication network while connecting to the first wireless communication network using the operational profile, it connects to the second wireless communication network using the bootstrap profile and re-establishes wireless communication with a host device (for example, Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2023-515277 A Summary of the Invention [Problem to be solved by the invention]

[0004] One aspect of the disclosure has an objective of providing an information processing device, a method, and a system that enable a current owner of the information processing device to be identified by a server that provides a predetermined service. [Means for solving the problem]

[0005] One aspect of the present disclosure is An embedded universal integrated circuit card (eUICC) that is used for connecting to a first communication system and holds first profile information associated with a first owner of the information processing device; a control unit that executes a connection to the first communication system using the first profile information; Equipped with The control unit is Obtaining a first electronic certificate from a predetermined certificate authority, the first electronic certificate proving that first authentication information corresponding to the first profile information belongs to the first owner, the first authentication information being used for authentication by a first server trusted by the first communication system; storing the first authentication information and the first electronic certificate in the eUICC; receiving authentication by the first server using the first authentication information and the first electronic certificate; Further execute It is an information processing device.

[0006] Another aspect of the present disclosure is A computer including an embedded universal integrated circuit card (eUICC) that is used for connecting to a first communication system and that holds first profile information associated with a first owner of an information processing device, connecting to the first communication system using the first profile information; A first authentication information corresponding to the first profile information used for authentication by a first server trusted by the first communication system is that of the first owner. obtaining a first electronic certificate from a predetermined certification authority that certifies that the storing the first authentication information and the first electronic certificate in the eUICC; receiving authentication by the first server using the first authentication information and the first electronic certificate; This is a method for further implementing the above.

[0007] Another aspect of the present disclosure is an eUICC capable of holding multiple pieces of profile information used for connecting to a communication network; a control unit that enables any one of the plurality of pieces of profile information and connects to the communication network using the enabled profile information; An information processing device comprising: the eUICC holds default profile information that is used for connecting to a first communication system and is set to charge a communication fee to a predetermined carrier when the information processing device is shipped from a factory; The control unit is When the information processing device is shipped from a factory, the default profile information is enabled, and the information processing device connects to the first communication system using the default profile information; when first profile information corresponding to a first owner of the information processing device is stored in the eUICC, invalidating the default profile information, validating the first profile information, and connecting to the first communication system using the first profile information; It is an information processing device. Effect of the Invention

[0008] According to one aspect of the present disclosure, a server that provides a predetermined service can identify the current owner of an information processing device. [Brief description of the drawings]

[0009] [Figure 1] FIG. 1 is a diagram showing an example of service provision to a vehicle according to the first embodiment. [Diagram 2] FIG. 2 is a diagram illustrating an example of a hardware configuration of the DCM. [Diagram 3] FIG. 3 shows an example of the functional configuration of a DCM. [Figure 4] FIG. 4 is a diagram illustrating an example of a hardware configuration of an information processing device. [Diagram 5] FIG. 5 is a diagram illustrating an example of the functional configuration of the HSS. [Figure 6] FIG. 6 is a diagram illustrating an example of information held in the subscriber information database. [Figure 7] FIG. 7 is a diagram illustrating an example of information held in the terminal connection information database. [Figure 8] FIG. 8 is a diagram illustrating an example of a functional configuration of the server. [Figure 9] FIG. 9 is an example of a flowchart of a profile information download process executed by the DCM. [Figure 10] FIG. 10 is an example of a flowchart of a process for enabling or disabling a profile, which is executed by the DCM. [Figure 11] FIG. 11 is an example of a flowchart of a process for acquiring an identity verification certificate executed by the DCM. [Figure 12] FIG. 12 is a diagram showing an example of a processing sequence in which the DCM acquires an owner profile and connects to a communication system. [Figure 13] FIG. 13 is a diagram showing an example of a processing sequence from when the DCM acquires a personal identification certificate until when the DCM accesses a server. [Figure 14] FIG. 14 is a diagram showing an example of transition of profile information used in a vehicle. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] When purchasing a vehicle, a seal certificate or similar document is required to verify the identity of the new owner of the vehicle. Instead of a seal certificate, it is also possible to use the electronic certificate of the My Number card. Based on such identity verification documents, a prescribed certification authority (CA: Certificate Authority or Certification Authority) will review the document and link the vehicle with the owner, and issue an electronic certificate indicating that the owner of the vehicle is genuine. The electronic certificate is stored, for example, in an on-board device installed in a vehicle with communication capabilities such as a connected car, and is used for authentication using the electronic certificate when receiving services for the vehicle.

[0011] An electronic certificate that certifies the owner of a vehicle is often stored in a secure storage area of ​​an on-board device, and in such cases, it cannot be rewritten. For example, a vehicle may be sold as a second-hand vehicle, and the owner may change. However, since the electronic certificate that certifies the owner stored in the secure storage area of ​​the on-board device cannot be rewritten, even if the owner of the vehicle changes, the electronic certificate of the original owner remains. Therefore, a party that provides services to the vehicle cannot identify the current owner even if the owner of the vehicle has changed from the original owner, and cannot provide services that correspond to the current owner.

[0012] In one aspect of the present disclosure, in consideration of the above problem, a digital certificate for verifying the identity of the owner is stored in an eUICC of an information processing device, which makes it possible to rewrite the digital certificate for verifying the identity, and enables a service provider that performs authentication using the digital certificate to identify the current owner of the information processing device.

[0013] More specifically, one aspect of the present disclosure is an information processing device including an eUICC used for connecting to a first communication system and holding first profile information associated with a first owner of the information processing device, and a control unit that executes connecting to the first communication system using the first profile information. The control unit obtains, from a predetermined certificate authority, a first electronic certificate that certifies that first authentication information corresponding to the first profile information, used for authentication by a first server trusted by the first communication system, belongs to the first owner. The control unit stores the first authentication information and the first electronic certificate in the eUICC. The control unit is authenticated by the first server using the first authentication information and the first electronic certificate.

[0014] The information processing device is, for example, an in-vehicle device mounted in a vehicle, a smartphone, a tablet terminal, a wearable terminal, an IoT terminal, and a terminal capable of wireless communication based on a mobile communication method. These include vehicle operation devices, drive recorders, and ECUs (Electronic Control Units). The control unit is, for example, a processor such as a central processing unit (CPU), a digital signal processor (DSP), or a data communication processor, or a circuit such as a field-programmable gate array (FPGA).

[0015] The first communication system is, for example, a wireless communication system that requires a terminal to have an eUICC, such as 4G (LTE-Advanced), 5G, 6G or later mobile communication standards, and 3G. The eUICC may be a chip type or a card type. The authentication information is, for example, key information such as a public key. The first server trusted by the first communication system may be a server in the first communication system or may be a server outside the first communication system. The first communication system may be a system managed by a manufacturer of an information processing device or a device in which an information processing device is installed, or may be a communication system of a business operator that issues profile information held in the eUICC.

[0016] Since the first profile information corresponds to the first owner, when the owner of the information processing device changes, the profile information also changes. Since the first authentication information corresponds to the first profile information, when the profile information changes, the authentication information also changes. Since the first electronic certificate is issued for the first authentication information, when the authentication information changes, the electronic certificate also changes. In other words, when the owner changes, the electronic certificate also changes. In one aspect of the present disclosure, by having an eUICC that is data rewritable hold an electronic certificate for identifying the owner, for example, the electronic certificate can be rewritten in conjunction with a change in the owner of the information processing device. This allows a service provider that performs authentication using an electronic certificate for identifying the owner to correctly identify the current owner of the information processing device.

[0017] In one aspect of the present disclosure, the information processing device may further hold an applet that generates first authentication information using the first profile information as a key. The control unit may start the applet to generate the first authentication information. This requires that the electronic certificate for identity verification be changed in conjunction with a change in the profile information. The first authentication information can be updated even when the profile information is updated due to, for example, a vulnerability problem other than a change in the owner of the information processing device, thereby maintaining security.

[0018] The control unit may also obtain the first profile information and the applet from a second server that manages the profile information, and store the first profile information and the applet in the eUICC. For example, the second server is a Subscription Manager Data Preparation + (SM-DP+) server when the first communication system is a system that supports LTE (Long Term Evolution). This allows the applet to be rewritten remotely in the same way as the profile information.

[0019] Furthermore, when the applet is updated, the control unit may obtain at least the updated applet from the second server and store it in the eUICC. The control unit may start the updated applet to newly generate first authentication information, obtain a digital certificate for the newly generated first authentication information from a predetermined certification authority (CA), and store the newly generated first authentication information and the newly obtained digital certificate in the eUICC. In this way, for example, when the vulnerability of the digital certificate is weakened, the first authentication information and the digital certificate can be updated by updating the applet by updating the generation algorithm of the first authentication information, for example.

[0020] In one aspect of the present disclosure, when the control unit validates second profile information associated with the second owner newly stored in the eUICC, the control unit may obtain, from a predetermined certificate authority, a second electronic certificate that certifies that the second authentication information corresponding to the second profile information belongs to the second owner. The control unit may store the second authentication information and the second electronic certificate in the eUICC, and be authenticated by the first server using the second authentication information and the second electronic certificate. At this time, the first profile information and the first electronic certificate are invalidated or deleted. This makes it possible to prevent the first server from confusing the first owner (previous owner) with the second owner (current owner) when, for example, the owner of the information processing device is changed from the first owner to the second owner.

[0021] In a vehicle capable of communication such as a connected car, various data such as the vehicle's condition, driving data, etc., are collected by the vehicle manufacturer. However, the vehicle is not in a state capable of communication until the purchaser (owner) has concluded a contract with a carrier network, etc., after the vehicle is purchased, and the vehicle is not in a state capable of communication between the time it is shipped from the factory and the time it is purchased, so information about the vehicle cannot be collected.

[0022] In view of the above problem, one aspect of the present disclosure stores default profile information in an eUICC of an information processing device so that the information processing device is capable of communication from the time of shipment from the factory. This allows the information processing device to be capable of communication from the time of shipment from the factory until the time of purchase, and for example, a manufacturer of the information processing device or a device equipped with the information processing device can collect information about the information processing device from the time of shipment from the factory until the time of purchase.

[0023] More specifically, one aspect of the present disclosure is an information processing device including an eUICC capable of holding a plurality of pieces of profile information used for connecting to a communication network, and a control unit that enables any one of the plurality of pieces of profile information and executes connection to the communication network using the enabled profile information. The eUICC holds default profile information used for connecting to a first communication system when the information processing device is shipped from a factory. The control unit enables the default profile information when the information processing device is shipped from a factory, and connects to the first communication system using the default profile information. When first profile information corresponding to a first owner of the information processing device is stored in the eUICC, the control unit disables the default profile information, enables the first profile information, and connects to the first communication system using the first profile information.

[0024] The information processing device is, for example, an in-vehicle device mounted on a vehicle, a smartphone, a tablet terminal, a wearable terminal, an IoT terminal, and a terminal capable of wireless communication based on a mobile communication method. The in-vehicle device is, for example, a DCM, a car navigation device, a drive recorder, an ECU, etc. The control unit is, for example, a processor such as a CPU, a DSP, and a data communication processor, and a circuit such as an FPGA. The first communication system is, for example, a wireless communication system that requires a terminal to have an eUICC, such as 4G, 5G, 6G or later mobile communication methods, and 3G. The first communication system may be a system managed by a manufacturer of the information processing device or a device in which the information processing device is mounted, or may be a communication system of a business operator that issues profile information held in the eUICC.

[0025] According to one aspect of the present disclosure, the information processing device can connect to the first communication system using default profile information from the time of shipment from the factory until the time of purchase and the owner being determined. This allows the first communication system to collect information regarding the information processing device from the time of shipment from the factory until the time of purchase.

[0026] In one aspect of the present disclosure, the default profile information may be set to charge communication fees to a specified business operator. In the default profile information, the specified business operator set as the billing destination is a business operator that collects information related to the information processing device. The specified business operator is, for example, an administrator of the first communication system (a manufacturer of the information processing device, a manufacturer of a device that mounts the information processing device such as a vehicle, and a business operator that issues profile information), a business operator that requests the administrator of the first communication system to collect information related to the information processing device, etc.

[0027] According to one aspect of the present disclosure, the owner is not charged for communication performed by connecting to the first communication system using the default profile information from the time of shipment from the factory until purchase, so the owner does not have to bear the communication costs. Also, after the owner of the information processing device is determined, the default profile information is invalidated, so that the specified business operator does not have to bear the communication costs after the owner is determined.

[0028] In one aspect of the present disclosure, the control unit invalidates or deletes the first profile information and sets a default profile when a predetermined secondhand dealer sells the information processing device secondhand. The file information may be enabled and the default profile information may be used to connect to the first communication system. This allows the information processing device to be in a communicable state and to collect information about the information processing device, even when the information processing device is being sold as a second-hand product.

[0029] Another aspect of the present disclosure is a system including the information processing device and a third server that holds information indicating whether profile information used in connection to a first communication system by the information processing device is default profile information. When the first communication system is a system compatible with 4G, for example, the third server is a Home Subscriber Server (HSS).

[0030] According to one aspect of the present disclosure, it is possible to determine whether the information processing device is for sale based on information indicating whether the profile information used to connect to the first communications network held by the third server is a default file.

[0031] In other aspects, the present disclosure can also be specified as a method in which a computer executes the processing of the above-mentioned information processing device, a program for causing a computer to execute the processing of the above-mentioned information processing device, and a computer-readable recording medium on which the program is recorded.

[0032] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. The configurations of the following embodiments are merely examples, and the present disclosure is not limited to the configurations of the embodiments.

[0033] First Embodiment FIG. 1 is a diagram showing an example of service provision to a vehicle 10 according to the first embodiment. In the first embodiment, the communication system 2 is a system managed by a manufacturer of the vehicle 10. The communication system 2 collects information related to the communication of the vehicle 10 and controls the communication of the vehicle 10. The communication system 2 strengthens the security of the vehicle 10 by passing the communication of the vehicle 10 through the communication system 2 and then to an external network such as the Internet. The communication system 2 provides the vehicle 10 with services such as a vehicle status monitoring service, a navigation service, and an emergency call service. The server 4 is a server trusted by the communication system 2 and provides these services to the vehicle 10. The server 4 is located outside the communication system 2 in FIG. 1, but may be located inside the communication system 2.

[0034] The vehicle 10 is a connected car, and is equipped with a DCM 1 that performs communication functions. In the first embodiment, the manufacturer of the vehicle 10, which is the administrator of the communication system 2, does not own a communication infrastructure. Therefore, the owner of the vehicle 10 makes a contract with a communication carrier and connects to the communication system 2 through the communication carrier network. The DCM 1 can also communicate using a communication method other than the mobile communication method, such as WiFi communication. The DCM 1 can connect to the Internet, for example, using WiFi as an access network. When WiFi is used as an access network, the DCM 1 can connect to the Internet even if it is not connected to the communication system 2. However, in this case, it is not possible to receive services from the communication system 2. On the other hand, even when WiFi is used as an access network, the DCM 1 can also connect to the communication system 2 and connect to the Internet via the communication system 2 depending on the settings. However, in the first embodiment, the connection of the DCM 1 to the communication system 2 when WiFi is used as an access network is not described.

[0035] The communication system 2, the SM-DP+ 3, the server 4, and the certificate authority 5 are each connected to a public network such as the Internet and are capable of communicating with each other. The vehicle 10 is also connected to a public network such as the Internet via, for example, a WiFi network, and is capable of communicating with the SM-DP+ 3 and the server 4. 4, and can be connected to a certification authority 5.

[0036] The communication system 2 includes an HSS 21 and an AAA (Authentication Authorization Accounting) 22. However, FIG. 1 shows only the components according to the first embodiment. 1, and the components of the communication system 2 are not limited to those shown in Fig. 1. The HSS 21 holds information about subscribers connected to the communication system 2. The subscriber-related information held by the HSS 21 includes, for example, identification information of the owner of the vehicle 10, identification information of the vehicle 10 (DCM 1), authentication information used to authenticate the DCM 1, and identification information of the profile information used for authentication.

[0037] The AAA 22 authenticates the DCM 1 in a predetermined authentication method using information about the DCM 1 held in the HSS 21. The authentication method adopted by the AAA 22 is, for example, AKA (Authentication and Key Agreement) authentication, which is used for authentication in carrier networks. However, the authentication method adopted by the AAA 22 is not limited to AKA authentication, and an authentication method unique to the communication system 2 may be adopted.

[0038] The SM-DP+ 3 manages profile information. The SM-DP+ 3 stores profile information issued by the communication system 2 about subscribers who have signed a subscription contract for the service of the communication system 2 (in the first embodiment, the owner of the vehicle 10). In addition, the SM-DP+ 3 provides profile information corresponding to the owner of the vehicle 10 in response to a request from the DCM 1. The SM-DP+ 3 is managed, for example, by the same administrator as the administrator of the communication system 2.

[0039] The certification authority 5 is a system that verifies that the owner of the vehicle 10 is genuine and issues an electronic certificate that indicates that the authentication information used by the vehicle 10 belongs to the original owner. The certification authority 5 is a system managed by a trusted third party. Hereinafter, the electronic certificate that indicates that the authentication information used by the vehicle 10 belongs to the original owner will be simply referred to as an identity verification certificate.

[0040] The DCM 1 is equipped with an eSIM and connects to the communication system 2 using profile information stored in the eSIM. In the first embodiment, since the DCM 1 is mounted on the vehicle 10, the purchaser of the vehicle 10, the owner of the vehicle 10, the owner of the DCM 1, and the subscriber of the communication system 2 are the same person.

[0041] In the first embodiment, the eSIM of the DCM 1 stores default profile information used for connecting to the communication system 2. The default profile information is downloaded from the SM-DP+ 3 via WiFi or the like by the manufacturer's staff at the time of factory shipment, stored in the eSIM, and activated. The default profile information is profile information set in correspondence with the communication system 2. That is, while the DCM 1 is connected to the communication system 2 using the default profile information, it is indicated that the owner of the vehicle 10 is the communication system 2, that is, the vehicle 10 is not owned by a specific individual and is being sold. By storing the default profile information in the eSIM of the DCM 1, the DCM 1 is in a state in which it can connect to and communicate with the communication system 2 after being shipped from the factory. In addition, the communication system 2 can obtain information about the DCM 1 after the DCM 1 is shipped from the factory, and can monitor the state of the vehicle 10, for example, even during the sale of the vehicle 10. Hereinafter, the default profile information is simply referred to as a default profile.

[0042] In the first embodiment, the flow from when the owner of the vehicle 10 purchases the vehicle 10 to when he or she receives the service provided by the communication system 2 is as follows.

[0043] (1) When a purchase contract for the vehicle 10 is concluded, the new owner submits documents such as an identity document such as a seal certificate and a garage certificate. In addition, along with the purchase contract for the vehicle 10, a subscription contract for the service of the communication system 2 is also concluded. Based on the contents of the purchase contract for the vehicle 10 and the subscription contract for the service of the communication system 2, information about the owner is registered in the communication system 2.

[0044] The information on the owner registered in the communication system 2 includes, for example, personal information of the owner such as name, address, sex, date of birth, and identification documents, information on the purchased vehicle, and subscriber information for the service of the communication system 2. The information on the purchased vehicle includes, for example, the name of the vehicle, the model, the information written on the license plate, and the location of the garage. The subscriber information for the service of the communication system 2 includes, for example, identification information of the owner (IMSI), identification information of the DCM 1 (IMEI), profile information, and setting information such as the contract contents of the service plan and the payment method. The subscriber information for the service of the communication system 2 is held in the HSS 21. The personal information of the owner and the information on the vehicle may be held in the HSS 21 or may be held in a database different from the HSS 21.

[0045] A subscription contract to the service of the communication system 2 may be made at the same time as a purchase contract for the vehicle 10, or may be made at a later time than a purchase contract for the vehicle 10. When a subscription contract to the service of the communication system 2 is established, the communication system 2 issues profile information corresponding to the owner based on the subscriber information, and the profile information is registered in the SM-DP+ 3. In addition, information on an identity document (seal certificate, identity document with a face image, My Number card) is transmitted from the communication system 2 to the certification authority 5, and the certification authority 5 examines the identity of the owner of the vehicle 10, and information on the association between the owner of the vehicle 10 and the vehicle 10 (DCM 1) is registered in the certification authority 5.

[0046] (2) The owner of the vehicle 10 operates the DCM 1 to download profile information corresponding to the owner of the vehicle 10 from the SM-DP+ 3. Note that the download of the profile information may be performed, for example, via WiFi, or may be performed via the communication system 2 since the DCM 1 is connected to the communication system 2 using a default profile in the first embodiment. The profile information corresponding to the owner of the vehicle 10 is stored in the eSIM of the DCM 1. Hereinafter, the profile information corresponding to the owner of the vehicle 10 will be simply referred to as an owner's profile.

[0047] For example, when the owner profile is enabled by an operation by the owner of the vehicle 10, the default profile is disabled. Then, a connection is re-established between the DCM 1 and the communication system 2 with the owner of the vehicle 10 as a subscriber to the service of the communication system 2. During this process, the DCM 1 is authenticated by the AAA 22 using the owner profile information. The AAA 22 authenticates the owner of the vehicle 10 using the subscriber information corresponding to the owner of the vehicle 10 held in the HSS 21. As a result, it is recorded in the HSS 21 that the DCM 1 is connected to the communication system 2 using the owner profile. Thereafter, the DCM 1 becomes able to connect to the Internet via the communication system 2.

[0048] (3) When the owner of the vehicle 10 receives a service from the server 4 as one of the services of the communication system 2, the DCM 1 is authenticated by the server 4. The DCM 1 generates authentication information for this purpose. In the first embodiment, the DCM 1 generates the authentication information by using a profile for the owner as a key. The authentication method adopted by the server 4 is, for example, TLS (Transport Layer Security) authentication. The authentication information is, for example, a public key and a private key used in TLS authentication.

[0049] (4) The DCM 1 requests the certification authority 5 to issue an identity certificate attesting that the DCM 1 is the owner of the vehicle 10 with respect to the authentication information. Since the association between the vehicle 10 (DCM 1) and the owner of the vehicle 10 has already been registered in the certification authority 5, the identity certificate is issued by the certification authority 5 based on this. Since the identity certificate is created based on the identity document, it strongly proves that the person is genuine. The DCM 1 obtains the identity certificate from the certification authority 5, links it to the owner profile together with the authentication information, and stores it in the eSIM. Note that the authentication information that is sent to the certification authority 5 and for which an identity certificate is issued is, for example, a public key used in TLS authentication. The TLS public key and private key are stored in the eSIM.

[0050] (5) The DCM 1 accesses the server 4 via the communication system 2, sends the identity verification certificate held in the eSIM to the server 4, and is authenticated by the server 4. If the authentication is successful, the DCM 1 is then able to receive services from the server 4.

[0051] In the first embodiment, authentication information used for authentication with the server 4 is generated using owner profile information of the vehicle 10 as a key. In addition, an identity verification certificate for the authentication information is stored in the eSIM and is therefore rewritable. As a result, for example, when the owner profile to be activated is changed due to a change in the owner of the vehicle 10, the identity verification certificate used for authentication of the server 4 is also changed. As a result, even if the owner of the vehicle 10 has changed, the server 4 can identify the current owner of the vehicle 10 from the identity verification certificate used for authentication of the DCM 1.

[0052] There are two main methods for connecting the DCM 1 to the communication system 2 through a carrier network. The first is when the communication system 2 is an MVNO (Mobile Virtual Network Operator). This method has a billing function for connection to the communication system 2, and the DCM 1 connects using a carrier network that has an MVNO contract with the communication system 2. In this case, settings related to billing for communication fees are made in the default profile and owner profile in the eSIM. For example, the administrator of the communication system 2 (the manufacturer of the vehicle 10) is set in the default profile as the party to be billed for communication fees, while the owner of the vehicle 10 is set in the owner profile.

[0053] In the other method, the communication system 2 is not an MVNO and does not have a billing function for connection to the communication system 2, and the DCM 1 connects to a gateway (ePDG) in the communication system 2 via an IPsec tunnel on the carrier network. In this case, the DCM The eSIM 1 is equipped with another SIM (hereinafter, the second SIM) for connecting to a carrier network, and the owner of the vehicle 10 is required to make a contract with the carrier network in addition to the communication system 2. The profile information held in the second SIM and used for connecting to the carrier network is used for authentication in establishing a connection between the DCM 1 and the carrier network. The default profile or the owner profile in the eSIM is used for authentication in establishing a connection with the communication system 2 after the connection between the DCM 1 and the carrier network is established. In this case, there is no special contract between the carrier network used for connecting the DCM 1 to the communication system 2 and the communication system 2, and the owner of the vehicle 10 can freely select the carrier network. In addition, the default profile and the owner profile in the eSIM are not set with respect to charging for communication fees. The second SIM may be an eSIM or a card-type SIM. In the following, the description will be given assuming that the second SIM is an eSIM.

[0054] For example, in the DCM 1, a default profile is stored in the eSIM when the vehicle 10 is shipped from the factory, and profile information used for connecting to a carrier network designated by the manufacturer of the vehicle 10 is stored in the second SIM. The profile information includes a name, address, and telephone number of the vehicle 10 as a billing destination for communication fees. For example, the administrator of the communication system 2 (the manufacturer of the vehicle 10) is set. When the vehicle 10 is purchased, as described above, a profile for the owner is stored in the eSIM, and profile information used for connecting to a carrier network selected by the owner is stored in the second SIM. In the profile information, the owner of the vehicle 10 is set as the party to whom communication fees will be charged.

[0055] In the first embodiment, regardless of the method of connection between DCM 1 and communication system 2 through the carrier network, communication fees incurred while connected to communication system 2 using the default profile are charged to the administrator of communication system 2 (the manufacturer of vehicle 10).

[0056] FIG. 2 is a diagram showing an example of the hardware configuration of the DCM 1. The DCM 1 includes, as the hardware configuration, a CPU 101, a memory 102, an auxiliary storage device 103, a first communication unit 104A, a second communication unit 104B, and an eUICC 105. The auxiliary storage device 103 is, for example, a hard disk drive (HDD) and a solid state drive (SSD). Programs held in the auxiliary storage device 103 include, for example, an operating system (OS), a communication control program, and a plurality of other programs. The communication control program is a program that connects to the communication system 2 using profile information in the eUICC 105. The memory 102 includes, for example, a semiconductor memory such as a read only memory (ROM) and a random access memory (RAM). The memory 102 and the auxiliary storage device 103 are each an example of a computer-readable recording medium.

[0057] The CPU 101 executes various processes by loading the OS and various other programs stored in the auxiliary storage device 103 into the memory 102 and executing them. The number of CPUs 101 is not limited to one, and may be multiple. The CPU 101 is an example of a "control unit."

[0058] In the first embodiment, the first communication unit 104A communicates with an external device based on a 4G mobile communication method. If the communication system 2 is a system that supports a 5G or 6G or later mobile communication method, the first communication unit 104A also supports the mobile communication method supported by the communication system 2. The second communication unit 104B performs wireless communication based on a method different from the mobile communication method. The second communication unit 104B supports wireless communication methods such as WiFi and Bluetooth (registered trademark), for example.

[0059] In the first embodiment, the eUICC 105 is a chip-type eUICC. However, the present invention is not limited to this, and the eUICC 105 may be a card-type card that is removable from the DCM 1. In this case, the DCM 1 is provided with an eSIM card slot, reader, and writer. In FIG. 2, it is assumed that the eUICC 105 is a chip-type eUICC embedded in the DCM 1.

[0060] The eUICC 105 includes a CPU 105-1, a memory 105-2, and an auxiliary storage device 105-3. The CPU 105-1 and the memory 105-2 are similar to the CPU 101 and the memory 102, respectively. The auxiliary storage device 105-3 is, for example, a flash memory or an EEPROM. The auxiliary storage device 105-3 stores, for example, an OS of the eUICC, a program for downloading profile information, a program for managing the profile information, and the like.

[0061] The hardware configuration of the DCM 1 is not limited to the configuration shown in Fig. 2. For example, a device equivalent to a SIM may be further provided in addition to the eUICC 105. The device equivalent to a SIM is, for example, an eUICC or a SIM slot and a SIM card reader for a SIM card of a card-type removable UICC.

[0062] 3 shows an example of the functional configuration of the DCM 1. The DCM 1 includes, as its functional configuration, a communication control unit 11, an LPAd 12, and a service control unit 16. The communication control unit 11 controls the connection between the DCM 1 and the communication system 2 by using profile information that is held and enabled in the eUICC 105. The processing of the communication control unit 11 will be described in detail later.

[0063] The service control unit 16 performs control for receiving services of the communication system 2 including the services of the server 4. Specifically, the service control unit 16 performs authentication with the server 4 and processes related to the services.

[0064] The LPAd 12 manages the profile information held in the eUICC 105. That is, processing from the DCM 1 to the eUICC 105 is performed via the LPAd 12. More specifically, the LPAd 12 downloads profile information from the SM-DP+ 3 in accordance with an instruction from a user, and transfers the downloaded profile information to the eUICC 105. The LPAd 12 also accepts an instruction from a user to enable, disable, or delete the profile information held in the eUICC 105, and transfers the instruction to the eUICC 105. The LPAd 12 also inquires of the SM-DP+ 3 about the presence or absence of an event such as an update of the profile information, for example. In addition, when the communication control unit 11 and the service control unit 16 access information stored in the eUICC 105, the access is also performed via the LPAd 12.

[0065] The eUICC 105 has the following functional configuration: ISD-R (Issure Security Domain Root ) 13, a default profile ISD-P (Issure Security Domain Profile) 14, and an owner profile ISD-P 15. These functional configurations are achieved by the CPU 105-1 executing the programs stored in the auxiliary storage device 105-3.

[0066] The ISD-R 13 is an interface with the LPAd 12. The ISD-R 13 receives downloaded profile information from the LPAd 12 and installs the profile information. Secure communication is used for communication between the ISD-R 13 and the SM-DP+ 3. In addition, the ISD-R 13 enables, disables, or deletes the corresponding profile information according to an instruction input from the LPAd 12.

[0067] The ISD-P is an area for storing profile information. An ISD-P is generated for each piece of profile information. The profile information is downloaded from the SM-DP+ 3 as packaged data together with applets, a control program for an OTA (Over The Air) function, a program for controlling access to a wireless communication network, and the like, which will be described later. The packaged data including the profile information is hereinafter referred to as a profile package. The profile package includes an encrypted portion for storing the profile information, etc., and a portion for storing the procedure for creating the ISD-P. The ISD-P is created by the ISD-R 13 based on the procedure for creating the ISD-P described in the profile package. The encrypted portion of the profile package is decrypted by the OS of the eUICC, and the profile information, etc. are expanded in the ISD-P. Hereinafter, the ISD-P may also be referred to as a profile. Furthermore, enabling the profile information indicates activating the ISD-P.

[0068] The ISD-P for default profile 14 is created when a default profile package is downloaded from the SM-DP+ 3 and installed at the factory. The ISD-P for owner profile 15 is created when an owner profile package is downloaded from the SM-DP+ 3 and installed by the operation of the owner of the vehicle 10. It is created when the

[0069] The ISD-P 15 for owner profile stores profile information 151, an authentication information generation applet 152, authentication information 153, and a personal identification certificate 154. The profile information 151 is a profile for the owner of the vehicle 10. The profile information 151 includes, for example, an International Mobile Subscription Identity (IMSI) which is an individual identification number of the DCM 1, an Integrated Circuit Card ID (ICCID) which is identification information for the owner profile of the vehicle 10, and authentication information used for authenticating the communication system 2. The authentication information used for authenticating the communication system 2 is, for example, a public key and a private key for AKA authentication.

[0070] The authentication information generation applet 152 is a program that generates authentication information 153 using the profile information 151 as a key. The authentication information 153 is, for example, a public key and a private key used in TLS authentication adopted by the server 4. The identity verification certificate 154 is an electronic certificate issued by the certificate authority 5 for the authentication information 153. When the authentication information 153 includes a public key and a private key, the identity verification certificate 154 is an electronic certificate for the public key. The public key and the private key are also collectively referred to as key information. Note that in FIG. 3, components according to the first embodiment are extracted and shown, and the components included in the ISD-P for owner profile 15 are not limited to the components shown in FIG. 3.

[0071] The ISD-P for default profile 14 stores, for example, default profile information. The default profile information includes, for example, IMSI, which is an individual identification number of the DCM 1, ICCID, which is identification information of the default profile information, and authentication information used to authenticate the communication system 2. The IMSI and ICCID, etc., are different values ​​between the ISD-P for default profile 14 and the ISD-P for owner profile 15. If the vehicle 10 is to receive the service of the server 4 even during sales, the ISD-P for default profile 14 may store authentication information used to authenticate the server 4 and an electronic certificate that certifies that the authentication information belongs to the administrator of the communication system 2 (the manufacturer of the vehicle 10). If the authentication information is generated by an applet, the applet may also be stored in the ISD-P for default profile 14. The generation algorithm of the authentication information of the applet may be the same as or different from that of the authentication information generation applet 152. However, the format of the generated authentication information is the same regardless of the generation algorithm.

[0072] It should be noted that the functional configuration of the DCM 1 shown in FIG. 3 is just an example, and the functional configuration of the DCM 1 is not limited to the example shown in FIG.

[0073] 4 is a diagram showing an example of a hardware configuration of the information processing device 6. The information processing device 6 is an example of a device that operates as any of the HSS 21, the AAA 22, the SM-DP+ 3, and the server 4. The information processing device 6 is, for example, a computer or device dedicated to the HSS 21, the AAA 22, the SM-DP+ 3, and the server 4.

[0074] The information processing device 6 includes, as its hardware configuration, a processor 601, a memory 602, an auxiliary storage device 603, and a communication unit 604. The processor 601, the memory 602, the auxiliary storage device 603, and the communication unit 604 are electrically connected by a bus. The memory 602 and the auxiliary storage device 603 are similar to the memory 102 and the auxiliary storage device 103, respectively. The auxiliary storage device 603 stores the HSS 21, AAA 22, SM-DP+ 3, and a program for implementing the operation of any one of the server 4 are stored.

[0075] The processor 601 executes various processes by loading the OS and various other programs held in the auxiliary storage device 603 into the memory 602 and executing them. The processor 601 is, for example, a CPU, a DSP, or a GPU (Graphics Processing Unit). The number of processors 601 is not limited to one, and multiple processors 601 may be provided. When multiple processors 601 are provided, the multiple processors 601 may be different types of processors.

[0076] The communication unit 604 is, for example, a network interface card (NIC), an optical line interface, etc. The communication unit 604 may be, for example, a wireless communication circuit that connects to a wireless network such as a wireless LAN. The hardware configuration of the information processing device 6 is not limited to that shown in FIG.

[0077] 5 is a diagram showing an example of the functional configuration of the HSS 21. The HSS 21 includes, as its functional configuration, a control unit 211, a subscriber information DB 212, and a terminal connection information DB 213. For example, in response to a request from the AAA 22, the HSS 21 reads data from the subscriber information DB 212 or the terminal connection information DB 213, or writes data to the subscriber information DB 212 or the terminal connection information DB 213.

[0078] The subscriber information DB 212 holds subscriber information. The terminal connection information DB 213 holds information on terminals connected to the communication system 2. Note that the functional configuration of the HSS 21 is not limited to that shown in FIG.

[0079] Fig. 6 is a diagram showing an example of information stored in the subscriber information DB 212. One record of the subscriber information DB 212 shown in Fig. 6 includes fields for a subscriber ID, a vehicle ID, a SIM ID, a profile ID, a matching ID, defaults, authentication information, and setting information.

[0080] The subscriber ID field stores, for example, an IMSI that the communication system 2 assigns to a subscriber of the service of the communication system 2. In the first embodiment, the subscriber is the administrator of the communication system 2 in the default profile, and the owner of the vehicle 10 (a contract holder of the service of the communication system 2) in the owner profile.

[0081] The vehicle ID field stores the IMEI (International Mobile Equipment Identity), which is the identification information of the DCM 1 assigned by the manufacturer of the DCM 1. The manufacturer of the vehicle 10 may be different from the manufacturer of the DCM 1. The SIM ID field stores an EID (Embedded Identity Document), which is an identification number of the SIM assigned to the eUICC or UICC.

[0082] The profile ID field stores an ICCID, which is identification information of the profile information. The matching ID field stores a matching ID assigned to the profile information. The matching ID is identification information for identifying a profile package in the SM-DP+ 3. The default field stores information indicating whether the profile information is a default profile or not. The information indicating whether the profile information is a default profile or not is, for example, a flag. The authentication information field stores authentication information used to authenticate the DCM 1. For example, when the authentication method adopted by the AAA 22 is AKA authentication, the authentication information field stores a public key and a private key corresponding to the DCM 1.

[0083] The setting information field stores the contents set in the profile. For example, the profile setting information includes, for example, the contract details with the subscriber, policy information, etc. If the communication system 2 is an MVNO, the setting information also stores the party to be charged for communication fees, charging rules, etc. In the case of a default profile, the party to be charged for communication fees is the administrator of the communication system 2 (the manufacturer of the vehicle 10). In the case of an owner's profile, the party to be charged for communication fees is the owner of the vehicle 10.

[0084] The information held in the subscriber information DB 212 is input, for example, from an operator terminal of the communication system 2. Note that the information held in the subscriber information DB 212 is not limited to the example shown in FIG.

[0085] Fig. 7 is a diagram showing an example of information held in the terminal connection information DB 213. The terminal connection information DB 213 stores information related to the connection of the DCM 1 currently connected to the communication system 2. One record of the terminal connection information DB 213 shown in Fig. 7 includes fields for a subscriber ID, a vehicle ID, an authentication date and time, and a profile ID.

[0086] The subscriber ID and vehicle ID fields store the IMSI and IMEI, respectively, in the same manner as the subscriber ID and vehicle ID fields of the subscriber information DB 212. The authentication date and time stores the date and time when the DCM 1 in question was authenticated by the AAA 22. The profile ID field stores the identification information (ICCID) of the profile information used for authentication by the AAA 22. A record in the terminal connection information DB 213 is generated when the DCM 1 is newly connected to the communication system 2, and is deleted when communication with the DCM 1 in question is disconnected.

[0087] When the ICCID in the profile ID field of a record in the terminal connection information DB 213 is indicated to be the default profile in the subscriber information DB 212, it is possible to specify that the corresponding vehicle is currently being sold as a new car or a used car. The information held in the terminal connection information DB 213 is not limited to that shown in Fig. 7. In addition, in the first embodiment, an example has been shown in which the subscriber information DB 212 manages information that does not change according to the connection status of the DCM 1, and the terminal connection information DB 213 manages information that changes dynamically according to the connection status of the DCM 1, but this is not limiting. The information held in the subscriber information DB 212 and the information held in the terminal connection information DB 213 may be managed as one database in an integrated state.

[0088] 8 is a diagram showing an example of the functional configuration of the server 4. The server 4 includes, as its functional configuration, an authentication unit 41, a service providing unit 42, and a user information DB 43. The authentication unit 41 authenticates the DCM 1 by a predetermined authentication method (for example, TLS authentication). By receiving the personal identification certificate 154 from the DCM 1, the authentication unit 41 is permitted to access the authentication unit 41. The service providing unit 42 performs processing related to the service corresponding to the DCM 1.

[0089] The user information DB 43 stores information about users of the services provided by the server 4. The information about the users includes, for example, user identification information, authentication information used to authenticate the user, personal information of the user, and service contents corresponding to the personal information of the user. For example, the identification information of the user is the identification information (IMSI) of the subscriber in the communication system 2.

[0090] The personal identification certificate 154 is for authentication information generated using the profile information. The profile information includes identification information (IMSI) that can identify the owner of the vehicle 10. The service providing unit 42 can identify the owner of the vehicle 10 by the personal identification certificate 154 used for authentication, and can provide services according to the attributes of the owner of the vehicle 10. For example, the user information DB 43, which stores personal information of the user, etc. A part of the information stored in the server 4 may be reused from information in a database stored in the communication system 2. The functional configuration of the server 4 is not limited to that shown in FIG.

[0091] <Processing flow> Fig. 9 is an example of a flowchart of a profile information download process executed by the DCM 1. The process shown in Fig. 9 is executed repeatedly while the DCM 1 is in operation. The process shown in Fig. 9 is executed mainly by the CPU 101 of the DCM 1, but for convenience, the process will be described mainly with reference to the functional components. The same applies to the flowcharts subsequent to Fig. 9.

[0092] In the OP101, the LPAd 12 determines whether a user operation for requesting acquisition of a profile has been input. For example, when a subscription contract for the service of the communication system 2 is made, a QR code (registered trademark) including an activation code for downloading an owner profile from the communication system 2 is notified to the DCM 1. The QR code may be notified, for example, by being printed on a paper medium, by accessing a predetermined URL, or by being sent to the smartphone of the owner of the vehicle 10 by e-mail or the like. When the QR code is notified on a paper medium or the smartphone of the owner of the vehicle 10, for example, the owner of the vehicle 10 may input a user operation for requesting acquisition of a profile to the DCM 1 by reading the QR code with an in-vehicle camera or the like mounted on the vehicle 10 and connected to the DCM 1. When the QR code is notified as digital data (for example, image data, etc.) by accessing a predetermined URL, the DCM 1 may input a user operation for requesting acquisition of a profile to the DCM 1 by reading the data of the QR code. The activation code is also input together with the request. Note that the user operation for requesting profile acquisition is not limited to the method using the QR code.

[0093] If a user operation requesting acquisition of a profile has been input (OP101: YES), the processing proceeds to OP102. If a user operation requesting acquisition of a profile has not been input (OP101: NO), the processing proceeds to OP105.

[0094] In OP 102, the LPAd 12 transmits a profile request to the SM-DP+ 3 to request acquisition of profile information. When a QR code is used, an activation code is also transmitted together with the profile request. The activation code includes, for example, the address of the SM-DP+ 3 and a matching ID.

[0095] In OP103, the LPAd 12 downloads the profile package from the SM-DP+ 3. In OP104, the LPAd 12 transfers the downloaded profile package to the ISD-R 13. Then, the process shown in FIG. 9 ends.

[0096] In the OP 105, the LPAd 12 determines whether there is an update to the profile information held in the ISD-P 15 for the owner profile. The profile information is updated, for example, when a vulnerability is found in the authentication information included in the profile information 151 or the authentication information 153, when the algorithm of the authentication information generation applet 152 is updated, etc. The update to the profile information is detected by the ISD-R 13 and the LPAd The update is notified to OP105. If there is an update to the profile information held in the ISD-P for owner profile 15 (OP105: YES), the process proceeds to OP101.

[0097] Note that profile information is updated package by package. Therefore, a profile package containing the updated profile information is downloaded from SM-DP+3, and a new ISD-P corresponding to the updated profile information is created. The ISD-P corresponding to the profile information is invalidated by activating the ISD-P corresponding to the updated profile information. Therefore, the matching ID of the profile package is changed from that before the update. The matching ID of the profile package including the updated profile information is obtained from the SM-DP+ 3, for example, when the ISD-R 13 detects the update of the profile information. However, the update of the profile information is not limited to being performed for each package, and may be performed for each profile information unit and applet unit where the update has occurred. When the profile information is updated for each profile information unit or applet unit, the updated profile information or applet may be downloaded from the SM-DP+ 3 and stored in the corresponding ISD-P. The download process of the profile information is not limited to the process shown in FIG. 9, and may be appropriately changed according to the embodiment.

[0098] Fig. 10 is an example of a flowchart of a process for enabling or disabling a profile, which is executed by the DCM 1. The process shown in Fig. 10 is repeatedly executed at a predetermined cycle while the DCM 1 is in operation.

[0099] In OP201, the LPAd 12 determines whether a user operation for activating a profile has been input. The user operation for activating or deactivating a profile is input, for example, from a menu screen related to the SIM. If a user operation for activating a profile has been input (OP201: YES), the process proceeds to OP202. In OP202, the LPAd 12 notifies the ISD-R 13 of an instruction for activating a profile, and the ISD-R 13 deactivates the profile if there is a currently activated profile. If there is no currently activated profile, the process of OP202 is skipped. In OP203, the ISD-R 13 activates the profile (ISD-P) designated for activation.

[0100] When a user operation to activate the profile has not been input (OP201: NO), the process proceeds to OP204. In OP204, the LPAd 12 determines whether or not a user operation to disable the profile has been input. When a user operation to disable the profile has been input (OP204: YES), the process proceeds to OP205. When neither a user operation to activate the profile nor a user operation to disable the profile has been input (OP204: NO), the process illustrated in FIG. 10 ends. In OP205, the LPAd 12 notifies the ISD-R 13 of an instruction to disable the profile, and the ISD-R 13 disables the profile (ISD-P) designated to be disabled.

[0101] In OP206, since there is a change in the enabled or disabled profile, the LPAd 12 notifies the communication control unit 11 of the change in the enabled profile or the invalidation of all profiles. When there is a change in the enabled profile, the communication control unit 11 reconnects communication to the communication system 2 using newly enabled profile information. When the profile information is invalidated and there is no enabled profile, communication with the communication system 2 is disconnected. After that, the process shown in FIG. 10 ends.

[0102] For example, when the vehicle 10 is shipped from the factory, a staff member inputs an operation to activate the default profile (OP201: YES), and the default profile is activated (OP203). For example, when the vehicle 10 is purchased and the new owner downloads an owner profile from the SM-DP+ 3 in preparation for connecting the DCM 1 to the communication system 2, the owner of the vehicle 10 inputs a user operation to activate the owner profile (OP201: YES). In this case, since the default profile has been activated, the default profile is deactivated (OP202), and then the owner profile is deactivated. The profile is activated (OP203).

[0103] For example, when the vehicle 10 is sold by the owner to a used car dealer and begins to be sold as a used car, the owner of the vehicle 10 or a staff member of the used car dealer inputs a user operation to activate the default profile in order to deactivate the owner profile (OP201: YES). In this case, first, the activated owner profile is deactivated (OP202), and then the default profile is activated (OP203). When the owner profile is deactivated, the authentication information 153 and the personal identification certificate 154 in the owner profile ISD-P 15 are also deactivated.

[0104] The process of enabling or disabling the profile is not limited to the example shown in Fig. 10. When the vehicle 10 is sold by the owner to a used car dealer, the owner profile may be deleted from the eUICC 105.

[0105] Fig. 11 is an example of a flowchart of the process of acquiring the identity confirmation certificate 154 executed by the DCM 1. The process shown in Fig. 11 is started with the user's permission to acquire the identity confirmation certificate 154, for example, when the service control unit 16 accesses the server 4 and the identity confirmation certificate 154 is not stored in the ISD-P 15 for the owner profile, and when the identity confirmation certificate 154 in the ISD-P 15 for the owner profile has expired. The identity confirmation certificate 154 is not stored in the ISD-P 15 for the owner profile when, for example, the server 4 has not been accessed since the owner profile was downloaded from the SM-DP+ 3 or since the owner profile was updated.

[0106] In OP301, the service control unit 16 requests the LPAd 12 to generate authentication information 153 using the authentication information generation applet 152. In OP302, the LPAd 12 starts the authentication information generation applet 152 via the ISD-R 13, generates the authentication information 153, and the service control unit 16 acquires the authentication information 153. In OP303, the service control unit 16 transmits a request to the certificate authority 5 for issuance of a digital certificate for the authentication information 153. A part (e.g., a public key) or all of the authentication information 153 is also transmitted together with the request.

[0107] In OP304, the service control unit 16 acquires the identity verification certificate 154 from the certificate authority 5. In OP305, the service control unit 16 stores the authentication information 153 and the identity verification certificate 154 in the ISD-P 15 for the owner profile. After that, the process shown in Fig. 11 ends. The service control unit 16 transmits the identity verification certificate 154 to the server 4, performs authentication processing with the server 4 using the authentication information 153, and starts using the service of the server 4. Note that the process of acquiring the identity verification certificate 154 is not limited to the example shown in Fig. 11.

[0108] Fig. 12 is a diagram showing an example of a processing sequence in which the DCM 1 acquires an owner profile and connects to the communication system 2. As a premise of the processing sequence shown in Fig. 12, a default profile is stored in the eUICC 105 and the default profile is enabled.

[0109] In S11, the DCM 1 accepts a user operation input of an owner profile request from the owner of the vehicle 10 (FIG. 9, OP101: YES). In S12, the DCM 1 transmits a profile request to the SM-DP+ 3 (FIG. 9, OP102). In S13, the DCM 1 downloads an owner profile package from the SM-DP+ 3 (FIG. 9, OP103). The communication between the DCM 1 and the SM-DP+ 3 in S12 and S13 is performed, for example, via WiFi. In S14, the DCM 1 The downloaded owner profile package is transferred to the eUICC 105 (FIG. 9, OP104). In S15, the ISD-R 13 in the eUICC 105 creates an owner profile ISD-P 15 from the owner profile package, and installs the owner profile.

[0110] In S21, a user operation for activating the owner profile is input from the owner of the vehicle 10 to the DCM 1 (OP201: YES). In S22, the DCM 1 transmits a user operation for activating the owner profile to the eUICC The ISD-R 13 in 105 is instructed to activate the owner profile. In S23, the currently activated default profile is deactivated (OP202), and then the owner profile is activated (OP204). In S24, the DCM 1 is notified that the new owner profile has been activated (OP206).

[0111] In S25, the DCM 1 executes a procedure for establishing a connection to the communication system 2 using the owner profile information. In a series of procedures in the AAA 22, an authentication process is performed between the DCM 1 and the HSS 21 using the owner profile information (AKA authentication). When communication between the DCM 1 and the communication system 2 is established, the DCM 1 becomes able to communicate with an external network such as the Internet via the communication system 2.

[0112] Fig. 13 is a diagram showing an example of a processing sequence in which the DCM 1 acquires the identity verification certificate 154 and accesses the server 4. As a prerequisite for the processing sequence shown in Fig. 13, for example, the sequence shown in Fig. 12 has been executed, and the DCM 1 has already connected to the communication system 2 using the owner profile.

[0113] In S31, the DCM 1 receives input of a user operation of a request to acquire the personal identification certificate 154 from a user (e.g., the owner of the vehicle 10) (FIG. 11, OP301). For example, if a user operation of starting a service of the server 4 is input from the user and the personal identification certificate 154 is not held in the eUICC 105, a message requesting permission to acquire the personal identification certificate 154 or the like is output, and if the user gives permission, a user operation of a request to acquire the personal identification certificate 154 is input.

[0114] In S32, the DCM 1 instructs the ISD-R 13 of the eUICC 105 to generate authentication information 153. In S33, the authentication information generation applet 152 of the eUICC 105 generates the authentication information 153 using the profile information 151. In S34, the DCM 1 acquires the ISD-R 13 through the ISD-R 13 of the eUICC 105 (FIG. 11, OP302). In S35, the DCM 1 transmits a request for issuing an electronic certificate for the authentication information 153 and the authentication information 153 (e.g., a public key) to the certification authority 5 (FIG. 11, OP303). In S36, the certification authority 5 issues an identification certificate 154. In S37, the DCM 1 receives the identification certificate 154 from the certification authority 5 (FIG. 11, OP304). In S38, the DCM 1 transfers the identification certificate 154 to the eUICC 105. In S39, the ISD-R 13 of the eUICC 105 stores the identification certificate 154 and the authentication information 153 in the ISD-P 15 for the owner profile (FIG. 11, OP305).

[0115] In S41, the DCM 1 reads the identity verification certificate 154 from the eUICC 105. In S42, the DCM 1 transmits an authentication request and the identity verification certificate 154 to the server 4. Thereafter, the DCM 1 performs an authentication process between the server 4 and the DCM 1 using the authentication information 153 (e.g., TLS authentication). In S44, the server 4 authenticates the DCM 1 and thereafter starts providing services to the DCM 1. The server 4 identifies the current owner of the vehicle 10 from the identity verification certificate 154, and can provide services according to, for example, the attributes of the owner of the vehicle 10.

[0116] Fig. 14 is a diagram showing an example of transition of profile information used in the vehicle 10. At the time of shipment from the factory, a default profile is stored in the eUICC 105 and enabled. From the time of shipment from the factory until the time of purchase and subscription to the service of the communication system 2, the default profile is enabled, and the DCM 1 connects to the communication system 2 using the default profile. Information on the default profile is registered in the HSS 21 of the communication system 2 (see Fig. 6, for example).

[0117] When a subscription contract to the service of the communication system 2 is concluded, the profile for owner A is downloaded and activated. This disables the default profile. During the period from subscribing to the service of the communication system 2 to being sold, the DCM 1 connects to the communication system 2 using the profile for owner A. After the profile for owner A is activated, the personal identification certificate 154 is also obtained. Information about the owner A and information about the profile for owner A are registered in the HSS 21 of the communication system 2 (see, for example, FIG. 6). Note that the information of the default profile remains in the HSS 21.

[0118] When the vehicle 10 is sold to a used car dealer, the default profile is activated and the owner A's profile is deactivated. At the same time, the identity verification certificate 154 in the ISD-P 15 for the owner's profile is also deactivated. Furthermore, the contract between the owner of the vehicle 10 and the service of the communication system 2 is also terminated, so the information about the owner A and the information about the owner A's profile are deleted from the HSS 21 of the communication system 2. After that, until the vehicle 10 is purchased and a subscription contract for the service of the communication system 2 is concluded with the new owner, the DCM 1 connects to the communication system 2 using the default profile.

[0119] When the vehicle 10 is purchased again and a new subscription contract for the service of the communication system 2 for the new purchaser B is concluded, the profile for owner B is downloaded and activated, and the default profile is deactivated. Thereafter, the DCM 1 connects to the communication system 2 using the profile for owner B. After the profile for owner B is activated, an identity verification certificate 154 corresponding to the profile for owner B is also obtained. Information about owner B and information about the profile for owner B are registered in the HSS 21 of the communication system 2 (see, for example, FIG. 6).

[0120] <Effects of the First Embodiment> In the first embodiment, the identity certificate 154 is generated from the profile information 151 and stored in the ISD-P for owner profile 15, so that the owner profile information and the ISD-P for owner profile 15 also change as the owner of the vehicle 10 changes, as shown in Fig. 14. The server 4, which performs authentication using the identity certificate 154, can identify the new owner from the identity certificate 154 even if the owner of the vehicle 10 changes. This allows the server 4 to provide services according to the attributes, etc. of the current owner of the vehicle 10, for example.

[0121] 14, in the first embodiment, the DCM 1 can connect to the communication system 2 using a default profile even when the DCM 1 is not owned by a specific individual, that is, even when the vehicle 10 is being sold as a new car or a used car. This allows the communication system 2 to collect and control information related to communication of the vehicle 10 even when the vehicle 10 is being sold as a new car or a used car.

[0122] In the first embodiment, in addition to when the owner is changed, the owner profile is updated due to detection of vulnerabilities in the identity verification certificate 154 or the owner profile, and the identity verification certificate 154 is also updated. This makes it possible to cover vulnerabilities in the identity verification certificate 154 and the owner profile, thereby further improving security.

[0123] <Other Modifications> The above-described embodiment is merely an example, and the present disclosure can be modified and implemented as appropriate without departing from the spirit and scope of the present disclosure.

[0124] In the first embodiment, it is assumed that the communication system 2 is a system compatible with 4G. However, the present invention is not limited to this, and the communication system 2 may be a system compatible with 5G, 3G, and 6G or later mobile communication methods. When the communication system 2 is compatible with 5G, the communication system 2 may use, for example, UDM (Unified Data Management) instead of HSS. Equipped with.

[0125] In the first embodiment, the communication system 2 is a system managed by the manufacturer of the vehicle 10, and has been described as collecting and controlling information related to the communication of the vehicle 10, but the application of the technology described in the first embodiment is not limited to the vehicle 10 and the communication system 2. For example, it is also possible to apply the technology to a communication terminal such as a smartphone or an IoT terminal and the communication system of the manufacturer. Furthermore, the administrator of the communication system 2 can receive a request from a third party to collect information related to the communication of a subscriber of the service of the communication system 2, collect information related to the communication of a terminal connected to the communication system 2, and provide the information to the third party. In this case, the communication fee when the default profile is used is charged to the third party.

[0126] The processes and means described in this disclosure can be freely combined and implemented as long as no technical contradiction occurs.

[0127] Furthermore, a process described as being performed by one device may be shared and executed by multiple devices. Alternatively, a process described as being performed by different devices may be executed by one device. In a computer system, the hardware configuration (server configuration) by which each function is realized can be flexibly changed.

[0128] The present disclosure can also be realized by supplying a computer program implementing the functions described in the above embodiments to a computer, and having one or more processors of the computer read and execute the program. Such a computer program may be provided to the computer by a non-transitory computer-readable storage medium connectable to the system bus of the computer, or may be provided to the computer via a network. Non-transitory computer-readable storage media include, for example, any type of disk, such as a magnetic disk (floppy disk, hard disk drive (HDD), etc.), an optical disk (CD-ROM, DVD disk, Blu-ray disk, etc.), a read-only memory (ROM), a random access memory (RAM), an EPROM, an EEPROM, a magnetic card, a flash memory, an optical card, and any type of medium suitable for storing electronic instructions. [Explanation of symbols]

[0129] 1··DCM 2. Communication Systems 3·SM-DP+ 4. Server 5. Certificate Authority 6. Information processing device 10. Vehicle 11. Communication control section 12··LPAd 13··ISD-R 14 Default profile for ISD-P 15 ISD-P for Owner Profile 16 Service Control Section 21··HSS 22 AAA 41 Authentication section 42 Service Department 43 User information DB 101··CPU 102 Memory 103...Auxiliary storage device 104A...1st Communication Department 104B Second communication section 105 eUICC 151··Profile Information 152 Authentication information generation applet 153 Authentication Information 154. Identification card 211 Control section 212·Subscriber information DB 213 Terminal connection information DB

Claims

1. An embedded universal integrated circuit card (eUICC) that is used for connecting to a first communication system and holds first profile information associated with a first owner of the information processing device; a control unit that executes a connection to the first communication system using the first profile information; Equipped with The control unit is Obtaining a first electronic certificate from a predetermined certificate authority, the first electronic certificate proving that first authentication information corresponding to the first profile information belongs to the first owner, the first authentication information being used for authentication by a first server trusted by the first communication system; storing the first authentication information and the first electronic certificate in the eUICC; receiving authentication by the first server using the first authentication information and the first electronic certificate; Further execute Information processing device.

2. further holding an applet that generates the first authentication information using the first profile information as a key; The control unit is launching the applet to generate the first authentication information; The information processing device according to claim 1 .

3. The control unit is acquiring the first profile information and the applet from a second server that manages profile information; storing the first profile information and the applet in the eUICC; Further execute The information processing device according to claim 2 .

4. The control unit is When the applet is updated, acquiring at least the updated applet from the second server and storing it in the eUICC; activating the updated applet to newly generate the first authentication information; acquiring the first electronic certificate from the predetermined certificate authority for the newly generated first authentication information, and storing the newly generated first authentication information and the newly acquired first electronic certificate in the eUICC; The information processing device according to claim 3 .

5. The control unit is When second profile information newly stored in the eUICC, which is used for connecting to the first communication system and corresponds to a second owner of the information processing device, is validated, a second electronic certificate is obtained from the predetermined certificate authority to certify that second authentication information corresponding to the second profile information belongs to the second owner; storing the second authentication information and the second electronic certificate in the eUICC; being authenticated by the first server using the second authentication information and the second electronic certificate; the first profile information and the first digital certificate are revoked or deleted; The information processing device according to claim 1 .

6. the control unit, after the authentication by the first server, identifies the first owner from the first electronic certificate by the first server, and receives a service according to the first owner from the first server; The information processing device according to claim 1 .

7. The eUICC does not hold the first profile information at the time of shipment from a factory, and holds default profile information used for connecting to the first communication system; The control unit is Activating the default profile information to connect to the first communication system; When the first profile information is acquired from a second server that manages profile information and stored in the eUICC, the default profile information is invalidated and the first profile information is valid; when a predetermined second-hand dealer sells the information processing device second-hand, the first profile information is invalidated or deleted, and the default profile information is valid. The information processing device according to claim 1 .

8. The information processing device is mounted on a vehicle, the first communication system is a system managed by a manufacturer of the vehicle; the first profile information is published by the first communication system when the vehicle is purchased by the first owner; The information processing device according to claim 1 .

9. A computer including an embedded universal integrated circuit card (eUICC) that is used for connecting to a first communication system and that holds first profile information associated with a first owner of an information processing device, connecting to the first communication system using the first profile information; Obtaining a first electronic certificate from a predetermined certificate authority, the first electronic certificate proving that first authentication information corresponding to the first profile information belongs to the first owner, the first authentication information being used for authentication by a first server trusted by the first communication system; storing the first authentication information and the first electronic certificate in the eUICC; receiving authentication by the first server using the first authentication information and the first electronic certificate; How to do more.

10. the computer further includes an applet that generates the first authentication information using the first profile information as a key; The computer, launching the applet to generate the first authentication information; 10. The method of claim 9.

11. The computer, acquiring the first profile information and the applet from a second server that manages profile information; storing the first profile information and the applet in the eUICC; Further execute The method of claim 10.

12. The computer, When the applet is updated, acquiring at least the updated applet from the second server and storing it in the eUICC; activating the updated applet to newly generate the first authentication information; acquiring the first electronic certificate from the predetermined certificate authority for the newly generated first authentication information, and storing the newly generated first authentication information and the newly acquired first electronic certificate in the eUICC; The method of claim 11.

13. The computer When second profile information newly stored in the eUICC, which is used for connecting to the first communication system and corresponds to a second owner of the information processing device, is validated, a second electronic certificate is obtained from the predetermined certificate authority to certify that second authentication information corresponding to the second profile information belongs to the second owner; storing the second authentication information and the second electronic certificate in the eUICC; being authenticated by the first server using the second authentication information and the second electronic certificate; the first profile information and the first digital certificate are revoked or deleted; 10. The method of claim 9.

14. The eUICC does not hold the first profile information at the time of shipment from a factory, and holds default profile information used for connecting to the first communication system; The computer, Activating the default profile information to connect to the first communication system; When the first profile information is acquired from a second server that manages profile information and stored in the eUICC, the default profile information is invalidated and the first profile information is valid; when a predetermined second-hand dealer sells the information processing device second-hand, the first profile information is invalidated or deleted, and the default profile information is valid.

10. The method of claim 9.

15. The computer is mounted on a vehicle, the first communication system is a system managed by a manufacturer of the vehicle; the first profile information is published by the first communication system when the vehicle is purchased by the first owner; 15. The method according to any one of claims 9 to 14.

16. An embedded universal integrated circuit card (eUICC) capable of holding multiple pieces of profile information used for connecting to a communication network; a control unit that enables any one of the plurality of pieces of profile information and connects to the communication network using the enabled profile information; An information processing device comprising: The eUICC holds default profile information used for connecting to a first communication system at the time of shipment of the information processing device from a factory, The control unit is When the information processing device is shipped from a factory, the default profile information is enabled, and the information processing device connects to the first communication system using the default profile information; When first profile information corresponding to a first owner of the information processing device is stored in the eUICC, the default profile information is invalidated, the first profile information is enabled, and the first communication system is controlled using the first profile information. Connect to, An information processing device.

17. The default profile information is set to charge communication fees to a predetermined carrier. The information processing device according to claim 16.

18. the control unit, when a predetermined second-hand dealer sells the information processing device second-hand, invalidates or deletes the first profile information, enables the default profile information, and connects to the first communication system using the default profile information. The information processing device according to claim 16.

19. The control unit is Obtaining a first electronic certificate from a predetermined certificate authority, the first electronic certificate proving that first authentication information corresponding to the first profile information belongs to the first owner, the first authentication information being used for authentication by a first server trusted by the first communication system; storing the first authentication information and the first electronic certificate in the eUICC; receiving authentication by the first server using the first authentication information and the first electronic certificate; Further execute The information processing device according to claim 16.

20. An information processing device according to any one of claims 16 to 19; a third server that holds information indicating whether profile information used in connection to the first communication system by the information processing device is default profile information; A system comprising:

Images