Access control system and access control method

Abstract

To verify the validity of a user of a diagnostic device accessing an ECU on the ECU side, and manage access to the ECU on the basis of the results of this verification.SOLUTION: In order to authenticate a user 5 who uses a fault diagnosis machine 10, an ECU 11 requests the fault diagnosis machine 10 connected to the ECU 11 to transmit user authentication information, specifying a device from which the fault diagnosis machine 10 is to obtain the user authentication information. The fault diagnosis machine 10 executes a process to obtain the user authentication information from the device specified by the ECU 11, and transmits the user authentication information obtained from the device to the ECU 11. The ECU 11 verifies the validity of the user authentication information transmitted from the fault diagnosis machine 10, and permits the fault diagnosis machine 10 to access the ECU 11 only when the verification of the validity of the user authentication information is successful.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to access management to an ECU (Electronic Control Unit) used for electronic control of a vehicle. [Background technology]

[0002] As vehicles (automobiles) become more electronically controlled, they are now equipped with ECUs (Electronic Control Units), which are microcomputers used for electronic control of the vehicle. A vehicle does not have just one ECU, but vehicles that require advanced electronic control, such as hybrid vehicles, are equipped with many ECUs.

[0003] The ECU installed in a vehicle is configured to be accessible from the outside. Devices that can access the ECU installed in a vehicle from the outside include other vehicles and infrastructure equipment installed on the road (traffic lights, road signs), but fault diagnosis devices also known as scan tools are widely used as devices for accessing the ECU installed in a vehicle from the outside.

[0004] A fault diagnosis device is an electronic device that communicates with the ECU via a diagnostic port (OBD port, OBD: On-Board Diagnostics) installed in the vehicle and reads fault codes from the ECU. Some fault diagnosis devices are compatible only with vehicles from a specific vehicle manufacturer, but there are also general-purpose fault diagnosis devices that are compatible with multiple vehicle manufacturers.

[0005] Unauthorized access to the ECU using a diagnostic connector provided in the vehicle is a threat to the ECU. For this reason, the ECU needs to verify the legitimacy of a diagnostic device that accesses the ECU through a diagnostic port provided in the vehicle. In order to verify the legitimacy of the diagnostic device, the invention disclosed in Patent Document 1 embeds a message authentication code in a message sent to the ECU. Since the ECU needs a vehicle key to authenticate the message authentication code, the invention disclosed in Patent Document 2 discloses a technology for securely delivering the vehicle key of the ECU to the diagnostic device. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] JP 2013-98719 A [Patent Document 2] JP 2019-161521 A Summary of the Invention [Problem to be solved by the invention]

[0007] However, conventional ECUs do not have a function for verifying the legitimacy of a user who uses a diagnostic tool that accesses the ECU, and it is not possible to prevent unauthorized access by a malicious third party. Considering that there are general-purpose diagnostic tools that are compatible with multiple vehicle manufacturers, it is desirable to be able to verify the legitimacy of a user who uses a diagnostic tool on the ECU side even if the user of the diagnostic tool cannot be limited. Therefore, in the present invention, the legitimacy of a user of a diagnostic tool that accesses the ECU is verified on the ECU side, and access to the ECU can be managed based on the verification result. [Means for solving the problem]

[0008] A first invention for solving the above-mentioned problems is an access management system including an ECU that performs electronic control of a vehicle, and a fault diagnosis device that connects to the ECU via a diagnostic port provided in the vehicle. The ECU of the first invention is equipped with an access management means that requests the fault diagnosis machine connected to the ECU to transmit user certification information by specifying a device that obtains user certification information having an electronic signature that can be verifiable using a public key stored in the ECU, and then uses the public key to verify the validity of the user certification information received from the fault diagnosis machine, and allows the fault diagnosis machine to access the ECU only if the verification of the validity of the user certification information is successful. The fault diagnosis machine according to the first aspect of the present invention includes an access request means for acquiring the user authentication information from the device and transmitting the user authentication information acquired from the device to the ECU.

[0009] A second invention is an invention in which the device for acquiring user authentication information in the first invention is an authentication device having a function for authenticating authentication information of a user. The authentication device according to the second aspect of the present invention includes an authentication means for authenticating user authentication information transmitted by a fault diagnosis device, and transmitting the authentication result of the authentication information, to which an electronic signature generated by using a private key that pairs with the public key, to the fault diagnosis device as the user certification information. The access management means of the ECU according to the second invention designates the authentication device as the device, and the access request means of the fault diagnosis machine according to the second invention transmits authentication information obtained from a user to the authentication device and transmits the user certification information received from the authentication device to the ECU.

[0010] A third invention is the first invention, wherein the apparatus for acquiring the user authentication information is a security device that stores the user authentication information and is carried by the user. The access management means of the ECU of the third invention designates the security device as the device, and the access request means of the fault diagnosis machine of the third invention acquires the user authentication information from the security device and transmits the user authentication information acquired from the security device to the ECU.

[0011] A fourth invention is an ECU for electronically controlling a vehicle. The ECU according to the fourth invention includes an access management means for requesting a fault diagnosis machine connected to the ECU to transmit user certification information having a digital signature verifiable by using a public key stored in the ECU, and then verifying the validity of the user certification information received from the fault diagnosis machine by using the public key, and permitting the fault diagnosis machine to access the ECU only when the verification of the validity of the user certification information is successful.

[0012] A fifth aspect of the present invention is characterized in that in the fourth aspect of the present invention, the access management means of the ECU designates an authentication device having a function of authenticating user authentication information as the device. Also, a sixth aspect of the present invention is characterized in that in the fourth aspect of the present invention, the access management means of the ECU designates a security device that stores the user authentication information as the device.

[0013] The seventh invention is an access management method comprising the steps of: a step a) in which an ECU that performs electronic control of a vehicle requests a fault diagnosis machine connected to the ECU via a diagnostic port provided in the vehicle to transmit user certification information having an electronic signature attached thereto that can be verified using a public key stored in the ECU, by specifying a device for obtaining user certification information; a step b) in which the fault diagnosis machine obtains the user certification information from the device and transmits the user certification information obtained from the device to the ECU; and a step c) in which the ECU uses the public key to verify the validity of the user certification information received from the fault diagnosis machine, and allows the fault diagnosis machine to access the ECU only if the verification of the validity of the user certification information is successful.

[0014] An eighth aspect of the present invention is the access management method according to the seventh aspect of the present invention, wherein the device for acquiring user credentials is an authentication device having a function for verifying authentication information of a user. In an eighth aspect of the invention, the ECU designates an authentication device connected to the network as the device in step a. Also, in the eighth aspect of the invention, step b includes step d in which the fault diagnosis machine transmits authentication information acquired from a user to the authentication device, step e in which the authentication device authenticates the user's authentication information transmitted by the fault diagnosis machine and transmits the authentication result, to which an electronic signature generated by using a private key paired with the public key, as the user certification information, to the fault diagnosis machine, and step f in which the fault diagnosis machine transfers the user certification information received from the authentication device to the ECU.

[0015] A ninth aspect of the present invention is an access management method according to the seventh aspect of the present invention, in which the apparatus for acquiring user authentication information is a security device that stores the user authentication information and is carried by the user. In a ninth aspect of the invention, the ECU designates a security device carried by a user as the apparatus in step a. Also, in the ninth aspect of the invention, the step b includes a step g in which the fault diagnosis machine acquires the user certification information from the security device, and a step h in which the fault diagnosis machine acquires the user certification information from the security device and transmits the user certification information acquired from the security device to the ECU. Effect of the Invention

[0016] In the present invention described above, in order to verify the legitimacy of a user of the diagnostic device, the diagnostic device acquires user certification information to which a verifiable electronic signature is added using a public key stored in the ECU from a device specified by the ECU. Then, in order to verify the legitimacy of the user of the diagnostic device, the ECU verifies the legitimacy of the user certification information acquired by the diagnostic device and manages access to the ECU based on the verification result. [Brief description of the drawings]

[0017] [Figure 1] 1 is a diagram showing the configuration of an access management system according to a first embodiment. [Diagram 2]1 is a block diagram of an access control system according to a first embodiment. [Diagram 3] FIG. 2 is a diagram for explaining processing in the access management system according to the first embodiment. [Figure 4] FIG. 11 is a diagram showing the configuration of an access management system according to a second embodiment. [Diagram 5] FIG. 11 is a block diagram of an access control system according to a second embodiment. [Figure 6] FIG. 11 is a diagram for explaining processing in the access management system according to the second embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0018] Hereinafter, an embodiment of the present invention will be described. The embodiment described below is for the purpose of facilitating understanding of the present invention, and the present invention is not limited to this embodiment. Furthermore, unless otherwise specified, the drawings are schematic diagrams drawn for the purpose of facilitating understanding of the present invention.

[0019] Fig. 1 shows the configuration of an access management system 1 according to the first embodiment. Referring to Fig. 1, the access management system 1 according to the first embodiment includes a fault diagnosis machine 10 and an ECU (Electronic Control Unit) 11. Furthermore, the access management system 1 according to the first embodiment includes an authentication device 12 that authenticates authentication information of a user 5.

[0020] The ECU 11 is a microcomputer that electronically controls the vehicle 3. The ECU 11 performs electronic control of the engine and the like based on signals from sensors provided in the vehicle 3, and automatically records fault codes that indicate malfunctions of the vehicle 3. Note that while FIG. 1 shows the vehicle 3 provided with one ECU 11, in reality, the vehicle 3 is provided with a plurality of ECUs 11.

[0021] The fault diagnosis device 10 is a device also called a scan tool. The vehicle 3 is provided with a diagnostic port 30 for external connection to the ECU 11, and the fault diagnosis device 10 connects to the ECU 11 via the diagnostic port 30 provided in the vehicle 3 to access the ECU 11. In this application, the term "connection" means that the fault diagnosis device 10 and the ECU 11 are physically connected to each other and a communication path is established between the fault diagnosis device 10 and the ECU 11. In addition, the term "access" means that the fault diagnosis device 10 operates the ECU 11. The operation of the ECU 11 is, for example, reading out a fault code stored in the ECU 11.

[0022] Conventional ECU 11 does not have a function for verifying the legitimacy of user 5 of diagnostic device 10 accessing ECU 11, and it is not possible to prevent unauthorized access by a malicious third party. Therefore, in the present invention, it is made possible for ECU 11 to verify the legitimacy of user 5 of diagnostic device 10 accessing ECU 11.

[0023] In order to authenticate the user 5 who uses the fault diagnosis machine 10, the ECU 11 according to the present invention requests the fault diagnosis machine 10 connected to the ECU 11 to transmit the user authentication information, specifying a device from which the fault diagnosis machine 10 will acquire the user authentication information. The fault diagnosis machine 10 executes a process of acquiring the user authentication information from the device specified by the ECU 11, and transmits the user authentication information acquired from the device to the ECU 11. The ECU 11 verifies the validity of the user authentication information transmitted from the fault diagnosis machine 10, and permits the fault diagnosis machine 10 to access the ECU 11 only when the verification of the validity of the user authentication information is successful.

[0024] In the present application, the user certification information is information that can prove that the user 5 is a legitimate user. For example, the authentication result of the authentication information stored by the user 5 or information stored in a device possessed by the user 5 can be used as the user certification information. Also, in the present application, an electronic signature that can be verified using the public key 114 of the public key cryptosystem stored in the ECU 11 is added to the user certification information. The public key 114 stored in the ECU 11 is an encryption key that pairs with the private key of the public key cryptosystem used to generate the electronic signature added to the user certification information.

[0025] In the present application, the device designated by the ECU 11 is one that the ECU 11 can trust. As a result, the ECU 11 can verify the legitimacy of the user certification information acquired by the diagnostic device 10 from a device that the ECU 11 can trust, thereby enabling the ECU 11 to verify the legitimacy of the user 5 of the diagnostic device 10. In addition, by adding a digital signature to the user certification information, the ECU 11 can verify that the user certification information has not been tampered with.

[0026] In the first embodiment, the device instructed by the ECU 11 is the authentication device 12 having a function of authenticating the authentication information of the user 5, and the authentication result of the authentication information is used as the user certification information. When the authentication device 12 instructed by the ECU 11 succeeds in authenticating the authentication information of the user 5, it means that the user 5 of the fault diagnosis machine 10 is a legitimate user 5. Therefore, the ECU 11 can verify the legitimacy of the user certification information, thereby verifying the legitimacy of the user 5 who uses the fault diagnosis machine 10. Note that, of course, the device instructed by the ECU 11 does not have to be the authentication device 12 as long as the ECU 11 is trustworthy. In the second embodiment, another form is described in which the authentication device 12 is not used as the device for acquiring the user certification information.

[0027] From here, a detailed description will be given of the access management system 1 according to the first embodiment. Fig. 2 shows a block diagram of the access management system 1 according to the first embodiment.

[0028] First, the fault diagnosis device 10 will be described with reference to Fig. 2. As shown in Fig. 2, the fault diagnosis device 10 has, as communication functions, a vehicle communication means 104 and a network communication means 103. The vehicle communication means 104 is a circuit that communicates with the ECU 11 connected via a diagnosis port 30 provided in the vehicle 3 using a communication protocol compatible with the ECU 11. A dedicated cable is used to connect the vehicle communication means 104 and the diagnosis port 30. The communication protocol compatible with the ECU 11 is, for example, CAN (Controller Area Network).

[0029] The network communication means 103 included in the fault diagnosis device 10 is a circuit that communicates with a communication protocol compatible with the network 4. The network communication means 103 is preferably a circuit that communicates wirelessly. For example, it is a circuit compatible with mobile communication (4G, 5G, etc.), Wifi, etc.

[0030] 2, the fault diagnosis machine 10 includes an operation device 106 and a display 107. The display 107 is a device that displays text and / or graphical information. A liquid crystal display or an organic electroluminescence display is used for the display 107. The operation device 106 is a device that operates the fault diagnosis machine 10.

[0031] 2, the fault diagnosis device 10 includes a processor 100 and a memory 105. When a computer program for performing fault diagnosis is executed, the processor 100 functions as a fault diagnosis means 101 that analyzes a fault code read from the ECU 11 and identifies a trouble or fault of the vehicle 3 in which the ECU 11 is provided.

[0032] Furthermore, when a computer program for making an access request to the ECU 11 is executed, the processor 100 of the fault diagnosis machine 10 functions as an access request means 102 that executes processing related to the access request to the ECU 11. The access request means 102 of the fault diagnosis machine 10 is a means that executes a process of acquiring user authentication information from a device designated by the ECU 11 connected to the fault diagnosis machine 10, and a process of transmitting the user authentication information acquired from this device to the ECU 11. In the first embodiment, since the device designated by the ECU 11 is the authentication device 12, the access request means 102 of the fault diagnosis machine 10 acquires a user ID used to identify the user 5 and authentication information (e.g., a password) of the user 5 from the user 5, and transmits this information to the authentication device 12.

[0033] The memory 105 is used to store the fault codes read from the ECU 11. The memory 105 may be implemented in the fault diagnosis device 10, but an external memory (for example, an SD card) may also be used.

[0034] Next, the ECU 11 will be described. As shown in Fig. 2, the ECU 11 has an in-vehicle communication means 112 as a communication function. The in-vehicle communication means 112 is a circuit that communicates using a communication protocol (e.g., CAN) used in in-vehicle communication. The communication partner of the ECU 11 is the fault diagnosis device 10, another ECU 11, etc.

[0035] 2, the ECU 11 includes a processor 110 and a memory 113. When a computer program for managing access from the fault diagnosis device 10 is executed, the processor 110 verifies the legitimacy of the user 5 of the fault diagnosis device 10 and functions as an access management means 111 that manages access from the fault diagnosis device 10 based on the verification result. The access management means 111 of the ECU 11 is a means for executing a process of requesting the fault diagnosis device 10 connected to the ECU 11 to transmit user certification information to which a verifiable electronic signature is added using a public key 114 stored in the ECU 11 by specifying a device that acquires user certification information, a process of verifying the legitimacy of the user certification information transmitted by the fault diagnosis device 10 using the public key 114, and a process of permitting the fault diagnosis device 10 to access the ECU 11 only when the verification of the legitimacy of the user certification information is successful.

[0036] The memory 113 of the ECU 11 stores a public key 114 used to verify the electronic signature added to the user authentication information. The memory 113 of the ECU 11 is also used to store a fault code.

[0037] Next, the authentication device 12 will be described. The authentication device 12 is a device realized by using a general-purpose server. As shown in Fig. 2, the authentication device 12 is connected to the network 4, and the authentication device 12 has a network communication means 123 as a communication function. The network communication means 123 provided in the authentication device 12 is a circuit that communicates using a communication protocol compatible with the network 4. In the case of the authentication device 12, the network communication means 123 is a circuit that communicates via wire.

[0038] 2, the authentication device 12 further includes a processor 120 and a DB 122 (DataBase). When a computer program for authenticating the authentication information of the user 5 is executed, the processor 120 functions as authentication means 121 that authenticates the authentication information of the user 5 transmitted from the fault diagnosis device 10. The DB 122 stores a user ID and authentication information for each user 5 of the fault diagnosis device 10. The authentication means 121 of the authentication device 12 is means for executing a process of requesting the fault diagnosis device 10 to transmit the authentication information of the user 5, a process of authenticating the authentication information of the user 5 transmitted by the fault diagnosis device 10, a process of generating, as user certification information, the authentication result of the authentication information to which an electronic signature generated by using a private key paired with the public key 114 is added, and a process of transmitting the user certification information to the fault diagnosis device 10.

[0039] From here, the processing in the access management system 1 according to the first embodiment will be explained. Fig. 3 shows the processing in the access management system 1 according to the first embodiment. The explanation of Fig. 3 also includes an explanation of the access management method according to the present invention.

[0040] When the fault diagnosis machine 10 connects to the ECU 11 via the diagnostic port 30 provided in the vehicle 3, the access request means 102 of the fault diagnosis machine 10 makes an access request to the ECU 11 (step S1). When the ECU 11 receives the access request from the fault diagnosis machine 10, the access management means 111 of the ECU 11 is started, and the access management means 111 of the ECU 11 designates the authentication device 12 as a device that will acquire the user certification information, and requests the fault diagnosis machine 10 to transmit the user certification information (step S2). In this case, the address of the authentication device 12 (e.g., URL (Uniform Resource Locator)) is used to designate the device that will acquire the user certification information.

[0041] The access request means 102 of the fault diagnosis machine 10 accesses the authentication device 12 instructed by the ECU 11 (step S3). The authentication means 121 of the authentication device 12 requests the fault diagnosis machine 10 that has accessed the authentication device 12 to transmit the user ID of the user 5 and the authentication information of the user 5 (step S4). When the transmission of the authentication information of the user 5 is requested, the access request means 102 of the fault diagnosis machine 10 acquires the user ID and the authentication information from the user 5 of the fault diagnosis machine 10 (step S5). The access request means 102 of the fault diagnosis machine 10 displays input screens for the user ID and the authentication information on the display 107, and acquires the user ID and the authentication information input by the user 5 using the operation device 106.

[0042] When the user ID and authentication information are acquired from the user 5, the access request means 102 of the fault diagnostic machine 10 transmits the user ID and authentication information to the authentication device 12 (step S6). The authentication means 121 of the authentication device 12 authenticates the authentication information received from the fault diagnostic machine 10 (step S7). At this time, the authentication means 121 of the authentication device 12 acquires, from the DB 122, authentication information associated with the user ID received from the fault diagnostic machine 10, and uses this authentication information to authenticate the authentication information received from the fault diagnostic machine 10. For example, the authentication means 121 of the authentication device 12 confirms whether the authentication information acquired from the DB 122 is the same as the authentication information received from the fault diagnostic machine 10.

[0043] When authenticating the authentication information received from the fault diagnosis machine 10, the authentication means 121 of the authentication device 12 transmits the authentication result of the authentication information received from the fault diagnosis machine 10 as user certification information to the fault diagnosis machine 10 that accessed the authentication device 12 (step S8). The authentication means 121 of the authentication device 12 according to the first embodiment adds an electronic signature generated using a private key paired with the public key 114 stored in the ECU 11 to the authentication result of the authentication information. From the viewpoint of security, it is desirable that the electronic signature added to the authentication result of the authentication information be different each time the authentication information is performed. For example, if a random value is included in the authentication result of the authentication information, a different electronic signature can be generated each time the authentication information is performed.

[0044] When the access request means 102 of the fault diagnosis machine 10 receives the user certification information (here, the authentication result of the authentication information), it transfers the user certification information (here, the authentication result of the authentication information) received from the authentication device 12 to the ECU 11 (step S9). The access management means 111 of the ECU 11 verifies the electronic signature added to the user certification information (here, the authentication result of the authentication information) (step S10), and if the verification of the electronic signature is successful, it verifies the user certification information (here, the authentication result of the authentication information) (step S11). The public key 114 stored in the ECU 11 is used to verify the electronic signature added to the user certification information. In addition, in verifying the user certification information, the access management means 111 of the ECU 11 verifies whether or not the user certification information indicates that the authentication of the authentication information has been successful. If the verification of the electronic signature has failed, or if the authentication of the authentication information has failed, the access management means 111 of the ECU 11 does not permit access from the fault diagnosis machine 10 and ends the procedure of FIG. 3. If the verification of the electronic signature is successful and the authentication of the authentication information is successful, the access management means 111 of the ECU 11 permits access from the fault diagnosis device 10 (step S12), and the procedure of FIG. 3 ends.

[0045] [Second embodiment] Fig. 4 shows the configuration of an access management system 2 according to the second embodiment. Referring to Fig. 4, the access management system 2 according to the second embodiment includes a fault diagnosis machine 20 and an ECU 21. Furthermore, the access management system 2 according to the second embodiment includes a security device 22 that stores user authentication information and is carried by a user 5. In the second embodiment, the same elements as in the first embodiment are denoted by the same reference numerals, and differences from the first embodiment will be described.

[0046] As in the first embodiment, the access management system 2 according to the second embodiment is configured so that the legitimacy of a user 5 of a fault diagnosis machine 20 accessing an ECU 21 can be verified on the ECU 21 side. In the first embodiment, the device designated by the ECU 11 was the authentication device 12 connected to the network 4, but in the second embodiment, the device designated by the ECU 21 is the security device 22 possessed by the user 5.

[0047] From here, the access management system 2 according to the second embodiment will be described in detail. Fig. 5 shows a block diagram of the access management system 2 according to the second embodiment.

[0048] First, the fault diagnosis machine 20 will be described with reference to Fig. 5. As shown in Fig. 5, the fault diagnosis machine 20 includes a vehicle communication means 104 as a communication function. Also, as shown in Fig. 5, the fault diagnosis machine 20 includes an operation device 106 and a display 107. These are the same as those in the first embodiment.

[0049] 5, the fault diagnosis machine 20 includes a reader / writer 203 as a function for communicating with the security device 22 carried by the user 5. The reader / writer 203 includes a function for communicating with the security device 22 carried by the user 5 using a communication protocol supported by the security device 22.

[0050] 5, the fault diagnosis device 20 includes a processor 100 and a memory 105. When a computer program for performing fault diagnosis is executed, the processor 100 functions as a fault diagnosis means 101, similarly to the first embodiment. The memory 105 is the same as in the first embodiment.

[0051] Furthermore, when a computer program for making an access request to the ECU 21 is executed, the processor 100 of the fault diagnosis device 20 functions as an access request means 202 for making an access request to the ECU 21. The operation of the access request means 202 provided in the fault diagnosis device 20 according to the second embodiment is different from that of the first embodiment. The access request means 202 of the fault diagnosis device 20 according to the second embodiment is a means for executing a process of acquiring user certification information 221 from the security device 22 and a process of transmitting the user certification information 221 acquired from the security device 22 to the ECU 21.

[0052] Next, a description will be given of the ECU 21. As shown in Fig. 5, the ECU 21 includes, as a communication function, an in-vehicle communication means 112. This has been described in the first embodiment.

[0053] As shown in FIG. 5, the ECU 21 includes a processor 110 and a memory 113 storing a public key 114. When the processor 110 executes a computer program for verifying the legitimacy of the user 5, the processor 110 verifies the legitimacy of the user 5 of the fault diagnosis device 20 and functions as an access management means 211 that manages access from the fault diagnosis device 20 based on the verification result. The operation of the access management means 211 according to the second embodiment is different from that of the first embodiment. When requesting transmission of the user certification information 221, the access management means 211 according to the second embodiment specifies the security device 22 possessed by the user 5 as a device for acquiring the user certification information 221. In addition, the access management means 211 according to the second embodiment verifies the electronic signature added to the user certification information 221 to verify the legitimacy of the user. In the second embodiment, the ECU 21 verifies the legitimacy of the user 5 by checking whether the user 5 possesses the security device 22 that stores the user certification information 221 that the ECU 21 can trust.

[0054] Next, a description will be given of the security device 22. The security device 22 possessed by the user 5 is a tamper-resistant device against unauthorized access and alteration. For example, an IC card can be used as the security device 22.

[0055] 5, the security device 22 includes an external interface 222 as a function for communicating with an external device. The external interface 222 included in the security device 22 is a circuit that communicates in accordance with a communication protocol compatible with the security device 22. When a contactless IC card is used as the security device 22, the external interface 222 included in the security device 22 is, for example, a circuit that communicates in accordance with a communication protocol compatible with NFC (Near Field Communication).

[0056] 5, the security device 22 further includes a processor 220 and a memory 223. The memory 223 stores user certification information 221 that can verify the identity of the user 5. In the case of the second embodiment, for example, an electronic certificate issued by a certification authority that is a trusted third party can be used for the user certification information 221. The electronic certificate includes an issuer of the electronic certificate, identification information of the user 5, and an electronic signature generated using a private key of the certification authority with at least a user public key as a seed. When an electronic certificate is used for the user certification information 221, the public key 114 stored in the ECU 21 becomes the key of the certification authority that issued the electronic certificate. The processor 220 has a function of transmitting the user certification information 221 read from the memory 223 when a computer program that reads out the user certification information 221 is executed.

[0057] From here, the processing in the access management system 2 according to the second embodiment will be explained. Fig. 6 shows the processing in the access management system 2 according to the second embodiment. The explanation of Fig. 6 also includes an explanation of the access management method according to the present invention.

[0058] When the fault diagnosis device 20 is connected to the ECU 21 via the diagnostic port 30 provided in the vehicle 3, the access request means 202 of the fault diagnosis device 20 is activated, and the access request means 202 of the fault diagnosis device 20 issues an access request to the ECU 21 (step S20). When the access request is received from the fault diagnosis device 20, the access management means 211 of the ECU 21 is activated, and the access management means 211 of the ECU 21 designates the security device 22 as a device that acquires the user certification information 221, and requests the fault diagnosis device 20 to transmit the user certification information 221 (step S21). In this case, information indicating the type of the security device 22 is used to designate the device that acquires the user certification information 221. For example, the information is information indicating the name (e.g., issuer name) or the general name (e.g., Smart Card) of the security device 22.

[0059] The access request means 202 of the fault diagnosis machine 20 displays on the display 107 an instruction to enable the security device 22 to communicate with the reader / writer 203, and when the reader / writer 203 detects the security device 22, it uses the reader / writer 203 to transmit a command message to the security device 22 to read out the user authentication information 221 (step S22). If the security device 22 is a contactless IC card, the instruction to enable the security device 22 to communicate with the reader / writer is an instruction to hold the contactless IC card over the reader / writer.

[0060] When the security device 22 receives a command message to read the user certification information 221 from the fault diagnosis machine 20, the security device 22 reads the user certification information 221 from the memory 223 and transmits it to the fault diagnosis machine 20 (step S23). The access request means 202 of the fault diagnosis machine 20 transfers the user certification information 221 received from the security device 22 to the ECU 21 (step S24). The access management means 211 of the ECU 21 verifies the user certification information 221 received from the fault diagnosis machine 20 (step S25). Specifically, the access management means 211 of the ECU 21 verifies the electronic signature added to the user certification information 221. The public key 114 stored in the ECU 21 is used to verify the electronic signature added to the user certification information 221. When the access management means 211 of the ECU 21 fails to verify the user certification information 221 received from the fault diagnosis machine 20, the access management means 211 of the ECU 21 does not permit access from the fault diagnosis machine 20 and ends the procedure of FIG. 6. When the access management means 211 of the ECU 21 successfully verifies the user certification information 221 received from the fault diagnosis device 20, it permits access from the fault diagnosis device 20 (step S26) and ends the procedure of Fig. 6. In the second embodiment, successful verification of the user certification information 221 means that the user 5 possesses the security device 22 specified by the ECU 21. That is, in the second embodiment, the legitimacy of the user 5 is verified depending on whether or not the user 5 possesses the security device 22 specified by the ECU 21. [Explanation of symbols]

[0061] 1, 2 Access control system 10,20 Diagnostic tool 101 Fault diagnosis means 102, 202 Access request means 11,21 ECU 111, 211 Access control measures 12 Authentication Device 121 Authentication Methods 22 Security Devices 3. Vehicle 30 Diagnostic Port

Claims

1. The vehicle includes an ECU that performs electronic control of the vehicle, and a fault diagnosis device that is connected to the ECU via a diagnostic port provided in the vehicle, said ECU comprises an access management means for requesting said fault diagnosis machine connected to said ECU to transmit said user certification information by designating a device for acquiring user certification information to which an electronic signature verifiable by use of a public key stored in said ECU is added, and then verifying the validity of said user certification information received from said fault diagnosis machine by use of said public key, and permitting said fault diagnosis machine to access said ECU only when verification of the validity of said user certification information is successful; the fault diagnosis machine includes an access request means for acquiring the user authentication information from the device and transmitting the user authentication information acquired from the device to the ECU; 1. An access control system comprising:

2. An authentication device having a function of authenticating authentication information of a user, the authentication device comprises authentication means for authenticating user authentication information transmitted by a fault diagnosis device, and transmitting to the fault diagnosis device, as the user certification information, a result of the authentication of the authentication information to which a digital signature generated by using a private key paired with the public key has been added; The access management means of the ECU designates the authentication device as the device, The access request means of the fault diagnosis machine transmits authentication information acquired from a user to the authentication device, and transmits the user authentication information received from the authentication device to the ECU.

2. The access control system according to claim 1.

3. a security device that stores the user credentials; The access management means of the ECU assigns the security device to the device; the access request means of the fault diagnosis machine acquires the user authentication information from the security device, and transmits the user authentication information acquired from the security device to the ECU; 2. The access control system according to claim 1.

4. An ECU that performs electronic control of a vehicle, said ECU is provided with an access management means for requesting a fault diagnosis machine connected to said ECU to transmit said user certification information by designating a device for acquiring user certification information to which an electronic signature verifiable by use of a public key stored in said ECU is added, and then verifying the validity of said user certification information received from said fault diagnosis machine by use of said public key, and permitting said fault diagnosis machine to access said ECU only when verification of the validity of said user certification information is successful. The ECU is characterized by:

5. The access management means of the ECU designates an authentication device having a function of authenticating user authentication information as the device.

5. The ECU according to claim 4 .

6. The access management means of the ECU designates a security device that stores the user authentication information to the device.

5. The ECU according to claim 4 .

7. a step a) of requesting a fault diagnosis device connected to the ECU via a diagnostic port provided in the vehicle to transmit the user certification information to which a digital signature verifiable by a public key stored in the ECU has been added, by specifying a device for acquiring user certification information; a step b in which the fault diagnosis device acquires the user authentication information from the device and transmits the user authentication information acquired from the device to the ECU; a step c of the ECU verifying the authenticity of the user authentication information received from the diagnostic device by using the public key, and allowing the diagnostic device to access the ECU only when the verification of the authenticity of the user authentication information is successful; The access management method according to the present invention comprises the steps of:

8. In step (a), the ECU designates an authentication device connected to the network as the device; The step b includes: a step d in which the fault diagnosis machine transmits authentication information acquired from the user to the authentication device; a step e in which the authentication device authenticates the authentication information of the user transmitted by the fault diagnosis device, and transmits the authentication result of the authentication information, to which an electronic signature generated by using a private key paired with the public key is added, as the user certification information to the fault diagnosis device; a step f of the fault diagnosis machine transmitting the user authentication information received from the authentication device to the ECU; Including, 8. The access management method according to claim 7, wherein the access management method comprises:

9. In step (a), the ECU stores the user authentication information and designates a security device possessed by the user to the apparatus; The step b includes: a step g of the fault diagnosis machine acquiring the user authentication information from the security device; a step h in which the fault diagnosis machine acquires the user authentication information from the security device and transmits the user authentication information acquired from the security device to the ECU; Including, 8. The access management method according to claim 7, wherein the access management method comprises:

Images