Control system and vehicle

Abstract

A control system according to an embodiment of the present disclosure comprises: a first control device including a first security circuit, in which a first cryptographic key is stored and to which access from the outside is restricted, and a first memory circuit; and a second control device including a second security circuit, in which a second cryptographic key is stored and to which access from the outside is restricted, and a second memory circuit. The first control device is capable of generating an authentication key to be used in an authentication process between the first control device and the second control device, is capable of generating a first authentication key by encrypting the authentication key with a first cryptographic key, and is capable of storing the first authentication key in the first memory circuit. The first control device is capable of supplying the generated authentication key to the second control device. The second control device is capable of generating a second authentication key by encrypting the authentication key supplied from the first control device with a second cryptographic key, and is capable of storing the second authentication key in the second memory circuit.

Description

Control Systems and Vehicles

[0001] The present disclosure relates to a control system that performs authentication processing using an authentication key, and a vehicle equipped with such a control system.

[0002] In electronic devices, a technique for enhancing security by using a key is often used. For example, Japanese Patent Application Laid-Open No. 2003-222222 discloses a technique for managing a security access key in a vehicle master device.

[0003] Japanese Patent Application Laid-Open No. 2020-028120

[0004] A control system according to an embodiment of the present disclosure includes a first control device and a second control device. The first control device includes a first security circuit in which a first encryption key is stored and in which external access is restricted, and a first storage circuit. The second control device includes a second security circuit in which a second encryption key is stored and in which external access is restricted, and a second storage circuit. The first control device is capable of generating an authentication key used in authentication processing between the first control device and the second control device, encrypting the authentication key with the first encryption key to generate the first authentication key, and storing the first authentication key in the first storage circuit. The first control device is capable of supplying the generated authentication key to the second control device. The second control device is capable of encrypting the authentication key supplied from the first control device with the second encryption key to generate a second authentication key, and storing the second authentication key in the second storage circuit.

[0005] A vehicle according to an embodiment of the present disclosure includes the above control system. The first control device includes an electronic control unit that controls the vehicle.

[0006] The accompanying drawings are included to provide a further understanding of the disclosure, and are incorporated in and constitute a part of this specification. The drawings illustrate one embodiment and, together with the description, serve to explain the principles of the disclosure.

[0007] FIG. 1 is an explanatory diagram illustrating an example configuration of a control system according to an embodiment of the present disclosure. FIG. 2 is a block diagram illustrating an example configuration of a central electronic control unit and a communication module illustrated in FIG. 1. FIG. 3 is an explanatory diagram illustrating an example operation of the control system illustrated in FIG. 1. FIG. 4 is a sequence diagram illustrating an example operation of the control system illustrated in FIG. 3. FIG. 5 is an explanatory diagram illustrating another example operation of the control system illustrated in FIG. 1. FIG. 6A is a sequence diagram illustrating an example operation of the control system illustrated in FIG. 5. FIG. 6B is another sequence diagram illustrating an example operation of the control system illustrated in FIG. 5.

[0008] Control systems are expected to offer increased security while also improving convenience, and further improvements in convenience are anticipated.

[0009] It is desirable to provide a control system and a vehicle that can improve convenience while also improving security.

[0010] Some exemplary embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings. Note that the following description illustrates one specific example of the present disclosure and should not be construed as limiting the present disclosure. For example, each element, including numerical values, shapes, materials, parts, the position of each part, and the connection method of each part, is merely an example and should not be construed as limiting the present disclosure. Furthermore, in the following exemplary embodiments, components not described in independent claims based on the highest concept of the present disclosure are optional and may be provided as needed. The drawings are schematic and are not intended to be drawn to scale. Throughout this specification and the drawings, components having substantially the same function and configuration are designated by the same reference numerals, and redundant description will be omitted. Furthermore, components not directly related to one embodiment of the present disclosure are not shown in the drawings.

[0011] 1 shows an example of the configuration of a control system (control system 1) according to an embodiment. The control system 1 is provided in a vehicle 9. The vehicle 9 is a vehicle such as an automobile. The control system 1 has a central electronic control unit (ECU: Electronic Control Unit) 10, a plurality of electronic control units 19, and a communication module 20.

[0012] The central electronic control unit 10 is configured to control the operation of the vehicle 9 by controlling the operation of the multiple electronic control units 19. The central electronic control unit 10 is also connected to a diagnostic device 30 (described later) outside the vehicle via, for example, a communication cable, and is capable of communicating with the diagnostic device 30. The central electronic control unit 10 is also connected to a CAN (Controller Area Network) 9, and is configured to communicate with a communication module 20 via the CAN 9.

[0013] The plurality of electronic control units 19 are configured to control the operation of each device in the vehicle 9 based on instructions from the central electronic control unit 10. The plurality of electronic control units 19 include, for example, an electronic control unit 19 that controls the powertrain such as the engine, an electronic control unit 19 that controls the steering device and the braking device, an electronic control unit 19 that controls the interior and exterior lighting, doors, windshield wipers, etc., an electronic control unit 19 that controls the driving assistance system, etc.

[0014] The communication module 20 is configured to communicate with a base station by performing mobile communications such as 4G (4th Generation) or 5G (5th Generation). This allows the communication module 20 to communicate with a server 40 (described later) connected to the Internet via the base station. The communication module 20 is also connected to a CAN 9 and communicates with the central electronic control unit 10 via the CAN 9.

[0015] In this control system 1, authentication processing can be performed between the central electronic control unit 10 and the communication module 20. In the central electronic control unit 10, for example, an encrypted authentication key KB1 is stored in a nonvolatile memory 14 (described later), and in the communication module 20, for example, an encrypted authentication key KB2 is stored in a nonvolatile memory 24 (described later). The central electronic control unit 10 and the communication module 20 are configured to be able to perform authentication processing using these authentication keys KB1 and KB2.

[0016] FIG. 2 shows an example of the configuration of the central electronic control unit 10 and the communication module 20. As shown in FIG.

[0017] The central electronic control unit 10 includes a communication unit 11 , a storage unit 12 , a security module 15 , an external communication unit 16 , and a processing unit 17 .

[0018] The communication unit 11 is configured to communicate with the communication module 20 via the CAN 9 .

[0019] The memory unit 12 is configured to store data. The memory unit 12 has a RAM 13 and a non-volatile memory 14. The RAM 13 is configured using, for example, a dynamic random access memory (DRAM) and is configured to temporarily store the processing contents of the central electronic control unit 10. The non-volatile memory 14 is configured using, for example, a flash memory and is configured to store software executed by the central electronic control unit 10 and an encrypted authentication key KB1. The memory areas of the RAM 13 and the non-volatile memory 14 can be accessed from outside the central electronic control unit 10 via the communication unit 11 and the processing unit 17.

[0020] The security module 15 is a so-called HSM (Hardware Security Module) and is configured to store data in a secure memory area. In this example, the security module 15 stores an encryption key KA1. The security module 15 is configured to restrict access from outside the central electronic control unit 10. This allows the security module 15 to protect the stored data so that it cannot be easily rewritten and so that the stored data will not be leaked.

[0021] For example, when a malfunction occurs in the vehicle 9, the external communication unit 16 is configured to communicate with a diagnostic device 30 (described later) using a communication cable.

[0022] The processing unit 17 is configured, for example, using one or more processors, and is configured to control the operation of the central electronic control unit 10 by executing software.

[0023] The communication module 20 includes a communication unit 21 , a storage unit 22 , a security module 25 , a wireless communication unit 26 , and a processing unit 27 .

[0024] The communication unit 21 is configured to communicate with the central electronic control unit 10 via the CAN 9 .

[0025] The storage unit 22 is configured to store data. The storage unit 22 has a RAM 23 and a non-volatile memory 24. The RAM 23 is configured using, for example, a DRAM, and is configured to temporarily store the processing contents of the communication module 20. The non-volatile memory 24 is configured using, for example, a flash memory, and is configured to store software executed by the communication module 20 and an encrypted authentication key KB2. The memory areas of the RAM 23 and the non-volatile memory 24 can be accessed from outside the communication module 20 via the communication unit 21 and the processing unit 27.

[0026] The security module 25 is a so-called HSM, and is configured to store data in a secure memory area. In this example, the security module 25 stores an encryption key KA2. The security module 25 is configured to restrict access from outside the communication module 20. In this way, the security module 25 protects the stored data so that it cannot be easily rewritten and so that the stored data will not be leaked.

[0027] The wireless communication unit 26 is configured to communicate with a base station by performing mobile communication such as 4G or 5G. This allows the wireless communication unit 26 to communicate with a server 40 (described later) connected to the Internet via the base station. The wireless communication unit 26 is configured to download, for example, software updates from the server 40.

[0028] The processing unit 27 is configured using, for example, one or more processors, and is configured to control the operation of the communication module 20 by executing software.

[0029] In this control system 1, the central electronic control unit 10 generates an authentication key KB based on an instruction from the diagnostic device 30. The central electronic control unit 10 then transmits this authentication key KB to the communication module 20. The central electronic control unit 10 encrypts this authentication key KB using an encryption key KA1 to generate an authentication key KB1 and stores this authentication key KB1 in the nonvolatile memory 14. Similarly, the communication module 20 encrypts this authentication key KB using an encryption key KA2 to generate an authentication key KB2 and stores this authentication key KB2 in the nonvolatile memory 24. Thereafter, the central electronic control unit 10 and the communication module 20 are able to perform authentication processing using the authentication keys KB1 and KB2 stored in the nonvolatile memories 14 and 24.

[0030] Here, the central electronic control unit 10 corresponds to a specific example of a "first control device" in an embodiment of the present disclosure. The encryption key KA1 corresponds to a specific example of a "first encryption key" in an embodiment of the present disclosure. The security module 15 corresponds to a specific example of a "first security circuit" in an embodiment of the present disclosure. The memory unit 12 corresponds to a specific example of a "first memory circuit" in an embodiment of the present disclosure. The communication module 20 corresponds to a specific example of a "second control device" in an embodiment of the present disclosure. The encryption key KA2 corresponds to a specific example of a "second encryption key" in an embodiment of the present disclosure. The security module 25 corresponds to a specific example of a "second security circuit" in an embodiment of the present disclosure. The memory unit 22 corresponds to a specific example of a "second memory circuit" in an embodiment of the present disclosure. The authentication key KB corresponds to a specific example of an "authentication key" in an embodiment of the present disclosure. The authentication key KB1 corresponds to a specific example of a "first authentication key" in an embodiment of the present disclosure. Authentication key KB2 corresponds to a specific but not limitative example of a "second authentication key" in an embodiment of the present disclosure.

[0031] [Operation and Function] Next, the operation and function of the control system 1 of this embodiment will be described.

[0032] (Overall Operation Overview) First, the operation of the control system 1 will be described with reference to Figures 1 and 2. In the central electronic control unit 10, the communication unit 11 communicates with the communication module 20 via the CAN 9. The memory unit 12 stores data. The security module 15 stores the data in a secure memory area. The security module 15 stores an encryption key KA1. The external communication unit 16 communicates with the diagnostic device 30 using a communication cable, for example, when a malfunction occurs in the vehicle 9. The processing unit 17 controls the operation of the central electronic control unit 10.

[0033] In the communication module 20, the communication unit 21 communicates with the central electronic control unit 10 via the CAN 9. The memory unit 22 stores data. The security module 25 stores the data in a secure memory area. The security module 25 stores an encryption key KA2. The wireless communication unit 26 communicates with a server 40 connected to the Internet via a base station by performing mobile communication. The wireless communication unit 26 can download, for example, update software from the server 40. The processing unit 27 controls the operation of the communication module 20.

[0034] (Detailed Operation) The operation of the control system 1 will now be described in detail.

[0035] The control system 1 registers the authentication keys KB1 and KB2 used in the authentication process between the central electronic control unit 10 and the communication module 20. This operation will be described in detail below.

[0036] 3 shows an example of a vehicle 9 in which authentication keys KB1 and KB2 are stored. For example, if the vehicle 9 has a malfunction, the owner of the vehicle 9 brings the vehicle 9 to a dealer. In this example, a dealer's technician connects a diagnostic device 30 to the central electronic control unit 10 of the vehicle 9 via a communication cable 8, and the diagnostic device 30 diagnoses the vehicle 9. In this example, the diagnostic device 30 detects a malfunction in the central electronic control unit 10. The dealer's technician replaces the central electronic control unit 10. In this case, the control system 1 registers the authentication keys KB1 and KB2 used in the authentication process between the central electronic control unit 10 and the communication module 20 based on instructions from the diagnostic device 30.

[0037] FIG. 4 shows an example of a registration process for the authentication keys KB1 and KB2 in the control system 1.

[0038] First, the diagnostic device 30 requests the central electronic control unit 10 of the vehicle 9 to register an authentication key (step S101). The external communication section 16 of the central electronic control unit 10 receives this registration request.

[0039] Next, the processing unit 17 of the central electronic control unit 10 generates an authentication key KB based on the authentication key registration request from the diagnostic device 30, and stores this authentication key KB in the RAM 13 (step S102).

[0040] Next, the communication section 11 of the central electronic control unit 10 supplies the authentication key KB generated in step S102 to the communication module 20 (step S103). The communication section 21 of the communication module 20 receives this authentication key KB.

[0041] Then, the processing unit 27 of the communication module 20 stores the received authentication key KB in the RAM 23 (step S104).

[0042] The processing unit 17 of the central electronic control unit 10 generates an authentication key KB1 by encrypting the authentication key KB stored in the RAM 13 using the encryption key KA1 stored in the security module 15, and stores this authentication key KB1 in the non-volatile memory 14 (step S105).

[0043] Then, the processing unit 17 of the central electronic control unit 10 deletes the authentication key KB stored in the RAM 13 (step S106).

[0044] Similarly, the processing unit 27 of the communication module 20 generates an authentication key KB2 by encrypting the authentication key KB stored in RAM 23 using the encryption key KA2 stored in the security module 25, and stores this authentication key KB2 in the non-volatile memory 24 (step S107).

[0045] Then, the processing unit 27 of the communication module 20 deletes the authentication key KB stored in the RAM 23 (step S108).

[0046] This completes the process.

[0047] In this way, the non-volatile memory 14 of the central electronic control unit 10 stores an authentication key KB1 encrypted using the encryption key KA1, and the non-volatile memory 24 of the communication module 20 stores an authentication key KB2 encrypted using the encryption key KA2.

[0048] In the control system 1, the central electronic control unit 10 and the communication module 20 can thereafter use these authentication keys KB1 and KB2 to perform authentication processing. This operation will be described below.

[0049] 5 shows an example of a vehicle 9 when authentication processing using authentication keys KB1 and KB2 is performed. For example, when software for updating software executed in one of the multiple electronic control units 19 is prepared, the communication module 20 of the vehicle 9 downloads the update software from the server 40. The central electronic control unit 10 and communication module 20 of the vehicle 9 then perform authentication processing using authentication keys KB1 and KB2, and if this authentication processing is successful, the central electronic control unit 10 updates the software of the electronic control unit 19 using the update software.

[0050] 6A and 6B show an example of authentication processing using authentication keys KB1 and KB2 in the control system 1.

[0051] First, the server 40 transmits update software to the communication module 20 of the vehicle 9 (step S201). The wireless communication unit 26 of the communication module 20 receives the update software.

[0052] Next, the communication section 21 of the communication module 20 requests authentication from the central electronic control unit 10 (step S202). The communication section 11 of the central electronic control unit 10 receives this authentication request.

[0053] The processing unit 27 of the communication module 20 restricts access to the RAM 23 (step S203), thereby temporarily restricting access to the memory area of ​​the RAM 23 from outside the communication module 20, for example.

[0054] Similarly, the processing unit 17 of the central electronic control unit 10 restricts access to the RAM 13 (step S204), thereby temporarily restricting access to the memory area of ​​the RAM 13 from outside the central electronic control unit 10, for example.

[0055] Next, the processing unit 17 of the central electronic control unit 10 generates random number data including a multi-digit random number, and stores the generated random number data in the RAM 13 (step S205).

[0056] Next, the communication section 11 of the central electronic control unit 10 supplies this random number data to the communication module 20 (step S206). The communication section 11 of the communication module 20 receives this random number data.

[0057] Next, the processing unit 27 of the communication module 20 stores the random number data received in step S206 in the RAM 23 (step S207).

[0058] Next, the processing unit 27 of the communication module 20 generates an authentication key KB21 by decrypting the authentication key KB2 stored in the nonvolatile memory 24 using the encryption key KA2 stored in the security module 25, and stores this authentication key KB21 in the RAM 13 (step S208). This authentication key KB21 is the same as the authentication key KB generated in step S102.

[0059] Then, the processing unit 27 of the communication module 20 uses the decrypted authentication key KB21 to encrypt the random number data stored in the RAM 23 in step S207 (step S209).

[0060] Similarly, the processing unit 17 of the central electronic control unit 10 generates an authentication key KB11 by decrypting the authentication key KB1 stored in the nonvolatile memory 14 using the encryption key KA1 stored in the security module 15, and stores this authentication key KB11 in the RAM 13 (step S210). This authentication key KB11 is the same as the authentication key KB generated in step S102.

[0061] Then, the processing unit 17 of the central electronic control unit 10 uses the decrypted authentication key KB11 to encrypt the random number data stored in the RAM 13 in step S205 (step S211).

[0062] Next, the communication section 11 of the communication module 20 supplies the random number data encrypted in step S209 to the central electronic control unit 10 (step S212). The communication section 11 of the central electronic control unit 10 receives this encrypted random number data.

[0063] Next, the processing unit 17 of the central electronic control unit 10 performs authentication processing by comparing the random number data encrypted in step S211 with the encrypted random number data received from the communication module 20 in step S212 (step S213). That is, if these random number data are the same, this means that the authentication key KB21 used in the communication module 20 and the authentication key KB11 used in the central electronic control unit 10 are the same, and the processing unit 17 can perform authentication processing by comparing these random number data.

[0064] If the authentication process is successful, the communication unit 11 of the central electronic control unit 10 notifies the communication module 20 that the software update is permitted (step S214). The communication unit 11 of the communication module 20 receives this notification of the update permission.

[0065] Next, the processing unit 27 of the communication module 20 deletes the authentication key KB21 and the random number data stored in the RAM 23 (step S215). Then, the processing unit 27 of the communication module 20 releases the access restriction on the RAM 23 imposed in step S203 (step S216). As a result, for example, access to the memory area of ​​the RAM 23 from outside the communication module 20 is permitted.

[0066] Similarly, the processing unit 17 of the central electronic control unit 10 deletes the authentication key KB11 and the random number data stored in the RAM 13 (step S217). Then, the processing unit 17 of the central electronic control unit 10 releases the access restriction on the RAM 13 imposed in step S204 (step S218). As a result, for example, access to the memory area of ​​the RAM 13 from outside the central electronic control unit 10 is permitted.

[0067] Next, the communication section 21 of the communication module 20 supplies the update software received in step S201 to the central electronic control unit 10 (step S219). The communication section 11 of the central electronic control unit 10 receives this update software.

[0068] Then, the processing unit 17 of the central electronic control unit 10 updates the software of the electronic control unit 19 to be updated using the update software received in step S220 (step S220).

[0069] This completes the process. Here, authentication key KB11 corresponds to a specific example of a "third authentication key" in an embodiment of the present disclosure. Authentication key KB21 corresponds to a specific example of a "fourth authentication key" in an embodiment of the present disclosure.

[0070] As described above, the control system 1 includes the central electronic control unit 10 having a first security circuit (security module 15) in which a first encryption key (encryption key KA1) is stored and in which external access is restricted, and a first memory circuit (memory unit 12), and the communication module 20 having a second security circuit (security module 25) in which a second encryption key (encryption key KA2) is stored and in which external access is restricted, and a second memory circuit (memory unit 22). The central electronic control unit 10 is capable of generating an authentication key KB used in authentication processing between the central electronic control unit 10 and the communication module 20, and is capable of generating a first authentication key (authentication key KB1) by encrypting the authentication key KB with the first encryption key (encryption key KA1), and is capable of storing the first authentication key (authentication key KB1) in the first memory circuit (memory unit 12). The central electronic control unit 10 is capable of supplying the generated authentication key KB to the communication module 20. The communication module 20 is capable of generating a second authentication key (authentication key KB2) by encrypting the authentication key KB supplied from the central electronic control unit 10 with a second encryption key (encryption key KA2), and is capable of storing the second authentication key (authentication key KB2) in a second memory circuit (memory unit 22). This makes it possible to improve security and convenience at the same time.

[0071] That is, in order to enhance security, a method may be used in which the generated authentication key is stored in security module 15, 25. In this case, for example, in order for diagnostic device 30 to store the authentication key in security module 15, it is necessary to use encryption key KA1 stored in security module 15. Therefore, diagnostic device 30 needs to store this encryption key KA1. That is, diagnostic device 30 needs to manage encryption keys KA1 for multiple vehicles 9, which increases management costs and reduces convenience.

[0072] On the other hand, in the control system 1 according to the present embodiment, instead of storing the authentication key in the security module 15, the authentication key KB is encrypted using the encryption key KA1 stored in the security module 15 to generate the authentication key KB1, and this authentication key KB1 is stored in the storage unit 12. Similarly, in the control system 1, the authentication key KB is encrypted using the encryption key KA2 stored in the security module 25 to generate the authentication key KB2, and this authentication key KB2 is stored in the storage unit 22. This eliminates the need for the diagnostic device 30 to store the encryption keys KA1 and KA2, thereby reducing management costs and improving convenience.

[0073] In the control system 1, the central electronic control unit 10 can temporarily store the generated authentication key (authentication key KB) in the first storage circuit (storage unit 12), and after storing the first authentication key (authentication key KB1) in the first storage circuit (storage unit 12), can delete the authentication key (authentication key KB) stored in the first storage circuit (storage unit 12). The communication module 20 can temporarily store the authentication key (authentication key KB) supplied from the central electronic control unit 10 in the second storage circuit (storage unit 22), and after storing the second authentication key (authentication key KB2) in the second storage circuit (storage unit 22), can delete the authentication key (authentication key KB) stored in the second storage circuit (storage unit 22). As a result, in the control system 1, the memory unit 12 stores the encrypted authentication key KB1 while deleting the unencrypted authentication key KB, and the memory unit 22 stores the encrypted authentication key KB2 while deleting the unencrypted authentication key KB, thereby improving security.

[0074] Furthermore, in the control system 1, the central electronic control unit 10 is able to generate the authentication key KB based on instructions from the diagnostic device 30. That is, for example, if the central electronic control unit 10 breaks down, the authentication key KB is generated based on instructions from the diagnostic device 30. This allows the authentication key KB to be generated again without continuing to use the previous authentication key KB, thereby improving security.

[0075] Furthermore, in the control system 1, the central electronic control unit 10 can generate a third authentication key (authentication key KB11) by decrypting the first authentication key (authentication key KB1) using the first encryption key (encryption key KA1) and can perform a first process based on the third authentication key (authentication key KB11). Furthermore, the communication module 20 can generate a fourth authentication key (authentication key KB21) by decrypting the second authentication key (authentication key KB2) using the second encryption key (encryption key KA2) and can perform a second process based on the fourth authentication key (authentication key KB21). The central electronic control unit 10 and the communication module 20 perform authentication processes by performing the first process and the second process. This improves security because, for example, if the authentication key KB11 and the authentication key KB21 are the same, the authentication process is successful and a predetermined process can be performed if the authentication process is successful.

[0076] [Effects] As described above, this embodiment includes a central electronic control unit having a first security circuit in which a first encryption key is stored and external access is restricted, and a first storage circuit; and a communication module having a second security circuit in which a second encryption key is stored and external access is restricted, and a second storage circuit. The central electronic control unit is capable of generating an authentication key used in authentication processing between the central electronic control unit and the communication module, and is capable of generating the first authentication key by encrypting the authentication key with the first encryption key and storing the first authentication key in the first storage circuit. The central electronic control unit is capable of supplying the generated authentication key to the communication module. The communication module is capable of generating a second authentication key by encrypting the authentication key supplied from the central electronic control unit with the second encryption key and storing the second authentication key in the second storage circuit. This improves security and convenience.

[0077] In this embodiment, the central electronic control unit can temporarily store the generated authentication key in a first storage circuit, and after storing the first authentication key in the first storage circuit, can delete the authentication key stored in the first storage circuit. The communication module can temporarily store the authentication key supplied from the central electronic control unit in a second storage circuit, and after storing the second authentication key in the second storage circuit, can delete the authentication key stored in the second storage circuit. This can improve security.

[0078] In this embodiment, the central electronic control unit is able to generate an authentication key based on an instruction from the diagnostic device, thereby improving security.

[0079] In this embodiment, the central electronic control unit can generate a third authentication key by decrypting the first authentication key using the first encryption key, and can perform a first process based on the third authentication key. The communication module can generate a fourth authentication key by decrypting the second authentication key using the second encryption key, and can perform a second process based on the fourth authentication key. The central electronic control unit and the communication module then perform authentication processes by performing the first process and the second process. This can improve security.

[0080] Although an example of an embodiment of the present disclosure has been described above with reference to the accompanying drawings, the present disclosure is by no means limited to the above embodiment. Those skilled in the art will understand that various modifications and variations can be made without departing from the scope defined by the appended claims. The present disclosure is intended to encompass such modifications and variations to the extent that they fall within the scope of the appended claims and their equivalents.

[0081] For example, in the above embodiment, authentication processing is performed using the method shown in Figures 6A and 6B, but this is not limited to this, and any authentication method using authentication key KB1 stored in memory 22 of central electronic control unit 10 and authentication key KB2 stored in memory 22 of communication module 20 may be used.

[0082] For example, in the above embodiment, the central electronic control unit 10 and the communication module 20 perform the authentication processing, but this is not limited to this, and various other circuits in the vehicle 9 may perform the authentication processing.

[0083] For example, in the above embodiment, the present technology is applied to the vehicle 9, but is not limited to this and may be applied to a vehicle other than the vehicle 9.

[0084] The effects described in this specification are merely examples, and the effects of the present disclosure are not limited to the effects described in this specification. Therefore, other effects may be obtained with respect to the present disclosure.

[0085] Furthermore, the present disclosure may take the following aspects.

[0086] (1) A control system comprising: a first control device having a first security circuit in which a first encryption key is stored and in which external access is restricted, and a first storage circuit; and a second control device having a second security circuit in which a second encryption key is stored and in which external access is restricted, and a second storage circuit, wherein the first control device is capable of generating an authentication key used in authentication processing between the first control device and the second control device, is capable of generating the first authentication key by encrypting the authentication key with the first encryption key, and is capable of storing the first authentication key in the first storage circuit; the first control device is capable of supplying the generated authentication key to the second control device; and the second control device is capable of generating a second authentication key by encrypting the authentication key supplied from the first control device with the second encryption key, and is capable of storing the second authentication key in the second storage circuit. (2) The control system according to (1), wherein the first control device is capable of temporarily storing the generated authentication key in the first storage circuit, and after storing the first authentication key in the first storage circuit, is capable of deleting the authentication key stored in the first storage circuit, and the second control device is capable of temporarily storing the authentication key supplied from the first control device in the second storage circuit, and after storing the second authentication key in the second storage circuit, is capable of deleting the authentication key stored in the second storage circuit. (3) The control system according to (1) or (2), wherein the first control device is capable of generating the authentication key based on an instruction from an external device.(4) The control system according to any one of (1) to (3), wherein the first control device is capable of generating a third authentication key by decrypting the first authentication key using the first encryption key and is capable of performing a first process based on the third authentication key, the second control device is capable of generating a fourth authentication key by decrypting the second authentication key using the second encryption key and is capable of performing a second process based on the fourth authentication key, and the first control device and the second control device perform the first process and the second process to perform the authentication process. (5) A vehicle comprising the control system according to any one of (1) to (4), wherein the first control device includes an electronic control unit that controls the vehicle.

[0087] The processing unit 17 shown in FIG. 2 can be implemented by circuitry including at least one semiconductor integrated circuit, such as at least one processor (e.g., a central processing unit (CPU)), at least one application-specific integrated circuit (ASIC), and / or at least one field-programmable gate array (FPGA). The at least one processor can be configured to perform all or a portion of the various functions of the processing unit 17 shown in FIG. 2 by reading instructions from at least one non-transitory, tangible computer-readable medium. Such media can take various forms, including, but not limited to, various magnetic media such as hard disks, various optical media such as CDs or DVDs, and various semiconductor memories (i.e., semiconductor circuits) such as volatile or non-volatile memories. Volatile memories can include DRAM and SRAM. Non-volatile memories can include ROM and NVRAM. An ASIC is an integrated circuit (IC) specialized to perform all or a portion of the various functions of the processing unit 17 shown in FIG. 2. An FPGA is an integrated circuit designed to be configurable after manufacture to perform all or a portion of the various functions of the processing unit 17 shown in FIG. 2. Although the processing unit 17 has been described above as an example, the present invention is not limited to this, and the same applies to the processing unit 27.

Claims

1. a first control device having a first security circuit in which a first encryption key is stored and in which external access is restricted, and a first storage circuit; a second control device having a second security circuit in which a second encryption key is stored and in which external access is restricted, and a second storage circuit; Equipped with the first control device is capable of generating an authentication key to be used in an authentication process between the first control device and the second control device based on an instruction from an external device, and is capable of supplying the generated authentication key to the second control device; the first control device is capable of generating a first authentication key by encrypting the authentication key with the first encryption key, and is capable of storing the first authentication key in the first storage circuit; The second control device is capable of generating a second authentication key by encrypting the authentication key supplied from the first control device with the second encryption key, and is capable of storing the second authentication key in the second storage circuit. Control system.

2. the first control device is capable of temporarily storing the generated authentication key in the first storage circuit, and after storing the first authentication key in the first storage circuit, is capable of deleting the authentication key stored in the first storage circuit; The second control device is capable of temporarily storing the authentication key supplied from the first control device in the second storage circuit, and is capable of deleting the authentication key stored in the second storage circuit after storing the second authentication key in the second storage circuit. The control system of claim 1 .

3. the first control device is capable of generating a third authentication key by decrypting the first authentication key using the first encryption key, and is capable of performing a first process based on the third authentication key; the second control device is capable of generating a fourth authentication key by decrypting the second authentication key using the second encryption key, and is capable of performing a second process based on the fourth authentication key; The first control device and the second control device perform the first process and the second process, thereby performing the authentication process. The control system of claim 1 .

4. A control system according to any one of claims 1 to 3, The first control device includes an electronic control unit that controls a vehicle. vehicle.

Images