Verification device and verification method

Abstract

To provide a verification device and a verification method capable of improving security of an apparatus equipped with an application.SOLUTION: A verification device comprises a generation unit and a verification unit. The generation unit generates verification information on the basis of unique information unique to an apparatus which performs processing about an application. The verification unit executes verification processing which verifies the normality of the application on the basis of the verification information generated by the generation unit.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a verification device and a verification method. [Background technology]

[0002] Conventionally, devices mounted on vehicles, for example, are equipped with various applications such as navigation software. In such devices, there is a risk that the applications may be tampered with illegally, so a technique for detecting the presence or absence of an application that has been tampered with illegally in the device has been proposed (for example, see Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2018-073245 A Summary of the Invention [Problem to be solved by the invention]

[0004] However, the conventional technology has room for further improvement in terms of improving the security of devices equipped with applications.

[0005] The present invention has been made in view of the above, and has an object to provide a verification device and a verification method that can improve the security of a device equipped with an application. [Means for solving the problem]

[0006] In order to solve the above problems and achieve the object, the present invention Related to Verification Equipment The present invention includes a computer, the computer being configured to: Generate validation information The computer stores the verification information in the storage unit as verification information for comparison when a second application is installed after the first application is installed. When a verification timing arrives, the computer compares the verification information stored in the storage unit at the time of the verification timing with the verification information for comparison, thereby Verify the authenticity of the application do. Effect of the Invention

[0007] According to the present invention, it is possible to improve the security of a device equipped with an application. [Brief description of the drawings]

[0008] [Figure 1] FIG. 1 is a diagram showing an overview of a verification method according to an embodiment. [Diagram 2] FIG. 2 is a block diagram showing an example of the configuration of an in-vehicle system including a verification device according to the embodiment. [Diagram 3] FIG. 3 is a diagram illustrating an example of the first verification information. [Figure 4] FIG. 4 is a diagram illustrating an example of the second verification information. [Diagram 5] FIG. 5 is a diagram illustrating an example of the third verification information. [Figure 6] FIG. 6 is a flowchart illustrating a processing procedure executed by the verification device. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Hereinafter, embodiments of a verification device and a verification method disclosed in the present application will be described in detail with reference to the accompanying drawings. Note that the present invention is not limited to the embodiments described below.

[0010] <Outline of verification method> First, an overview of a verification method performed by a verification device according to an embodiment will be described below with reference to Fig. 1. Fig. 1 is a diagram showing an overview of the verification method according to an embodiment.

[0011] As shown in FIG. 1, the verification device 100 is composed of, for example, verification processing function units provided in an in-vehicle device 20 and a communication device 50, and performs verification processing, such as verifying the authenticity of an application of the in-vehicle device 20, using the functions of each of these devices 20, 50.

[0012] The in-vehicle device 20 and the communication device 50 are mounted on a vehicle (not shown). The in-vehicle device 20 includes applications and the like. Specifically, applications (hereinafter sometimes referred to as "apps") are installed on the in-vehicle device 20, and the in-vehicle device 20 can perform processes related to the apps. The apps are any apps, such as various apps for navigation, vehicle control, music playback, and the like.

[0013] FIG. 1 shows an example in which there are two apps. In the following, one of the two apps may be referred to as a "first app" and the other as a "second app", and when there is no need to distinguish between them, they will be referred to as "apps". In the example of FIG. 1, it is assumed that the first app is installed in the in-vehicle device 20 first, and then the second app is installed.

[0014] The in-vehicle device 20 is an example of a device. The device is not limited to the in-vehicle device 20, and may be any other type of device, such as a PC (Personal Computer), a smartphone, or a tablet terminal, as long as it has an application.

[0015] The communication device 50 is a device that can perform processes related to apps, such as processes related to app communication, such as downloading apps, and processes related to apps, such as processes for managing apps in the in-vehicle device 20. For example, management software for managing apps is installed in the communication device 50. The communication device 50 is also connected to the in-vehicle device 20 so as to be able to communicate with the in-vehicle device 20. The communication device 50 is an example of a device.

[0016] Incidentally, in recent years, when an application is additionally installed in the in-vehicle device 20 or when an application for updating (reprogramming) is installed in the in-vehicle device 20, data may be transmitted and received (downloaded, etc.) via wireless communication such as OTA (Over The Air). Note that an application for updating is installed, for example, when a function is added to an existing application or when a defect is discovered after the fact.

[0017] While this makes it easy to add and update apps, it also raises the risk that, for example, malware using wireless communication may erroneously add unauthorized apps or unauthorizedly tamper with existing apps. It is also possible that a malicious user may unauthorizedly tamper with an app, for example by adding inappropriate functions or removing restrictions. For this reason, it has been desired to improve the security of the in-vehicle device 20 equipped with apps.

[0018] Therefore, in the verification device 100 according to the present embodiment, the accuracy of the verification process for verifying the authenticity of the application is improved, thereby improving the security of the in-vehicle device 20. Specifically, the verification device 100 generates verification information based on unique information unique to the communication device 50 (or the in-vehicle device 20), and uses the verification information to accurately verify the authenticity of the application, thereby improving the security of the in-vehicle device 20.

[0019] More specifically, the verification device 100 uses predetermined verification information 10, first verification information 11, and second verification information 12 as verification information used in a verification process for verifying the authenticity of an application.

[0020] In the following description, for each piece of verification information 10, 11, and 12, information stored in the storage unit related to the first application of the in-vehicle device 20 may be designated with the suffix "a1", information stored in the storage unit related to the second application may be designated with the suffix "a2", and information stored in the storage unit of the communication device 50 may be designated with the suffix "b". When there is no need to distinguish between these pieces of verification information, they will be referred to as "predetermined verification information 10", "first verification information 11", and "second verification information 12".

[0021] The predetermined verification information 10 is verification information related to the communication device 50. The predetermined verification information 10b is information that the communication device 50 has in advance. The predetermined verification information 10a1 is information related to the first application of the in-vehicle device 20 that is stored in a storage unit by an information generation process described later.

[0022] The first verification information 11 is verification information related to the first application. The first verification information 11a1 and 11b are information generated when the first application is installed. The first verification information 11a2 is information related to the second application that is stored in a storage unit of the in-vehicle device 20 when the second application is installed.

[0023] The second verification information 12 is verification information related to the second application. The second verification information 12a2 and 12b is information generated when the second application is installed.

[0024] [Regarding the second verification information] For ease of understanding, the following will be described in detail in the order of the second verification information 12, the first verification information 11, and the predetermined verification information 10. The second verification information 12 includes, for example, an application hash value 12x and a device hash value 12y.

[0025] The application hash value 12x is a hash value obtained by multiplying application-specific information that is specific to an application (here, the second application) by a predetermined hash function. The application-specific information may be, for example, a binary code or source code of the application, but is not limited thereto, and may be any other type of information that is specific to the application and from which a hash value can be calculated. Note that, regarding the above-mentioned predetermined hash function, it is assumed that the in-vehicle device 20 and the communication device 50 have the same predetermined hash function in advance, in other words, it is assumed that they share the predetermined hash function.

[0026] The device hash value 12y is an example of verification information generated based on unique information unique to the above-mentioned communication device 50 (or the in-vehicle device 20). For example, such unique information includes information related to the installation process of the application (here, the second application). Specifically, the unique information includes date and time information indicating the date and time when the corresponding application (here, the second application) was installed.

[0027] That is, for example, if there are multiple vehicles, each of the multiple vehicles is equipped with a communication device 50 and an in-vehicle device 20. Then, the app is downloaded by the communication device 50 of the vehicle and installed in the in-vehicle device 20, but the timing at which the app is installed differs for each vehicle, in other words, for each communication device 50. Therefore, the date and time information indicating the date and time of installation is unique information that is unique to the communication device 50 (or the in-vehicle device 20).

[0028] The device hash value 12y is a hash value obtained by multiplying the date and time information, which is unique information, by a predetermined hash function.

[0029] In the above, the unique information is the installation date and time information, but the present invention is not limited to this. That is, the above-mentioned installation date and time may be the date and time when the installation is started or the date and time when the installation is completed. In addition, the unique information may be other types of information, such as information indicating the location when the installation process is performed (specifically, the vehicle's location information (e.g., latitude and longitude)).

[0030] The second verification information 12 described above is stored in a storage unit related to the second application of the in-vehicle device 20 and in a storage unit of the communication device 50, respectively.

[0031] [Regarding the first verification information] In addition to the second verification information 12a2, verification information (first verification information 11a2) related to an application installed before the second application is stored in the storage unit related to the second application of the in-vehicle device 20. The verification information related to the application installed before the second application is specifically the verification information related to the application (here, the first application) installed immediately before the second application, i.e., the first verification information 11a2.

[0032] The first verification information 11a2 is also an example of verification information generated based on unique information unique to the communication device 50 (or the in-vehicle device 20). In detail, the first verification information 11a2 is verification information related to an application (here, the first application) installed before the second application, as described above.

[0033] Here, for example, if there are multiple vehicles, each of the multiple vehicles is equipped with a communication device 50 and an in-vehicle device 20. Also, various applications are downloaded and installed in each of the multiple in-vehicle devices 20 by the communication device 50, but the order in which the applications are installed differs for each vehicle, in other words, for each communication device 50. Therefore, the above-mentioned first verification information 11a2 is verification information obtained based on the installation order of the applications (here, the installation order of the first application and the second application), which is unique information unique to the communication device 50 (or the in-vehicle device 20).

[0034] The first verification information 11 is stored in the storage unit related to the second application of the in-vehicle device 20, the storage unit related to the first application of the in-vehicle device 20, and the storage unit of the communication device 50, respectively.

[0035] Next, a description will be given of the contents of the first verification information 11. The first verification information 11 includes, for example, an application hash value 11x and a device hash value 11y.

[0036] The application hash value 11x is a hash value obtained by multiplying application-specific information (eg, the binary code of the first application) that is specific to the application (here, the first application) by a predetermined hash function.

[0037] The device hash value 11y is a hash value obtained by multiplying date and time information indicating the date and time when a corresponding application (here, the first application) was installed in the in-vehicle device 20 by a predetermined hash function. Like the device hash value 12y, the device hash value 11y is also an example of verification information generated based on unique information unique to the communication device 50.

[0038] [Regarding prescribed verification information] In addition to the first verification information 11a1, the storage unit for the first application of the in-vehicle device 20 stores predetermined verification information 10a1. Here, the first application is the application that is first installed in the in-vehicle device 20. In other words, there is no application installed before the first application. Therefore, there is no verification information for an application installed before an application (here, the first application) such as the first verification information 11a2 stored in the storage unit for the second application.

[0039] Therefore, in this embodiment, "predetermined verification information 10b", which is verification information that the communication device 50 has in advance, is stored as "predetermined verification information 10a1" in a storage unit related to the first application of the in-vehicle device 20. The contents of the predetermined verification information 10 can be set arbitrarily as long as it is verification information obtained from unique information (such as a serial number) unique to the communication device 50. As an example, the predetermined verification information 10 may be a hash value obtained by multiplying unique information (such as a serial number) unique to the communication device 50 by a predetermined hash function.

[0040] In this manner, in this embodiment, verification information is generated based on information unique to the communication device 50 and the in-vehicle device 20, such as the date and time information of the installation of the application and the order in which the application was installed, and the authenticity of the application is verified based on such verification information. This makes it possible to accurately detect, for example, an application that has been illegally tampered with, as will be described later.

[0041] [Generation of verification information] Next, the timing at which the above-mentioned predetermined verification information 10, first verification information 11, and second verification information 12 are generated will be described.

[0042] In an initial state of the in-vehicle device 20 and the communication device 50, specifically, before the first application and the second application are installed in the in-vehicle device 20, the communication device 50 only has the predetermined verification information 10b. That is, the first verification information 11 and the second verification information 12 have not yet been generated. The predetermined verification information 10b is stored in a storage unit (a management storage unit 71 (see FIG. 2) described later) of the communication device 50.

[0043] First, the installation of the first application will be described. Specifically, when a request to install the first application is made, the communication device 50 (management software) downloads the first application from an external server (not shown). Then, when the communication device 50 verifies that the downloaded first application is authentic, the application is installed in the in-vehicle device 20.

[0044] In more detail, the first application to be downloaded has an application hash value in advance, and communication device 50 acquires this application hash value. Communication device 50 also acquires application unique information of the first application (e.g., the binary code of the first application) from the downloaded first application, and multiplies the application unique information by a predetermined hash function to calculate application hash value 11x.

[0045] The communication device 50 verifies the authenticity of the first application by comparing and matching the application hash value acquired from the first application with the application hash value 11x calculated from the application unique information. For example, the communication device 50 compares the acquired application hash value with the calculated application hash value 11x, and if they match, determines that the first application is an authentic application and installs the first application into the in-vehicle device 20.

[0046] On the other hand, if the acquired application hash value does not match the calculated application hash value 11x, the communications device 50 determines that the first application is not a legitimate application, and does not install the first application in the in-vehicle device 20.

[0047] When the installation of the first application is completed, the communication device 50 generates first verification information 11b. For example, the communication device 50 multiplies the date and time information of the installation of the first application by a predetermined hash function to calculate a device hash value 11y. Then, the communication device 50 generates first verification information 11b including the calculated application hash value 11x and device hash value 11y, and stores the first verification information 11b in a storage unit of the communication device 50. Note that the application hash value 11x included in the first verification information 11b may be calculated by the communication device 50, or may be an application hash value that the first application has in advance.

[0048] Therefore, after the first application is installed, the communication device 50 has the predetermined verification information 10b and the first verification information 11b.

[0049] Furthermore, when the installation of the first application is completed, the communication device 50 outputs to the in-vehicle device 20 date and time information of the installation of the first application and the predetermined verification information 10 (10b) that the communication device 50 has.

[0050] Then, the in-vehicle device 20 generates the first verification information 11a1 based on the information input from the communication device 50. For example, the in-vehicle device 20 calculates the application hash value 11x by multiplying the application unique information of the first application by a predetermined hash function. Note that the in-vehicle device 20 may use an application hash value that the first application has in advance, without calculating the application hash value 11x.

[0051] The in-vehicle device 20 also multiplies the installation date and time information of the first application by a predetermined hash function to calculate a device hash value 11y. The in-vehicle device 20 then generates first verification information 11a1 including the application hash value 11x and the device hash value 11y, and stores it in a storage unit related to the first application (a first application storage unit 41 (see FIG. 2) described later). The in-vehicle device 20 also stores predetermined verification information 10 (10a1) input from the communication device 50 in the storage unit separately from the first verification information 11a1.

[0052] Therefore, after the first application is installed, the in-vehicle device 20 has the predetermined verification information 10a1 and the first verification information 11a1 for the first application. The in-vehicle device 20 updates the predetermined verification information 10a1 and the first verification information 11a1 stored in the storage unit periodically or irregularly in order to detect, for example, unauthorized tampering with the first application after installation. An example of such irregular updating is updating immediately before a verification process described later, but is not limited to this, and the timing of updating can be set arbitrarily.

[0053] Next, the installation of the second application will be described. Specifically, when a request to install the second application is made, the communication device 50 (management software) downloads the second application from an external server (not shown). Then, when the communication device 50 verifies that the downloaded second application is authentic, the second application is installed in the in-vehicle device 20.

[0054] In more detail, the second application to be downloaded has an application hash value in advance, and communication device 50 acquires this application hash value. Communication device 50 also acquires application unique information of the second application (e.g., binary code of the second application) from the downloaded second application, and multiplies the application unique information by a predetermined hash function to calculate application hash value 12x.

[0055] The communication device 50 verifies the authenticity of the second application by comparing the application hash value acquired from the second application with the application hash value 12x calculated from the application unique information. For example, when the communication device 50 compares the acquired application hash value with the calculated application hash value 12x and finds that they match, it determines that the second application is an authentic application and installs the second application into the in-vehicle device 20.

[0056] On the other hand, if the acquired application hash value does not match the calculated application hash value 12x, the communication device 50 determines that the second application is not a legitimate application, and does not install the second application in the in-vehicle device 20.

[0057] When the installation of the second application is completed, the communication device 50 generates second verification information 12b. For example, the communication device 50 multiplies the date and time information of the installation of the second application by a predetermined hash function to calculate a device hash value 12y. Then, the communication device 50 generates second verification information 12b including the calculated application hash value 12x and device hash value 12y, and stores the second verification information 12b in a storage unit of the communication device 50. Note that the application hash value 12x included in the second verification information 12b may be calculated by the communication device 50, or may be an application hash value that the second application has in advance.

[0058] Therefore, after the second application is installed, the communication device 50 has the predetermined verification information 10b, the first verification information 11b, and the second verification information 12b.

[0059] In addition, when the installation of the second application is completed, the communication device 50 outputs to the in-vehicle device 20 the date and time information of the installation of the second application and verification information regarding the first application that was installed immediately before the second application that the communication device 50 owns, i.e., the first verification information 11 (11b).

[0060] Then, the in-vehicle device 20 generates the second verification information 12a2 based on the information input from the communication device 50. For example, the in-vehicle device 20 calculates the application hash value 12x by multiplying the application unique information of the second application by a predetermined hash function. Note that the in-vehicle device 20 may use an application hash value that the second application has in advance, without calculating the application hash value 12x.

[0061] The in-vehicle device 20 also multiplies the installation date and time information of the second application by a predetermined hash function to calculate a device hash value 12y. The in-vehicle device 20 then generates second verification information 12a2 including the application hash value 12x and the device hash value 12y, and stores the second verification information 12a2 in a storage unit related to the second application (a second application storage unit 42 (see FIG. 2) described later). The in-vehicle device 20 also stores the first verification information 11 (11a2) input from the communication device 50 in the storage unit separately from the second verification information 12a2.

[0062] Therefore, after the second application is installed, the in-vehicle device 20 has the predetermined verification information 10a1 and the first verification information 11a1 for the first application, and has the first verification information 11a2 and the second verification information 12a2 for the second application. The in-vehicle device 20 updates the first verification information 11a2 and the second verification information 12a2 stored in the storage unit periodically or irregularly in order to detect, for example, unauthorized tampering with the second application after installation. An example of such irregular updating is updating immediately before a verification process, but is not limited to this, and the timing of the update can be set arbitrarily.

[0063] [About verification process] Next, a description will be given of the verification process executed by the verification device 100. The verification process is a process for verifying the authenticity of an application. For example, the verification process is a process for verifying the authenticity of an installed application, and specifically, a process for checking whether the application (here, the first and second applications) has been illegally tampered with.

[0064] Specifically, when an installed application is tampered with, the contents of the verification information (e.g., first verification information 11a1, 11a2, second verification information 12a2, and predetermined verification information 10a1) stored in the storage unit of the application and the application-specific information of the application are changed (rewritten) from those at the time of installation or download. In the verification process according to this embodiment, the authenticity of the application is verified based on the presence or absence of changes in the verification information and the application-specific information.

[0065] Here, an example of tampering with an application will be described. An example of tampering is when application-specific information such as the binary code or source code of the application is rewritten by tampering. When such tampering occurs, the application hash value 11x (12x) calculated by the in-vehicle device 20 at the time of update differs from the application hash value 11x (12x) at the time of installation, i.e., the application hash value 11x (12x) stored on the communication device 50 side. Therefore, in this embodiment, tampering with the application can be detected by comparing the (current) application hash value 11x (12x) after the update with the application hash value 11x (12x) at the time of installation.

[0066] As another example, an application may be tampered with (rewritten) by unauthorized installation software separate from the first and second applications, without going through communication device 50. In such tampering, if application-specific information such as binary code is rewritten, in this embodiment, as described above, application hash value 11x (12x) becomes different from that at the time of installation, and this makes it possible to detect tampering with the application.

[0067] Here, even in the case of a high level of tampering such that the application hash value 11x (12x) after tampering is the same as that at the time of installation, in this embodiment, tampering with the application can be detected by using the device hash value. That is, when tampering is performed, in the in-vehicle device 20, the unique information (e.g., date and time information of the installation of the application) unique to the in-vehicle device 20 (or the communication device 50) changes. Therefore, the device hash value 11y (12y) calculated by the in-vehicle device 20 at the time of update differs from the device hash value 11y (12y) at the time of installation, i.e., the device hash value 11y (12y) stored on the communication device 50 side. Therefore, in this embodiment, tampering with the application can be detected by comparing the (current) device hash value 11y (12y) after update with the device hash value 11y (12y) at the time of installation.

[0068] The process of detecting tampering with an application, in other words, the process of verifying the authenticity of the application, will be described in detail below. Note that, although the following will be described taking as an example a case where the communication device 50 (management software) performs the verification process, the present invention is not limited to this, and the in-vehicle device 20 may perform the verification process.

[0069] Furthermore, there are multiple (e.g., three) verification processes according to this embodiment. Of the multiple verification processes, a first verification process is a verification process based on mutual monitoring between the communication device 50 and the in-vehicle device 20 using verification information on the communication device 50 side and verification information on the in-vehicle device 20 side. A second verification process is a verification process on the communication device 50 side using verification information on the communication device 50 side. A third verification process is a verification process based on mutual monitoring between applications (here, between a first application and a second application) using verification information on the in-vehicle device 20 side.

[0070] [Regarding the first verification process] First, the first verification process will be described below, taking as an example a case where the authenticity of the second application is verified in the first verification process.

[0071] In the first verification process, the second verification information 12a2 and the second verification information 12b, and the first verification information 11a2 and the first verification information 11b are used to verify the authenticity of the second application. For example, when a predetermined timing for executing the first verification process arrives, the communication device 50 requests the second application of the in-vehicle device 20 to transmit the second verification information 12a2 and the first verification information 11a2 stored in the in-vehicle device 20. In response to the transmission request, the in-vehicle device 20 transmits the second verification information 12a2 and the first verification information 11a2 to the communication device 50.

[0072] Then, the communication device 50 compares and verifies the authenticity of the second app by comparing and matching the second verification information 12a2 transmitted from the in-vehicle device 20 with the second verification information 12b stored in the memory unit of the communication device 50, and also compares and verifies the first verification information 11a2 transmitted from the in-vehicle device 20 with the first verification information 11b stored in the memory unit of the communication device 50.

[0073] In detail, the communication device 50 verifies the authenticity of the second application by comparing the second verification information 12a2 transmitted from the in-vehicle device 20, i.e., the second verification information 12a2 stored on the in-vehicle device 20 side at the time when a specified timing arrives, with the second verification information 12b stored in the memory unit of the communication device 50 and generated when the second application is installed.

[0074] Specifically, the communication device 50 determines whether the application hash value 12x in the second verification information 12a2 matches the application hash value 12x in the second verification information 12b. The communication device 50 also determines whether the device hash value 12y in the second verification information 12a2 matches the device hash value 12y in the second verification information 12b.

[0075] Furthermore, the communication device 50 verifies the authenticity of the second application by comparing the first verification information 11a2 transmitted from the in-vehicle device 20, i.e., the first verification information 11a2 stored in the in-vehicle device 20 at the time when a predetermined timing arrives, with the first verification information 11b that was generated when the first application was installed and stored in the storage unit of the communication device 50 and that is also stored in the storage unit of the communication device 50 when the second application is installed. Specifically, the communication device 50 determines whether the first verification information 11a2 on the in-vehicle device 20 side and the first verification information 11b on the communication device 50 side match each other.

[0076] When the second verification information 12a2 and the second verification information 12b match and the first verification information 11a2 and the first verification information 11b match, the communication device 50 determines that the second application is legitimate, in other words, that the second application is not an unauthorized application. That is, the communication device 50 determines that the second application is a legitimate application and not an unauthorized application because the second verification information 12a2 and the first verification information 11a2 on the in-vehicle device 20 side have not changed (have not been rewritten) from the second verification information 12b and the first verification information 11b on the communication device 50 side, which are the verification information at the time of installation.

[0077] On the other hand, if the second verification information 12a2 and the second verification information 12b do not match and / or the first verification information 11a2 and the first verification information 11b do not match, the communication device 50 determines that the second application is not authentic, in other words, the authenticity of the second application is not verified and the second application is determined to be an unauthorized application. That is, the communication device 50 determines that the current second application is an unauthorized application that has been tampered with, because the second verification information 12a2 and the first verification information 11a2 on the in-vehicle device 20 side have been changed (rewritten) from the second verification information 12b and the first verification information 11b on the communication device 50 side, which are the verification information at the time of installation.

[0078] In addition, the mismatch between the above-mentioned second verification information 12a2 and the second verification information 12b means that some of the application hash value 12x and the device hash value 12y do not match, but is not limited to this and may mean, for example, that all of them do not match.

[0079] In this way, in the first verification process, mutual monitoring is performed between the communication device 50 and the in-vehicle device 20 using verification information on the in-vehicle device 20 side of the application at the time when a predetermined timing arrives (for example, the present) (here, the second verification information 12a2 and the first verification information 11a2) and verification information on the communication device 50 side of the application at the time of installation (here, the second verification information 12b and the first verification information 11b). This can improve the accuracy of the verification process for verifying the authenticity of the application, and therefore the security of the in-vehicle device 20 equipped with the application.

[0080] In the above, an example has been given of verifying the authenticity of the second application in the first verification process. However, when verifying the authenticity of the first application, the communication device 50 performs the verification process by comparing the first verification information 11a1 and the predetermined verification information 10a1 of the first application side of the in-vehicle device 20 with the first verification information 11b and the predetermined verification information 10b of the communication device 50.

[0081] [Regarding the second verification process] Next, the second verification process will be described, taking as an example a case where the authenticity of the second application is verified in the second verification process.

[0082] In the second verification process, the authenticity of the second application is verified using the application hash value. For example, when a predetermined timing for executing the second verification process arrives, the communication device 50 acquires application unique information (e.g., binary code of the second application) that is unique to the second application of the in-vehicle device 20. The communication device 50 multiplies the acquired application unique information by a predetermined hash function to recalculate the application hash value. That is, the communication device 50 calculates the application hash value when the predetermined timing arrives.

[0083] Then, the communication device 50 compares and verifies the authenticity of the second application by comparing the application hash value calculated at the specified time with the application hash value 12x of the second verification information 12b stored in the storage unit of the communication device 50.

[0084] In detail, the communication device 50 verifies the authenticity of the second application by comparing the application hash value recalculated at a specified time with the application hash value 12x that is stored in the memory unit of the communication device 50 and calculated when the application was installed.

[0085] Specifically, communication device 50 determines whether the recalculated application hash value matches application hash value 12x in second verification information 12b. If the recalculated application hash value matches application hash value 12x in second verification information 12b, communication device 50 determines that the second application is legitimate, in other words, that the second application is not a fraudulent application. That is, communication device 50 determines that the second application is a legitimate application and not a fraudulent application because the recalculated application hash value has not changed (has not been rewritten) from application hash value 12x, which is verification information at the time of installation.

[0086] On the other hand, if the recalculated app hash value does not match app hash value 12x of second verification information 12b, communication device 50 determines that the second app is not legitimate, in other words, the authenticity of the second app is not verified and the second app is determined to be a fraudulent app. That is, communication device 50 determines that the current second app is a fraudulent app that has been tampered with, because the recalculated app hash value has changed (rewritten) from app hash value 12x, which is the verification information at the time of installation.

[0087] In this way, in the second verification process, the communication device 50 (management software) detects any change in the application hash value since the time of installation, thereby improving the accuracy of the verification process for verifying the authenticity of the application, and thereby improving the security of the in-vehicle device 20 equipped with the application.

[0088] In the above description, an example has been given in which the authenticity of the second application is verified in the second verification process. However, in the case of verifying the authenticity of the first application, the communication device 50 re-calculates the application hash value based on the application unique information of the first application, and performs the verification process by comparing the calculated application hash value with the application hash value 11x in the first verification information 11b of the communication device 50.

[0089] [Regarding the third verification process] Next, the third verification process will be described. Here, a case where the authenticity of the first application and the second application is verified in the third verification process will be described as an example. Also, a case where the predetermined timing for executing the third verification process is when a request to start an application is made (hereinafter, when a request to start the second application is made) will be described as an example.

[0090] In the third verification process, the first verification information 11a1 and the first verification information 11a2 are used to verify the authenticity of the first and second applications. For example, when a user or the like requests the second application to be started and a predetermined timing for executing the third verification process arrives, the communication device 50 requests the second application of the in-vehicle device 20 to transmit the first verification information 11a2 stored on the in-vehicle device 20 side. In other words, the communication device 50 requests the second application of the in-vehicle device 20 to transmit the first verification information 11a2, which is verification information stored in a storage unit related to the second application of the in-vehicle device 20 and is verification information related to an application installed before the second application, specifically, verification information related to an application (here, the first application) installed immediately before the second application. In response to the transmission request, the in-vehicle device 20 transmits the first verification information 11a2 to the communication device 50.

[0091] The communication device 50 also requests the first application of the in-vehicle device 20 to transmit the first verification information 11a1 stored on the in-vehicle device 20 side. In other words, the communication device 50 requests the first verification information 11a1, which is verification information related to the first application and is stored in a storage unit related to the first application of the in-vehicle device 20. In response to this transmission request, the in-vehicle device 20 transmits the first verification information 11a1 to the communication device 50.

[0092] The communication device 50 then compares and collates the first verification information 11a2 transmitted from the in-vehicle device 20 with the first verification information 11a1, thereby verifying the authenticity of the first and second applications.

[0093] In detail, the communication device 50 verifies the authenticity of the first and second applications by comparing the first verification information 11a2 stored in a memory unit related to the second application of the in-vehicle device 20 at the time a specified timing arrives with the first verification information 11a1 stored in a memory unit related to the first application of the in-vehicle device 20 at the time a specified timing arrives.

[0094] Specifically, the communication device 50 determines whether the application hash value 11x in the first verification information 11a2 matches the application hash value 11x in the first verification information 11a1. The communication device 50 also determines whether the device hash value 11y in the first verification information 11a2 matches the device hash value 11y in the first verification information 11a1.

[0095] When the first verification information 11a2 and the first verification information 11a1 match, the communication device 50 determines that the first and second applications are legitimate, in other words, that the first and second applications are not unauthorized applications. That is, the communication device 50 determines that the first and second applications are legitimate applications and not unauthorized applications because it can be estimated that the first verification information 11a2 and the first verification information 11a1 on the in-vehicle device 20 side have not changed (have not been rewritten) from the verification information at the time of installation. Then, when the communication device 50 determines that the first and second applications are legitimate, the in-vehicle device 20 launches the second application.

[0096] On the other hand, when the first verification information 11a2 and the first verification information 11a1 do not match, the communication device 50 determines that at least one of the first and second applications is not authentic. More precisely, the authenticity of the first and second applications is not verified, and at least one of the first and second applications is an unauthorized application. That is, the communication device 50 determines that at least one of the current first and second applications is an unauthorized application because the first verification information 11a2 and the first verification information 11a1 on the in-vehicle device 20 side have changed (been rewritten) from the verification information at the time of installation. Then, when the authenticity of the first and second applications is not verified by the communication device 50, the in-vehicle device 20 does not launch the second application, in other words, prohibits the launch of the second application.

[0097] In addition, the mismatch between the above-mentioned first verification information 11a2 and the first verification information 11a1 means that some of the application hash value 11x and the device hash value 11y do not match, but is not limited to this and may mean, for example, that all of them do not match.

[0098] In this way, in the third verification process, the verification process is performed using the verification information (here, the first verification information 11a2) on the in-vehicle device 20 side, which is possessed by the application (here, the second application) for which a start request has been made, related to the application (here, the first application) installed immediately before, and the verification information (here, the first verification information 11a1) on the in-vehicle device 20 side, which is possessed by the application (here, the first application) installed immediately before the application for which a start request has been made. That is, in the third verification process, mutual monitoring is performed between the applications (here, the first application and the second application). This can improve the accuracy of the verification process for verifying the authenticity of the application, and therefore the security of the in-vehicle device 20 including the application can be improved.

[0099] The above-mentioned first to third verification processes can be arbitrarily combined. In the above, the first to third verification processes are executed when a predetermined timing arrives. The predetermined timing is, for example, a periodic verification timing set at an arbitrary time, an arbitrary regular time interval, or a timing when a request to start an application is made, but is not limited thereto, and may be set at an irregular timing or an arbitrary timing.

[0100] As an example, the first and second verification processes are executed at regular intervals, and the third verification process is executed when a request to start an application is made. Note that the above-mentioned combinations of verification processes and the execution timings of the verification processes are merely examples and are not intended to be limiting.

[0101] In this manner, in this embodiment, in addition to the application hash value generated based on application-specific information that is specific to the application, the authenticity of the application is verified using verification information (specifically, the device hash value and verification information related to the application that was installed immediately before) generated based on unique information that is specific to the communication device 50 or the in-vehicle device 20.

[0102] This enables the verification device 100 to detect an application that has been illegally tampered with with greater accuracy than when the verification process is performed using only the application hash value, for example. This improves the accuracy of the verification process for verifying the authenticity of the application, thereby improving the security of the in-vehicle device 20.

[0103] In the present embodiment, the unique information of the communication device 50 or the in-vehicle device 20 includes information related to the installation process of the application. Specifically, the unique information includes date and time information indicating the date and time when the corresponding application was installed.

[0104] This allows the in-vehicle device 20 equipped with the application to use, as the unique information, information related to the installation process (for example, date and time information), which is information that is relatively easy to obtain.

[0105] <In-vehicle system including verification device> Next, the configuration of an in-vehicle system including the verification device 100 according to the embodiment will be described with reference to Fig. 2. Fig. 2 is a block diagram showing an example of the configuration of an in-vehicle system 1 including the verification device 100 according to the embodiment. Note that in the block diagram of Fig. 2, only components necessary for explaining the features of this embodiment are shown as functional blocks, and descriptions of general components are omitted.

[0106] In other words, each component shown in the block diagram of Figure 2 is a functional concept, and does not necessarily have to be physically configured as shown in the figure. For example, the specific form of distribution and integration of each functional block is not limited to that shown in the figure, and all or part of it can be functionally or physically distributed and integrated in any unit according to various loads, usage conditions, etc.

[0107] As shown in FIG. 2, the in-vehicle system 1 includes the above-mentioned verification device 100 and an output unit 80.

[0108] The output unit 80 outputs various information such as a notification indicating a response when the authenticity of the application is not verified as described below. For example, the output unit 80 includes a display unit such as a display and an audio output unit such as a speaker, and outputs various information such as notifications to the user.

[0109] The verification device 100 is configured by each verification processing function unit provided in the in-vehicle device 20 and the communication device 50. The in-vehicle device 20 is any device mounted on a vehicle. The in-vehicle device 20 may be, for example, a navigation device, a vehicle control device, an audio device, or the like, but is not limited thereto.

[0110] 2 shows an example in which three applications, a first application, a second application, and a third application, are installed in the in-vehicle device 20, but the number of applications is merely an example and is not limited thereto. In the example of FIG. 2, the applications are installed in the in-vehicle device 20 in the order of the first application, the second application, and the third application.

[0111] The communication device 50 is a device that can perform various processes related to the application, such as a process related to the communication of the application, a process for managing the application of the in-vehicle device 20, and a process for outputting a response notice when the authenticity of the application is not verified. For example, a TCU (Telematics Control Unit) can be used as the communication device 50, but is not limited thereto. The communication device 50 and the in-vehicle device 20 are connected to each other so as to be able to communicate with each other via wireless communication or wired communication.

[0112] [About the configuration of on-board equipment] First, a detailed configuration of the in-vehicle device 20 will be described. The in-vehicle device 20 includes an application control unit 30 and an in-vehicle device side storage unit 40. The application control unit 30 includes an application processing unit 31 and an application side generation unit 32, and includes, for example, a computer having a CPU (Central Processing Unit), a ROM (Read Only Memory), a RAM (Random Access Memory), an input / output port, and various circuits.

[0113] The CPU of the computer functions as the application processing unit 31 and the application side generation unit 32 of the application control unit 30, for example, by reading and executing a program stored in the ROM.

[0114] At least a part or the whole of the application processing unit 31 and the application side generation unit 32 of the application control unit 30 can be configured with hardware such as an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA).

[0115] The in-vehicle device storage unit 40 is a storage unit configured with a storage device such as a non-volatile memory, a data flash, a hard disk drive, etc. The in-vehicle device storage unit 40 includes a first application storage unit 41, a second application storage unit 42, and a third application storage unit 43.

[0116] The first application storage unit 41 is a storage unit that stores information related to the first application. The first application storage unit 41 stores predetermined verification information 10a1 and first verification information 11a1. As described above, the predetermined verification information 10a1 is verification information related to the communication device 50, and is information output from the communication device 50 and stored when the first application is installed.

[0117] The first verification information 11a1 is verification information related to the first application, and is generated when the first application is installed and stored in the first application storage unit 41. Note that the predetermined verification information 10a1 and the first verification information 11a1 stored in the first application storage unit 41 are updated periodically or irregularly as described above.

[0118] Here, the first verification information 11a1 will be described with reference to Fig. 3. Fig. 3 is a diagram showing an example of the first verification information 11a1. As shown in Fig. 3, the first verification information 11a1 includes items such as "verification ID" and "contents of verification information", and each item is associated with each other.

[0119] The "verification ID" is identification information for identifying the verification information. The "verification information content" is information indicating the content of the verification information. The "verification information content" includes the first application hash value and the first device hash value, etc.

[0120] The first application hash value is a hash value obtained by multiplying application-specific information unique to the first application (for example, the binary code of the first application) by a predetermined hash function. The first device hash value is a hash value obtained by multiplying unique information unique to the communication device 50 or the in-vehicle device 20 (for example, date and time information indicating the date and time when the first application was installed) by a predetermined hash function. In this way, the first verification information 11a1 is verification information that includes the first application hash value and the first device hash value.

[0121] Returning to the explanation of Fig. 2, the second application storage unit 42 is a storage unit that stores information related to the second application. The second application storage unit 42 stores first verification information 11a2 and second verification information 12a2.

[0122] The first verification information 11a2 is information that is output from the communication device 50 when the second application is installed and stored in the second application storage unit 42. The contents of the verification information included in the first verification information 11a2 are similar to those of the above-described first verification information 11a1, and therefore a description thereof will be omitted here (see FIG. 3). However, the contents of the information itself may differ between the first verification information 11a2 and the first verification information 11a1 due to tampering or the like.

[0123] The second verification information 12a2 is verification information related to the second application, and is generated when the second application is installed and stored in the second application storage unit 42. Note that the first verification information 11a2 and the second verification information 12a2 stored in the second application storage unit 42 are updated periodically or irregularly as described above.

[0124] Here, the second verification information 12a2 will be described with reference to Fig. 4. Fig. 4 is a diagram showing an example of the second verification information 12a2. As shown in Fig. 4, the second verification information 12a2 includes items such as "verification ID" and "verification information content" as in the first verification information 11a1, and each item is associated with each other.

[0125] The "verification information content" of second verification information 12a2 includes the second application hash value and the second device hash value. The second application hash value is a hash value obtained by multiplying application-specific information unique to the second application (e.g., the binary code of the second application) by a predetermined hash function. The second device hash value is a hash value obtained by multiplying unique information unique to communication device 50 or in-vehicle device 20 (e.g., date and time information indicating the date and time when the second application was installed) by a predetermined hash function. In this way, second verification information 12a2 is verification information that includes the second application hash value and the second device hash value.

[0126] Returning to the explanation of Fig. 2, the third application storage unit 43 is a storage unit that stores information related to the third application. The third application storage unit 43 stores second verification information 12a3 and third verification information 13a3.

[0127] Second verification information 12a3 is information that is output from communication device 50 when the third application is installed and stored in third application storage unit 43. The contents of the verification information included in second verification information 12a3 are similar to those of second verification information 12a2 described above, and therefore will not be described here (see FIG. 4). However, the contents of the information itself may differ between second verification information 12a3 and second verification information 12a2 due to tampering or the like.

[0128] The third verification information 13a3 is verification information related to the third application, and is generated when the third application is installed and stored in the third application storage unit 43. Note that the second verification information 12a3 and the third verification information 13a3 stored in the third application storage unit 43 are updated periodically or irregularly.

[0129] Here, the third verification information 13a3 will be described with reference to Fig. 5. Fig. 5 is a diagram showing an example of the third verification information 13a3. As shown in Fig. 5, the third verification information 13a3 includes items such as "verification ID" and "verification information content" similar to the first verification information 11a1, and each item is associated with each other.

[0130] The "verification information content" of third verification information 13a3 includes the third application hash value and the third device hash value. The third application hash value is a hash value obtained by multiplying application specific information specific to the third application (e.g., binary code of the third application) by a predetermined hash function. The third device hash value is a hash value obtained by multiplying specific information specific to communication device 50 or in-vehicle device 20 (e.g., date and time information indicating the date and time when the third application was installed) by a predetermined hash function. In this way, third verification information 13a3 is verification information that includes the third application hash value and the third device hash value.

[0131] Returning to the explanation of FIG. 2, the application processing unit 31 of the application control unit 30 performs processing related to the first application, the second application, and the third application. For example, the application processing unit 31 can perform installation processing of each application. Specifically, when the application downloaded to the communication device 50 is verified to be authentic, the application processing unit 31 accepts an instruction to execute installation from the communication device 50 and installs the application. In addition, the application processing unit 31 can perform uninstallation processing to delete the installed application.

[0132] In addition, in response to a request to transmit verification information or application specific information output from the communication device 50, the application processing unit 31 can transmit the verification information stored in the first to third application storage units 41 to 43 and the application specific information of the first to third applications to the communication device 50.

[0133] The application side generation unit 32 can generate the first verification information 11a1, the second verification information 12a2, the third verification information 13a3, etc. The application side generation unit 32 is an example of a generation unit.

[0134] First, generation of the first verification information 11a1 will be described. For example, when the installation of the first application is completed, the application side generation unit 32 generates the first verification information 11a1.

[0135] Specifically, when installation of the first application is completed, the in-vehicle device 20 receives, from the communication device 50, information on the date and time of installation of the first application. The application side generation unit 32 calculates a first application hash value based on the application unique information of the first application. The application side generation unit 32 also calculates a first device hash value based on the received information on the date and time of installation of the first application. Then, the application side generation unit 32 generates first verification information 11a1 including the first application hash value and the first device hash value, and stores the information in the first application storage unit 41 (see FIG. 3).

[0136] Furthermore, when the installation of the first application is completed, predetermined verification information 10b is input to the in-vehicle device 20 from the communication device 50. The application-side generation unit 32 stores the input information in the first application storage unit 41 as predetermined verification information 10a1.

[0137] Next, generation of the second verification information 12a2 will be described. For example, when the installation of the second application is completed, the application side generation unit 32 generates the second verification information 12a2.

[0138] Specifically, when installation of the second application is completed, date and time information of the installation of the second application is input from communication device 50. Application side generation unit 32 calculates a second application hash value based on the application unique information of the second application. Furthermore, application side generation unit 32 calculates a second device hash value based on the input date and time information of the installation of the second application. Then, application side generation unit 32 generates second verification information 12a2 including the second application hash value and the second device hash value, and stores the information in second application storage unit 42 (see FIG. 4).

[0139] Furthermore, when the installation of the second application is completed, first verification information 11b related to the first application that was installed immediately before the second application is input to the in-vehicle device 20 from the communication device 50. The application-side generation unit 32 stores the input information in the second application storage unit 42 as first verification information 11a2.

[0140] Next, generation of the third verification information 13a3 will be described. For example, when the installation of the third application is completed, the application side generation unit 32 generates the third verification information 13a3.

[0141] Specifically, when installation of the third application is completed, date and time information of the installation of the third application is input from communication device 50. Application side generation unit 32 calculates a third application hash value based on the application unique information of the third application. Furthermore, application side generation unit 32 calculates a third device hash value based on the input date and time information of the installation of the third application. Then, application side generation unit 32 generates third application hash value and third verification information 13a3 including the third device hash value, and stores it in third application storage unit 43 (see FIG. 5).

[0142] Furthermore, when installation of the third application is completed, second verification information 12b related to the second application installed immediately before the third application is input to the in-vehicle device 20 from the communication device 50. The application-side generation unit 32 stores the input information in the second application storage unit 42 as third verification information 13a3.

[0143] In this way, the application-side generation unit 32 generates the first verification information 11a1, the second verification information 12a2, and the third verification information 13a3 based on unique information unique to the communication device 50 or the in-vehicle device 20, such as installation date and time information, and stores them in the in-vehicle device storage unit 40. In addition, the application-side generation unit 32 stores in the in-vehicle device storage unit 40 the predetermined verification information 10a1, the first verification information 11a2, and the second verification information 12a3, which are verification information generated based on unique information unique to the communication device 50 or the in-vehicle device 20, such as verification information related to the application installed immediately before.

[0144] [About the configuration of communication devices] Next, a detailed description will be given of the configuration of the communication device 50. The communication device 50 includes a communication unit 51, a management control unit 60, and a communication device side storage unit .

[0145] The communication unit 51 is a communication interface that is connected to a communication network such as the Internet so as to enable two-way communication, and transmits and receives information related to apps, such as app downloads, to and from an external server, for example.

[0146] The management control unit 60 includes an application management unit 61, a management side generation unit 62, a verification unit 63, and a notification unit 64, and includes, for example, a computer having a CPU, ROM, RAM, input / output ports, and various other circuits.

[0147] The CPU of the computer functions as an application management unit 61, a management side generation unit 62, a verification unit 63, and a notification unit 64 of the management control unit 60, for example, by reading and executing a program stored in the ROM.

[0148] Furthermore, at least some or all of the application management unit 61, management side generation unit 62, verification unit 63, and notification unit 64 of the management control unit 60 can be configured with hardware such as ASIC or FPGA.

[0149] The communication device side storage unit 70 is a storage unit configured with a storage device such as a non-volatile memory, a data flash, a hard disk drive, etc. The communication device side storage unit 70 includes a management storage unit 71.

[0150] The management storage unit 71 is a storage unit that stores information related to management of applications. The management storage unit 71 stores predetermined verification information 10b, first verification information 11b, second verification information 12b, and third verification information 13b. Among the predetermined verification information 10b and the first to third verification information 11b, 12b, and 13b, the predetermined verification information 10b is stored in advance in the management storage unit 71, in other words, before the installation of an application or the like is performed.

[0151] The contents of the verification information included in the predetermined verification information 10b, and the first to third verification information 11b, 12b, and 13b are similar to those of the predetermined verification information 10a1, and the first to third verification information 11a1, 12a2, and 13a3 described above, and therefore will not be described here (see FIGS. 3 to 5). However, the contents of the information themselves may differ due to tampering or the like. That is, there may be differences between the predetermined verification information 10b and the predetermined verification information 10a1, between the first verification information 11b and the first verification information 11a1, between the second verification information 12b and the second verification information 12a2, and between the third verification information 13b and the third verification information 13a3 due to tampering or the like.

[0152] The application management unit 61 of the management control unit 60 can perform management processes related to application communication, such as downloading and installing applications.

[0153] For example, when a request to install an application is made, the application management unit 61 downloads the corresponding application from an external server (not shown). The request to install an application is input to the communication device 50, for example, when an application is added to the in-vehicle device 20 or when an application for updating (reprogramming) is distributed.

[0154] The application management unit 61 determines whether the downloaded application is a legitimate application. As an example, the application management unit 61 acquires an application hash value that the downloaded application has in advance. Furthermore, the application management unit 61 acquires application unique information of the application (e.g., the binary code of the application) from the downloaded application. The application management unit 61 multiplies the acquired application unique information by a predetermined hash function to calculate the application hash value.

[0155] The application management unit 61 compares the application hash value acquired from the application with the calculated application hash value, and if they match, determines that the application is a legitimate application. If the application management unit 61 determines that the application is a legitimate application, it outputs an instruction to the in-vehicle device 20 to execute installation, and the application is installed in the in-vehicle device 20.

[0156] When the installation of the application is completed, the application management unit 61 outputs the date and time information of the installation of the application to the management side generation unit 62 and the in-vehicle device 20.

[0157] Furthermore, when the installation of an application is completed, the application management unit 61 outputs verification information related to the application installed immediately before the application whose installation has been completed to the in-vehicle device 20. If the application installed immediately before does not exist, the application management unit 61 outputs predetermined verification information 10b to the in-vehicle device 20. As a result, the application control unit 30 of the in-vehicle device 20 stores the verification information related to the application in the in-vehicle device storage unit 40, as described above.

[0158] On the other hand, if the application hash value acquired from the application does not match the calculated application hash value, the application management unit 61 determines that the application is not a legitimate application, and does not install the application in the in-vehicle device 20.

[0159] The management side generating unit 62 can generate the first verification information 11b, the second verification information 12b, the third verification information 13b, etc. The management side generating unit 62 is an example of a generating unit.

[0160] For example, when installation of the first application is completed, the management side generation unit 62 generates first verification information 11b. Specifically, when installation of the first application is completed, the management side generation unit 62 calculates a first application hash value based on the application unique information of the first application. In addition, the management side generation unit 62 calculates a first device hash value based on date and time information of the installation of the first application. Then, the management side generation unit 62 generates first verification information 11b including the first application hash value and the first device hash value, and stores it in the management storage unit 71 (see FIG. 3).

[0161] For example, when installation of the second application is completed, the management side generation unit 62 generates second verification information 12b. Specifically, when installation of the second application is completed, the management side generation unit 62 calculates a second application hash value based on the application unique information of the second application. In addition, the management side generation unit 62 calculates a second device hash value based on date and time information of the installation of the second application. Then, the management side generation unit 62 generates second verification information 12b including the second application hash value and the second device hash value, and stores it in the management storage unit 71 (see FIG. 4).

[0162] For example, when installation of the third application is completed, the management side generation unit 62 generates third verification information 13b. Specifically, when installation of the third application is completed, the management side generation unit 62 calculates a third application hash value based on the application unique information of the third application. In addition, the management side generation unit 62 calculates a third device hash value based on date and time information of the installation of the third application. Then, the management side generation unit 62 generates third verification information 13b including the third application hash value and the third device hash value, and stores it in the management storage unit 71 (see FIG. 5).

[0163] In this way, the management side generation unit 62 generates the first verification information 11b, the second verification information 12b and the third verification information 13b based on unique information specific to the communication device 50 or the in-vehicle device 20, such as the date and time information of the application installation, and stores the first verification information 11b, the second verification information 12b and the third verification information 13b in the management memory unit 71.

[0164] The verification unit 63 executes a verification process for verifying the authenticity of the application based on the verification information generated as described above. For example, the verification unit 63 executes the verification process (first to third verification processes) when a predetermined timing arrives after the application is installed.

[0165] As described above, the predetermined timing is the periodic verification timing, or the timing when a request to start an application is made, etc. Here, a case will be described in which the first verification process and the second verification process are executed at the periodic verification timing, and the third verification process is executed at the timing when a request to start an application is made, but the present invention is not limited to this.

[0166] [About the execution of the first verification process] The verification unit 63 executes the first verification process when, for example, a regular verification timing arrives. The following describes an example in which the authenticity of the second application is verified in the first verification process.

[0167] First, the verification unit 63 requests the in-vehicle device 20 to transmit the second verification information 12a2 and the first verification information 11a2. More specifically, the verification unit 63 requests the in-vehicle device 20 to transmit the second verification information 12a2 and the first verification information 11a2, which are verification information related to the second application and are stored in the second application storage unit 42 that stores information related to the second application. As a result, the in-vehicle device 20 transmits the second verification information 12a2 and the first verification information 11a2, and the verification unit 63 acquires the transmitted second verification information 12a2 and first verification information 11a2. That is, the verification unit 63 acquires the second verification information 12a2 and the first verification information 11a2 stored in the second application storage unit 42 at the time when the regular verification timing, which is a predetermined timing, arrives.

[0168] Next, the verification unit 63 acquires the second verification information 12b and the first verification information 11b stored in the management storage unit 71. That is, the verification unit 63 acquires the second verification information 12b stored in the management storage unit 71 that stores information related to application management and generated when the second application is installed, and the first verification information 11b generated when the first application is installed and stored in the management storage unit 71 when the second application is installed.

[0169] Then, the verification unit 63 compares and verifies the authenticity of the second application by comparing and matching the acquired second verification information 12a2 and second verification information 12b and also comparing and matching the acquired first verification information 11a2 and first verification information 11b (see the first verification process in FIG. 1). Specifically, the verification unit 63 compares the application hash value and the device hash value included in the second verification information 12a2 and the second verification information 12b, respectively, and compares the application hash value and the device hash value included in the first verification information 11a2 and the first verification information 11b, respectively, to determine whether they match.

[0170] If the second verification information 12a2 and the second verification information 12b match and the first verification information 11a2 and the first verification information 11b match, the verification unit 63 determines that the second application is legitimate. In other words, the verification unit 63 determines that the second application is a legitimate application and not an unauthorized application because the second verification information 12a2 and the first verification information 11a2 on the in-vehicle device 20 side have not changed (have not been rewritten) with respect to the second verification information 12b and the first verification information 11b on the communication device 50 side, which are the verification information at the time of installation.

[0171] On the other hand, if the second verification information 12a2 and the second verification information 12b do not match and / or the first verification information 11a2 and the first verification information 11b do not match, the verification unit 63 determines that the second application is not legitimate. That is, the verification unit 63 determines that the current second application is an unauthorized application that has been tampered with, because the second verification information 12a2 and the first verification information 11a2 on the in-vehicle device 20 side have been changed (rewritten) compared to the second verification information 12b and the first verification information 11b on the communication device 50 side.

[0172] In this way, in the first verification process, by comparing and mutually monitoring the verification information on the in-vehicle device 20 side and the verification information on the communication device 50 side, the accuracy of the verification process for verifying the authenticity of the application can be improved, thereby improving the security of the in-vehicle device 20 equipped with the application.

[0173] [About the execution of the second verification process] Verification unit 63 executes the second verification process when, for example, a regular verification timing arrives. Hereinafter, an example will be described in which the authenticity of the second application is verified in the second verification process.

[0174] For example, when the periodic verification timing arrives, the verification unit 63 requests the in-vehicle device 20 to transmit the application unique information of the second application. As a result, the application unique information of the second application is transmitted from the in-vehicle device 20, and the verification unit 63 acquires the transmitted application unique information of the second application. The verification unit 63 multiplies the acquired application unique information of the second application by a predetermined hash function to recalculate the application hash value of the second application. In other words, the verification unit 63 calculates the (current) application hash value of the second application at the time when the periodic verification timing arrives.

[0175] Next, the verification unit 63 obtains the application hash value of the second verification information 12b stored in the management storage unit 71. That is, the verification unit 63 obtains the application hash value of the second verification information 12b stored in the management storage unit 71 and calculated when the second application is installed.

[0176] Then, the verification unit 63 verifies the authenticity of the second application by comparing and matching the application hash value of the second application calculated when the regular verification timing arrives with the application hash value of the second application calculated when the second application is installed (see the second verification process in FIG. 1).

[0177] If the app hash value of the second app at the time of regular verification matches the app hash value of the second app at the time of installation, the verification unit 63 determines that the second app is legitimate. In other words, the verification unit 63 determines that the second app is a legitimate app and not an unauthorized app because the recalculated app hash value of the second app has not changed (has not been rewritten) from the app hash value of the second app that is the verification information at the time of installation.

[0178] On the other hand, if the application hash value of the second application at the time of the regular verification does not match the application hash value of the second application at the time of installation, the verification unit 63 determines that the second application is not legitimate. That is, the verification unit 63 determines that the current second application is an unauthorized application that has been tampered with, because the recalculated application hash value of the second application has changed (rewritten) from the application hash value of the second application at the time of installation.

[0179] In this way, in the second verification process, the (current) application hash value at the time when the periodic verification timing arrives is compared with the application hash value at the time of installation to detect a change in the application hash value since installation. This improves the accuracy of the verification process for verifying the authenticity of the application, thereby improving the security of the in-vehicle device 20 equipped with the application.

[0180] [About the execution of the third verification process] The verification unit 63 executes the third verification process when, for example, a request to start an application is made. The following describes an example of verifying the authenticity of the second application, etc.

[0181] When a request to start the second application is made, the verification unit 63 first makes a request to the second application of the in-vehicle device 20 to transmit first verification information 11a2, which is verification information stored in the second application storage unit 42 and is related to the first application that was installed before the second application. As a result, the first verification information 11a2 is transmitted from the in-vehicle device 20, and the verification unit 63 acquires the transmitted first verification information 11a2. In other words, the verification unit 63 acquires the first verification information 11a2 stored in the second application storage unit 42 at the time when a request to start the second application is made.

[0182] Next, the verification unit 63 requests the first application of the in-vehicle device 20 to transmit the first verification information 11a1 stored in the first application storage unit 41. As a result, the first verification information 11a1 is transmitted from the in-vehicle device 20, and the verification unit 63 acquires the transmitted first verification information 11a1. That is, the verification unit 63 acquires the first verification information 11a1 stored in the first application storage unit 41 at the time when the start request for the second application is made.

[0183] Then, the verification unit 63 verifies the authenticity of the first and second applications by comparing and collating the acquired first verification information 11a2 and first verification information 11a1 (see the third verification process in FIG. 1). Specifically, the verification unit 63 compares the application hash value and the device hash value included in the first verification information 11a2 and the first verification information 11a1, respectively, to determine whether they match.

[0184] If the first verification information 11a2 and the first verification information 11a1 match, the verification unit 63 determines that the first and second applications are legitimate. In other words, the verification unit 63 determines that the first and second applications are legitimate applications and not unauthorized applications because it can be estimated that the first verification information 11a2 and the first verification information 11a1 have not been changed (rewritten) from the verification information at the time of installation.

[0185] On the other hand, when the first verification information 11a2 and the first verification information 11a1 do not match, the verification unit 63 determines that at least one of the first and second applications is not legitimate. That is, the verification unit 63 determines that at least one of the current first and second applications is an unauthorized application that has been tampered with, because the first verification information 11a2 and the first verification information 11a1 have been changed (rewritten) from the verification information at the time of installation.

[0186] When the above-mentioned verification process is completed, the verification unit 63 transmits information indicating the verification result (comparison result) of the above-mentioned verification process to the in-vehicle device 20 and the notification unit 64. If the verification result indicates that the first and second applications are legitimate, the application processing unit 31 of the in-vehicle device 20 launches the second application. On the other hand, if the verification result indicates that at least one of the first and second applications is not legitimate, the application processing unit 31 does not launch the second application, in other words, prohibits the launch of the second application.

[0187] In this way, in the third verification process, mutual monitoring is performed between the apps (here, between the first app and the second app) using the first verification information 11a2 of the first app installed before the second app stored in the second app storage unit 42 of the second app requested to be started and the first verification information 11a1 of the first app stored in the first app storage unit 41 of the first app installed before the second app. This can improve the accuracy of the verification process for verifying the authenticity of the app, and therefore the security of the in-vehicle device 20 including the app.

[0188] [Regarding notifications] The notification unit 64 can provide a notification according to information indicating the verification result of each of the above-mentioned verification processes. For example, if the authenticity of the application is not verified by the verification process, in other words, if the verification result indicates that the application is a fraudulent application, the notification unit 64 notifies the user of the in-vehicle device 20 via the output unit 80 of the action to be taken against the application.

[0189] As an example, the notification unit 64 can perform a notification to prompt a process of deleting (uninstallation process) an application whose authenticity has not been verified. Then, when a user who has received such a notification operates the in-vehicle device 20 to request the deletion of the application whose authenticity has not been verified, for example, the in-vehicle device 20 performs an uninstallation process to delete the application.

[0190] In this way, if the authenticity of an app cannot be verified, the device is configured to notify the user of the action that should be taken regarding the application, allowing the user to take appropriate action, such as deleting the fraudulent app.

[0191] Furthermore, when the authenticity of the application is verified by the verification process, the notification unit 64 may provide a notification indicating that the application is a legitimate application. This allows, for example, a user to confirm the safety of the application of the in-vehicle device 20.

[0192] <Control process of the verification device according to the embodiment> Next, a specific processing procedure in the verification device 100 will be described with reference to Fig. 6. Fig. 6 is a flowchart showing the processing procedure executed by the verification device 100.

[0193] 6, the verification device 100 determines whether or not there is a request to install the application (step S10). If it is determined that there is a request to install the application (step S10, Yes), the verification device 100 executes a process to download the application from an external server (step S11).

[0194] Next, the verification device 100 verifies whether the downloaded application is a legitimate application (step S12). If the verification device 100 verifies that the downloaded application is not a legitimate application, that is, that the application is not legitimate (step S12, No), the verification device 100 does not install the application and ends the process.

[0195] If the verification device 100 verifies that the downloaded application is a legitimate application, that is, that the application is legitimate (Yes at step S12), the verification device 100 installs the application in the in-vehicle device 20 (step S13).

[0196] Next, the verification device 100 generates verification information based on information unique to the communication device 50 or the in-vehicle device 20, application unique information unique to the application, etc. (step S14). If it is determined in the process of step S10 that there is no request to install the application (step S10, No), the verification device 100 skips the processes of steps S11 to S14.

[0197] Next, the verification device 100 judges whether or not the periodic verification timing has arrived (step S15). If the verification device 100 judges that the periodic verification timing has arrived (step S15, Yes), it executes the first verification process (step S16) and then executes the second verification process (step S17). Note that, in the example of Fig. 6, the first verification process and the second verification process are performed in that order, but this is not limited thereto, and for example, the second verification process and the first verification process may be performed in that order, or the first and second verification processes may be performed simultaneously.

[0198] Next, the verification device 100 judges whether or not the authenticity of the application has been verified in the first and second verification processes (step S18). If the verification device 100 judges that the application is not authentic (step S18, No), the verification device 100 notifies the user of the action to be taken against the application (step S19), for example, by notifying the user to delete the application.

[0199] On the other hand, if the verification device 100 verifies that the application is legitimate (step S18, Yes), or if it is determined in step S15 that the regular verification timing has not arrived (step S15, No), it determines whether a request to launch the application has been made (step S20).

[0200] If the verification device 100 determines that the application startup request has not been made (step S20, No), it skips the subsequent processes. On the other hand, if the verification device 100 determines that the application startup request has been made (step S20, Yes), it executes a third verification process (step S21).

[0201] Next, the verification device 100 determines whether or not the authenticity of the application is verified in the third verification process (Step S22). If the authenticity of the application is verified (Yes in Step S22), the verification device 100 starts the application (Step S23).

[0202] On the other hand, if the verification device 100 determines that the app is not legitimate (step S22, No), the verification device 100 proceeds to step S19 without launching the app, and notifies the user of what action should be taken against the app, for example, prompting the user to delete the app.

[0203] As described above, the verification device 100 according to the embodiment includes a generation unit (application side generation unit 32, management side generation unit 62) and a verification unit 63. The generation unit generates verification information based on unique information unique to the device (in-vehicle device 20, communication device 50) that performs processing related to the application. The verification unit 63 executes a verification process to verify the authenticity of the application based on the verification information generated by the generation unit. This can improve the security of the in-vehicle device 20 equipped with the application.

[0204] In the above embodiment, the application hash value is calculated based on application-specific information such as the binary code or source code of the application, and the device hash value is calculated based on information specific to the communication device 50 (or the in-vehicle device 20) such as date and time information of the installation of the application, but the present invention is not limited to this. That is, for example, the application-specific information (such as the binary code) and information specific to the communication device 50 or the like (such as date and time information of the installation) may be combined, the combined information may be multiplied by a predetermined hash function to calculate a hash value, and the verification process may be performed based on the hash value.

[0205] In the above description, the in-vehicle device 20 and the communication device 50 each perform various processes, but the devices in which the various processes are performed are not limited to those described above. That is, a part or all of the processes performed in the in-vehicle device 20 may be performed in the communication device 50. Also, a part or all of the processes performed in the communication device 50 may be performed in the in-vehicle device 20.

[0206] Further advantages and modifications may readily occur to those skilled in the art. Thus, the invention in its broader aspects is not limited to the specific details and representative embodiments shown and described above. Accordingly, various modifications may be made without departing from the spirit or scope of the general inventive concept as defined by the appended claims and equivalents thereof. [Explanation of symbols]

[0207] 1. In-vehicle systems 20 In-vehicle equipment 30 Application control section 32 Application side generation part 50 Communication Equipment 60 Management and Control Unit 62 Management side generation section 63 Verification Department 64 Notification Department 100 Verification Device

Claims

1. A verification device having a computer, The computer includes: generating verification information when the first application is installed and storing the verification information in the first application storage unit; After the installation of the first application, when a second application is installed, the verification information generated when the first application is installed is stored in a second application storage unit as verification information for comparison; When a verification timing arrives, verification information stored in the first application storage unit at the time of the verification timing is compared with verification information for comparison stored in the second application storage unit, thereby verifying the authenticity of the second application. Verification device.

2. The computer includes: generating the verification information based on unique information unique to a device that processes the application; The verification device according to claim 1 .

3. The unique information is containing information regarding the installation process of said application; The verification device according to claim 2 .

4. The unique information is including date and time information indicating the date and time when the application was installed; 4. The verification device according to claim 2 or 3.

5. The computer includes: generating the verification information based on application specific information specific to the application and the specific information; The verification device according to any one of claims 2 to 4.

6. The computer includes: calculating a hash value as the verification information based on application specific information that is specific to the application; The verification device according to any one of claims 1 to 5.

7. The computer includes: If the authenticity of the second application is not verified, a notification is given to a user to prompt the user to perform an uninstallation process of the second application. The verification device according to any one of claims 1 to 6.

8. A computer implemented verification method comprising: generating verification information when the first application is installed and storing the verification information in a first application storage unit; a step of storing, after the installation of the first application, the verification information generated when the first application was installed in a second application storage unit as verification information for comparison when a second application is installed; When a verification timing arrives, verifying the authenticity of the second application by comparing verification information stored in the first application storage unit at the time of the verification timing with verification information for comparison stored in the second application storage unit. A verification method, comprising:

Images