Management system, controller, key generation method, control method, and program

Abstract

This management system includes a request reception unit and a generation unit. The request reception unit receives, from a controller, charging device identification information pertaining to a charging device connected to the controller. On the basis of the charging device identification information, the generation unit generates a key for decrypting encrypted data of a software program for the controller to control the charging device.

Description

Management system, controller, key generation method, control method, and recording medium

[0001] The present disclosure relates to a management system and the like.

[0002] Charging devices that charge batteries of electric vehicles are installed in various locations. For example, Patent Literature 1 describes that a management server registers and manages, for each charging spot, a control device that belongs to the charging spot and the charging device controlled by the control device.

[0003] Japanese Patent Application Laid-Open No. 2015-165765 Japanese Patent Application Laid-Open No. 2022-522607

[0004] Incidentally, there is a possibility that charging spots will be operated unmanned. In this case, the controller that controls the charging equipment may be stolen. This may result in, for example, the leakage of software programs that the controller runs to control the charging equipment.

[0005] An example of an objective of the present disclosure is to provide a management system or the like that prevents leakage of software programs of controllers that control charging equipment for charging rechargeable batteries installed in electric vehicles or the like.

[0006] A management system in one aspect of the present disclosure includes a request receiving means for receiving charging device identification information of a charging device connected to a controller from the controller, and a generating means for generating a key based on the charging device identification information to decrypt data encrypted by a software program for the controller to control the charging device.

[0007] In one aspect of the present disclosure, the controller is capable of communicating with the management system and controls a connected charging device, and includes: a charging device information acquisition means for acquiring charging device identification information that identifies the charging device from the charging device; a request sending means for sending the acquired charging device identification information to the management system; and a data receiving means for receiving from the management system data that is encrypted data that is a software program that controls the charging device and can be decrypted using a key generated by the charging device identification information.

[0008] A key generation method in one aspect of the present disclosure receives charging device identification information of a charging device connected to a controller from the controller, and generates a key based on the charging device identification information to decrypt encrypted data by a software program used by the controller to control the charging device.

[0009] In one aspect of the control method of the present disclosure, a controller capable of communicating with a management system and controlling a connected charging equipment acquires charging equipment identification information that identifies the charging equipment from the charging equipment, transmits the acquired charging equipment identification information to the management system, and receives from the management system data that is encrypted data that is a software program that controls the charging equipment and can be decrypted using a key generated by the charging equipment identification information.

[0010] A program in one aspect of the present disclosure causes a computer to receive charging device identification information of a charging device connected to a controller from the controller, and, based on the charging device identification information, generate a key for decrypting encrypted data used by a software program for the controller to control the charging device.

[0011] A program in one aspect of the present disclosure is capable of communicating with a management system and causes a controller that controls a connected charging device to receive charging device identification information of the charging device connected to the controller from the controller, and based on the charging device identification information, cause the controller to execute a process of generating a key to decrypt encrypted data using a software program for controlling the charging device.

[0012] Each program may be stored in a non-transitory computer-readable recording medium.

[0013] According to the present disclosure, it is possible to prevent leakage of software programs that run on controllers that control charging equipment for charging rechargeable batteries installed in electric vehicles and the like.

[0014] 14 is a first block diagram showing an example configuration of a management system according to the present disclosure. FIG. 15 is a flowchart showing an example operation of the management system according to the present disclosure. FIG. 16 is a first block diagram showing an example configuration of a controller according to the present disclosure. FIG. 17 is a flowchart showing an example operation of the controller according to the present disclosure. FIG. 18 is an explanatory diagram showing an example connection between a management system and a controller. FIG. 19 is an explanatory diagram showing in a simplified manner a series of operations in a provisioning phase and an operation phase. FIG. 19 is a second block diagram showing an example configuration of a management system according to the present disclosure. FIG. 19 is a second block diagram showing an example configuration of a controller according to the present disclosure. FIG. 19 is an explanatory diagram showing an example storage of a charging device DB. FIG. 19 is an explanatory diagram showing an example storage of a controller association DB. FIG. 19 is a sequence diagram showing an example operation related to generation of a shared key in the provisioning phase. FIG. 19 is a sequence diagram showing an example operation related to downloading of an encrypted software program in the provisioning phase. FIG. 19 is a flowchart simply explaining the overall operation in the operation phase. FIG. 19 is a flowchart simply explaining the decryption process shown in FIG. 13. FIG. 19 is an explanatory diagram showing an example screen of a terminal device of an LOB administrator. FIG. 19 is a sequence diagram showing an example operation 1 related to distribution of a shared key when a change in connection status in the operation phase is detected. FIG. 19 is a sequence diagram showing an example operation when a request to transmit a shared key is divided into a connection status confirmation request and a key request. Fig. 1 is a sequence diagram showing an operation example 2 related to distribution of a common key when a change in connection status in the operation phase is detected. Fig. 2 is a sequence diagram showing an operation example related to distribution of a common key when it is detected that there is no change in the connection status in the operation phase. Fig. 3 is a sequence diagram showing an operation example when a request to transmit a common key is divided into a connection status confirmation request and a key request. Fig. 4 is an explanatory diagram showing an example of the hardware configuration of a computer.

[0015] Hereinafter, with reference to the drawings, embodiments of a management system, a controller, a key generation method, a key distribution method, a control method, a program, and a non-transitory recording medium for recording the program according to the present disclosure will be described in detail. The disclosed technology is not limited to these embodiments.

[0016] (Embodiment 1) First, in embodiment 1, an example of basic functions of a management system will be described. Fig. 1 is a first block diagram showing an example configuration of a management system according to the present disclosure. A management system 10 manages a controller 11 installed at an installation location and charging devices connected to the controller 11.

[0017] In FIG. 1, the management system 10 includes a request receiving unit 101 and a generating unit 102 .

[0018] The request receiving unit 101 receives, from the controller 11, charging device identification information of a charging device connected to the controller 11. Here, the controller 11 executes a software program distributed by the management system 10 to control the charging device. The charging device identification information is not particularly limited as long as it can uniquely identify the charging device. For example, the charging device identification information may be the serial number of the charging device. Note that the request receiving unit 101 may receive the charging device identification information and the controller identification information from the controller 11. The controller identification information is not particularly limited as long as it can uniquely identify the controller 11. The controller identification information may be the serial number of the controller 11. Here, when multiple charging devices are connected to the controller 11, the request receiving unit 101 receives the charging device identification information of each of the multiple charging devices from the controller 11.

[0019] Then, generation unit 102 generates a key for decrypting data encrypted by a software program for controller 11 to control the charging device, based on the charging device identification information received by request reception unit 101. Here, when request reception unit 101 receives multiple pieces of charging device identification information from controller 11, generation unit 102 generates a key for decrypting encrypted data based on the multiple pieces of charging device identification information.

[0020] Here, the key is a key for the controller 11 identified by the controller identification information. The key may be, for example, a common key, and is not particularly limited. The specific generation method is not particularly limited. For example, as a generation method, the generation unit 102 may generate a hash value of the charging device identification information received by the request receiving unit 101 as the key. Note that in the case of a common key, the software program used by the controller 11 to control the charging device is encrypted using the generated key.

[0021] 2 is a flowchart showing an example of an operation of the management system 10 according to the present disclosure. The request receiving unit 101 receives, from the controller 11, the charging device identification information of the charging device connected to the controller 11 (step S101).

[0022] Then, based on the charging device identification information, generation unit 102 generates a key for decrypting data encrypted by a software program used by controller 11 to control the charging device (step S102). Here, if request receiving unit 101 receives multiple pieces of charging device identification information in step S101, generation unit 102 generates a key for decrypting the encrypted data based on the multiple pieces of charging device identification information in step S102. Management system 10 ends the series of processes.

[0023] 3 is a first block diagram showing an example of the configuration of the controller 11 according to the present disclosure. The controller 11 controls the charging device connected to the controller 11 itself.

[0024] In FIG. 3 , the controller 11 includes a charging device information acquisition unit 121 , a request transmission unit 122 , and a data reception unit 123 .

[0025] The charging equipment information acquisition unit 121 acquires charging equipment identification information that identifies the charging equipment from the charging equipment connected to its own controller 11. Here, the charging equipment identification information is not particularly limited as long as it can uniquely identify the charging equipment. For example, the charging equipment identification information may be the serial number of the charging equipment. Specifically, for example, the charging equipment information acquisition unit 121 transmits a transmission request for charging equipment identification information to the charging equipment connected to the controller 11. Then, upon receiving the transmission request from the controller 11, the charging equipment transmits charging equipment identification information that identifies its own charging equipment to the controller 11. Then, the charging equipment identification information that identifies the charging equipment is received from the charging equipment connected to its own controller 11.

[0026] Then, for example, the request sending unit 122 sends the charging equipment identification information acquired by the charging equipment information acquisition unit 121 to the management system 10. Here, the request sending unit 122 may send the charging equipment identification information and controller identification information that identifies its own controller 11 to the management system 10. Specifically, for example, in order to register a charging equipment connected to the controller 11, the request sending unit 122 may send the charging equipment identification information as an association request that associates the charging equipment identification information with the controller identification information that identifies its own controller 11.

[0027] The data receiving unit 123 receives encrypted data from the management system 10. Here, the encrypted data is data in which a software program that controls the charging device is encrypted, and is data that can be decrypted using a key generated based on the charging device identification information.

[0028] 4 is a flowchart showing an example of an operation of the controller 11 according to the present disclosure. The charging device information acquisition unit 121 acquires charging device identification information for identifying the charging device from the connected charging device (step S111). Here, if multiple charging devices are connected to the controller 11, the charging device information acquisition unit 121 acquires charging device identification information from each of the multiple charging devices.

[0029] Then, for example, the request sending unit 122 sends the charging device identification information acquired by the charging device information acquisition unit 121 to the management system 10 (step S112). Here, if multiple charging devices are connected to the controller 11, the request sending unit 122 sends the multiple pieces of charging device identification information acquired by the charging device information acquisition unit 121 to the management system 10.

[0030] The data receiving unit 123 receives the encrypted data from the management system 10 (step S113). The controller 11 then ends the series of processes.

[0031] There is a possibility that charging spots will be operated unmanned. In this case, the controller that controls the charging equipment may be stolen. However, when a controller 11 is stolen, it is time-consuming to repeatedly check charging equipment identification information, such as the serial number of the charging equipment connected to the controller 11. For this reason, it is thought that a thief will not perform such checking when stealing the controller 11. Therefore, the management system 10 generates a key for decrypting encrypted data of the software program used by the controller 11 to control the charging equipment, based on the charging equipment identification information that identifies the charging equipment connected to the controller 11. This makes it possible to use a key that is difficult to identify as the key for decrypting the encrypted data. Therefore, it is possible to prevent the leakage of the software program of the controller 11 that controls the charging equipment that charges the rechargeable battery of an electric vehicle.

[0032] The controller 11 acquires charging device identification information that identifies the charging device from the connected charging device and transmits the acquired charging device identification information to the management system 10. The controller 11 then receives from the management system 10 encrypted data that is a software program that controls the charging device and that can be decrypted using a key generated using the transmitted charging device identification information. Therefore, the controller 11 transmits information necessary for managing the connection relationship between the controller 11 and the charging device to the management system 10, while having the management system 10 generate a key for decrypting the encrypted data. This makes it possible to prevent theft and leakage of the software program of the controller 11 using a simple mechanism.

[0033] (Second Embodiment) Next, a second embodiment will be described in detail with reference to the drawings. In the second embodiment, the overall operation of the management system and the controller will be described in more detail. In particular, in the second embodiment, the provisioning phase and the operation phase will be described in detail. Furthermore, the key used to decrypt the encrypted software program executed by the controller is not particularly limited, but in the second embodiment, a common key will be used as an example. Below, to the extent that the description of the second embodiment is not unclear, description of content that overlaps with the above description will be omitted.

[0034] FIG. 5 is an explanatory diagram showing an example of a connection between a management system and a controller. For example, the management system 20 is realized on a cloud. For example, the management system 20 is connected to a system administrator's terminal device 23 via a communication network. In FIG. 5 , the type of the system administrator's terminal device 23 is not particularly limited, and may be a personal computer (PC), a smartphone, a tablet device, or the like. Note that the system administrator's terminal device 23 may be pre-installed with an application program that can transmit information to the management system 20 and output information from the management system 20. The system administrator's terminal device 23 may be pre-installed with an application program that can transmit information to the controller 21 and output information from the controller 21.

[0035] Furthermore, the controller 21 and the charging device 22 are installed at an installation location where the charging device 22 is actually installed. The installation location is, for example, a facility. The facility is not particularly limited to a residence, a store, a school, an entertainment facility, etc. More specifically, for example, the installation location is not particularly limited to a condominium parking lot, a large shopping mall parking lot, a university facility parking lot, an amusement park parking lot, etc.

[0036] Furthermore, the controller 21 is connected to one or more chargers 22 and controls the operation of the one or more chargers 22. In other words, the controller 21 is an edge terminal device. Furthermore, a plurality of controllers 21 may be installed at the installation location, and one or more chargers 22 may be connected to each controller 21. The method of connection between the controller 21 and the chargers 22 may be wired or wireless, and is not particularly limited.

[0037] 5, controller 21-A and controller 21-B are shown as examples. Chargers 22-1 to 22-3 are connected to controller 21-A. Chargers 22-4 to 22-6 are connected to controller 21-B. In the following description, when a controller is not particularly specified, it will be referred to as controller 21, and when a charger is not particularly specified, it will be referred to as charger 22.

[0038] The controller 21 may also be connected to a terminal device of a line of business (LOB) manager via a communication network. In FIG. 5 , the type of the LOB manager's terminal device 24 is not particularly limited, and may be a PC, a smartphone, a tablet device, or the like. The LOB manager's terminal device 24 may have an application program pre-installed thereon that can transmit information to the management system 20 and output information from the management system 20. The LOB manager's terminal device 24 may have an application program pre-installed that can transmit information to the controller 21 and output information from the controller 21.

[0039] The communication network at the installation site and the communication network on the cloud side may be connected by a base-to-base Virtual Private Network (VPN). For example, the communication network at the installation site is connected to the Internet via a VPN router, and the communication network on the cloud side is connected to the Internet via a VPN router.

[0040] 6 is an explanatory diagram simply showing a series of operations in the provisioning phase and the operation phase. For example, in the provisioning phase as shown in (1), the management system 20 generates a unique common key when registering the controller 21. In FIG. 6, the management system 20 generates a common key A for the controller 21-A, a common key B for the controller 21-B, and a common key C for the controller 21-C.

[0041] Then, in the operation phase as shown in (2), the controller 21 downloads the common key from the management system 20 and decrypts the encrypted software program every time the power is turned on. Then, the controller 21 discards the common key.

[0042] 7 is a second block diagram showing a configuration example of the management system 20 according to the present disclosure. The management system 20 includes a request receiving unit 201, a generating unit 202, an encrypting unit 203, a registering unit 204, a detecting unit 211, a data transmitting unit 212, a notifying unit 213, and a permission accepting unit 214.

[0043] The request receiving unit 201 may have the basic function of the function of the request receiving unit 101 shown in Fig. 1. Furthermore, the generation unit 202 may have the basic function of the function of the generation unit 102 shown in Fig. 1.

[0044] 8 is a second block diagram showing a configuration example of the controller 21 according to the present disclosure. The management system 20 includes a charging device information acquisition unit 221, a request transmission unit 222, a data reception unit 223, a decryption unit 224, a deletion unit 225, a controller information acquisition unit 226, and a stopping unit 227.

[0045] The basic function of the charging equipment information acquisition unit 221 may be the function of the charging equipment information acquisition unit 121 shown in Fig. 1. The basic function of the request transmission unit 222 may be the function of the request transmission unit 122 shown in Fig. 1. The basic function of the data reception unit 223 may be the function of the data reception unit 123 shown in Fig. 1.

[0046] Each functional unit will be explained separately for the provisioning phase and the operation phase.

[0047] (Provisioning Phase) First, in the provisioning phase, the controller 21 is registered when the controller 21 is installed. Furthermore, in the provisioning phase, information on the charger 22 connected to the controller 21 is registered. At this time, in the provisioning phase, a common key for the software program, which is an encrypted software program running on the controller 21, is generated.

[0048] First, the request sending unit 222 of the controller 21 sends a registration request to register the controller to the management system 20 in response to an operation by the system administrator. The registration request includes controller identification information. The controller identification information is not particularly limited as long as it is information that can uniquely identify the controller 21. For example, the controller identification information may be the serial number of the controller 21. The registration request may include the controller identification information and a certificate for the controller 21. Note that each request may also include a certificate for the requestor.

[0049] As an example of transmitting a registration request, first, the system administrator operates the terminal device 23 to log in to the controller 21. Then, for example, the controller 21 request transmission unit 222 may transmit the registration request by transmitting a registration API (Application Programming Interface) of the controller 21 to the management system 20 through the system administrator's operation via the terminal device 23 of the system administrator.

[0050] Next, the request receiving unit 201 of the management system 20 receives the registration request including the controller identification information. Then, the registration unit 204 registers the controller identification information included in the registration request in a controller DB (Database). This allows the management system 20 to know the controller 21 to be managed. Then, when the registration of the controller 21 is completed, the notification unit 213 transmits a registration completion notification to the controller 21 that sent the registration request.

[0051] Next, the charger information acquisition unit 221 of the controller 21 acquires charger identification information that identifies the charger 22 from the charger 22 connected to the controller itself. Here, the charger identification information is not particularly limited as long as it can uniquely identify the charger 22. For example, the charger identification information may be the serial number of the charger 22. Specifically, the charger information acquisition unit 221 transmits a transmission request for the charger identification information to the charger 22 connected to the controller 21. Then, upon receiving the transmission request from the controller 21, the charger 22 transmits charger identification information that identifies its own charger to the controller 21. Then, the charger identification information that identifies the charger 22 is received from the connected charger 22. Note that when multiple chargers 22 are connected to the controller 21, the charger information acquisition unit 221 acquires charger identification information from each of the multiple chargers 22.

[0052] Then, the request sending unit 222 sends charging equipment identification information that identifies the connected charger 22 and controller identification information that identifies its own controller to the management system 20. Note that if multiple chargers are connected to the controller 21, the request sending unit 222 sends the multiple pieces of charging equipment identification information acquired by the charging equipment information acquisition unit 221 to the management system 10. Specifically, for example, the request sending unit 222 sends an association request to the management system 20 that associates the charging equipment identification information that identifies the charger 22 connected to its own controller with the controller identification information that identifies its own controller. The association request is, for example, a request by the system administrator to register the connection status between the controller 21 and the charger 22. Note that the registration request and the association request described above may be a single request.

[0053] Next, the request receiving unit 201 of the management system 20 receives, from the controller 21, the charging device identification information and the controller identification information of the charging device 22 connected to the controller 21. Specifically, for example, the request sending unit 222 receives, from the controller 21, an association request including the charging device identification information and the controller identification information of the charging device 22 connected to the controller 21.

[0054] The registration unit 204 registers the charging device identification information and the controller identification information included in the association request in the charging device DB 2001 .

[0055] FIG. 9 is an explanatory diagram showing an example of storage in the charging device DB 2001. The charging device DB 2001 stores a controller ID (IDentifier) ​​and a charging device ID in association with each other for each controller 21. In FIG. 9 , the controller ID is an example of controller identification information, and the charging device ID is an example of charging device identification information. For example, three charging devices 22 identified by charging device IDs "EVC001," "EVC002," and "EVC003" are connected to the controller 21 identified by the controller ID "C002." For example, three charging devices 22 identified by charging device IDs "EVC004," "EVC005," and "EVC006" are connected to the controller 21 identified by the controller ID "C002."

[0056] The generation unit 202 of the management system 20 generates a common key for the encrypted software program used by the controller 21 to control the charger 22. The common key may be, for example, a common key unique to the controller 21.

[0057] For example, the generation unit 202 may generate a common key based on the charging device identification information received by the request reception unit 201. When the request reception unit 201 receives a plurality of pieces of charging device identification information, the generation unit 202 generates a key for decrypting encrypted data based on the plurality of pieces of charging device identification information.

[0058] Here, when stealing controller 21, it is unlikely that charging device identification information, such as the serial number of chargers 22 connected to controller 21, would be checked sequentially. Therefore, for example, generation unit 202 of management system 20 may generate a common key for controller 21, which is the requestor of the association request, based on charging device identification information included in the association request received by request receiving unit 201. Therefore, a simple mechanism can be used to prevent theft of software programs for controller 21. In particular, when managing the connection relationship between controller 21 and chargers 22, management system 20 receives, from controller 21, charging device identification information that identifies chargers 22 connected to controller 21. In this way, management system 20 generates a common key using the information received for management purposes. Therefore, a simple mechanism can be used to prevent theft of software programs for controller 21.

[0059] Furthermore, for example, the generation unit 202 may generate a common key based on the controller identification information received by the request receiving unit 201. When managing the connection relationship between the controller 21 and the charger 22, the management system 20 receives, from the controller 21, charging equipment identification information that identifies the controller 21. In this way, the management system 20 generates a common key using the information received for management purposes. Therefore, a simple mechanism can be used to prevent theft of a software program for the controller 21. Furthermore, for example, the generation unit 202 of the management system 20 may generate a common key based on the controller identification information and charging equipment identification information received by the request receiving unit 201. As a result, when managing the connection relationship between the controller 21 and the charger 22, the management system 20 associates and registers the controller identification information and the charging equipment identification information. In this way, the management system 20 generates a common key using the information received for management purposes. Therefore, a simple mechanism can be used to prevent theft of a software program for the controller 21.

[0060] The specific method for generating the common key is not particularly limited as long as an existing technology is used. For example, as a method for generating the common key, the generation unit 202 may generate a hash value of the identification information of the connected charging device as the common key. Alternatively, for example, the generation unit 202 may generate the common key by a logical operation such as an exclusive OR of the identification information of the connected charging device.

[0061] Furthermore, other information may be used to generate the common key. The other information is not particularly limited. For example, it is time-consuming to sequentially check the controller identification information that identifies multiple controllers 21 in the same area. For this reason, it is thought that a thief would not perform such checking when stealing a controller 21. Therefore, for example, controller identification information that identifies other controllers 21 in the same area as the requesting controller 21 may be used to generate the common key. The area here may be, for example, within the same LAN (Local Area Network).

[0062] Specifically, for example, the controller information acquisition unit 226 of the controller 21 acquires controller identification information that identifies other controllers 21 that are in the same area as the controller itself. For example, the controller information acquisition unit 226 acquires controller identification information that identifies other controllers 21 that are in the same area by exchanging messages for collecting information. For example, the exchange of messages for collecting information is information exchange using IGMP (Internet Group Management Protocol). Here, IGMP is a protocol for managing a group of hosts when performing multicast, which efficiently transmits the same data to multiple hosts on an IP (Internet Protocol) network.

[0063] Next, the request sending unit 222 sends to the management system 20 an association request that associates the controller identification information that identifies the controller 21 with the controller identification information that identifies another controller 21 that is in the same area as the controller 21. Note that the association request that requests registration of being in the same area may be made at the same timing as the association request that requests registration of the connection relationship between the controller 21 and the charger 22 described above.

[0064] The request receiving unit 201 of the management system 20 receives the association request from the controller 21 .

[0065] The registration unit 204 of the management system 20 then associates and registers the controller identification information that identifies the controller 21 that has issued the association request with the controller identification information that identifies the other controllers 21 that are in the same area as the requesting controller 21. Specifically, for example, the registration unit 204 associates and registers each piece of controller identification information included in the association request in the controller association DB 2002.

[0066] Fig. 10 is an explanatory diagram showing an example of storage in the controller association DB 2002. The controller association DB 2002 stores, for each area, controller identification information within the area. More specifically, for example, the controller association DB 2002 associates and stores area identification information that identifies an area with controller identification information that identifies a controller 21 within the same area. In Fig. 10, an area ID is an example of area identification information, and a controller ID is an example of charging device identification information.

[0067] The generation unit 202 of the management system 20 may generate a common key for the requesting controller 21 based on controller identification information that identifies the controller 21 that requested the association request and controller identification information that identifies other controllers 21 that are located in the same area as the requesting controller 21.

[0068] Furthermore, for example, it is time-consuming to sequentially check the charger identification information that identifies the charger 22 connected to multiple controllers 21 in the same area. For this reason, it is thought that a thief would not perform such checking when stealing a controller 21. Therefore, for example, charger identification information that identifies the charger 22 connected to another controller 21 in the same area as the requesting controller 21 may be used to generate a common key.

[0069] For example, the generation unit 202 of the management system 20 may generate a common key for the requesting controller 21 based on charging equipment identification information that identifies the charging equipment 22 connected to the controller 21 that has issued the association request and charging equipment identification information that identifies the charging equipment 22 connected to another controller 21 that is in the same area as the requesting controller 21. Specifically, for example, the generation unit 202 of the management system 20 identifies, in the charging equipment DB 2001, the charging equipment identification information associated with the controller identification information that identifies the controller 21 that has issued the association request and the charging equipment identification information associated with the controller identification information that identifies the other controller 21 that is in the same area as the requesting controller 21. Then, the generation unit 202 of the management system 20 may generate a common key for the requesting controller 21 based on the identified charging equipment identification information.

[0070] For example, the generation unit 202 of the management system 20 may generate a common key for each of the multiple controllers 21 in the same area after completing registration of the connection relationship with the connected charger devices 22.

[0071] Furthermore, by combining the above examples, the generation unit 202 of the management system 20 may generate a common key for the requesting controller 21 based on controller identification information that identifies the requesting controller 21, charging equipment identification information that identifies the charging equipment 22 connected to the requesting controller 21, controller identification information that identifies other controllers 21 in the same area, and charging equipment identification information that identifies the charging equipment 22 connected to the other controllers 21.

[0072] Furthermore, other information used to generate the key may be unique information specific to the controller 21 or unique information specific to the charger 22. The unique information specific to the controller 21 may be, for example, information specific to each controller 21 or information specific to each model of the controller 21. The unique information specific to the controller 21 may be, for example, a supported language, a model name, performance information such as a processor or storage capacity, etc. The unique information specific to the charger 22 may be, for example, information specific to each charger 22 or information specific to each model of the charger 22. The unique information specific to the charger 22 may be, for example, a model name, a capacity performance of a rechargeable battery, etc. The request receiving unit 201 of the management system 20 may acquire this information from the controller 21.

[0073] Next, an example in which a control software program transfers encrypted data to the controller 21 will be described.

[0074] The encryption unit 203 of the management system 20 encrypts the control software program based on the common key generated for the controller 21. Then, the data transmission unit 212 of the management system 20 transmits the encrypted software program. The encrypted software program is also called an encrypted software program.

[0075] Here, the management system 20 may encrypt the software program and transmit the encrypted software program in response to a request from the controller 21. Specifically, for example, the request sending unit 222 of the controller 21 transmits a request to send the encrypted software program. The request may include, for example, controller identification information. Next, the request receiving unit 201 of the management system 20 receives the request to send the encrypted software program.

[0076] Then, the encryption unit 203 of the management system 20 encrypts the control software program based on the common key generated for the controller 21 that has requested the transmission of the encrypted software program. The data transmission unit 212 of the management system 20 transmits a notification that the encrypted software program is ready for distribution. The request transmission unit 222 of the controller 21 transmits a download request for the encrypted software program. The request reception unit 201 of the management system 20 receives the download request. When the request reception unit 201 receives the download request, the data transmission unit 212 transmits the encrypted software program to the controller 21.

[0077] The data receiving unit 223 receives the encrypted software program and stores the encrypted software program in a non-volatile recording medium. For example, an example of the non-volatile recording medium will be described in the configuration example of the computer.

[0078] 11 is a sequence diagram showing an example of operations related to generation of a common key in the provisioning phase. An example will be described in which the common key is generated based on charging device identification information that identifies charging device 22 connected to controller 21. For example, in response to an operation by a system administrator, request sending unit 222 of controller 21 sends a registration request to register its own controller to management system 20 (step S201). The registration request includes controller identification information.

[0079] When the request receiving unit 201 receives a registration request including the controller identification information, the registration unit 204 registers the controller identification information included in the registration request in the controller DB (step S202).

[0080] Next, when registration is complete, the notification unit 213 transmits a registration success notification to the controller 21 that has requested the registration (step S203). When the controller 21 receives the registration success notification, the charger information acquisition unit 221 acquires charger identification information that identifies the charger 22 from the connected charger 22 (step S204). In step S204, the charger information acquisition unit 221 transmits a request to the connected charger 22 to send charger identification information. In response to the request from the controller 21, the charger 22 transmits charger identification information that identifies its own charger to the controller 21 (step S205). Then, the charger information acquisition unit 221 receives the charger identification information from the controller 21. This allows the controller 21 to acquire the charger identification information from the connected charger 22. Note that if multiple chargers 22 are connected to the controller 21, the charger information acquisition unit 221 acquires charger identification information from each of the multiple chargers 22.

[0081] When the charging device information acquisition unit 221 receives the charging device identification information from the controller 21, the request transmission unit 222 transmits an association request including the controller identification information and the charging device identification information (step S206). Note that if multiple chargers 22 are connected to the controller 21, the association request includes multiple pieces of charging device identification information. When the request reception unit 201 receives the association request, the registration unit 204 associates the controller identification information and the charging device identification information included in the association request and registers them in the charging device DB 2001 (step S207).

[0082] Then, generation unit 202 of management system 20 generates a common key for controller 21 that has requested the association request, based on the charging device identification information included in the association request (step S208). In step S208, if multiple chargers 22 are connected to controller 21, generation unit 202 of management system 20 generates a common key for controller 21 that has requested the association request, based on the multiple pieces of charging device identification information included in the association request. This completes the series of processes related to the generation of a common key in the provisioning phase by management system 20.

[0083] Here, a brief description will be given of a case where the common key is generated using controller identification information that identifies the other controllers 21 that are in the same region as the controller 21. For example, in step S204, the controller information acquisition unit 226 of the controller 21 further acquires controller identification information that identifies the other controllers 21 that are in the same region as the local controller 21. Then, in step S206, the request transmission unit 222 further transmits an association request that associates the local controller 21 with the other controllers 21 that are in the same region as the local controller 21. This association request includes the controller identification information that identifies the local controller 21 and the controller identification information that identifies the other controllers 21. In step S207, when the request reception unit 201 of the management system 20 receives the association request, the registration unit 204 associates and registers each controller identification information included in the association request in the controller association DB 2002.

[0084] In step S208, generation unit 202 generates a common key for controller 21 that has requested the association request, based on each controller identification information included in the association request. Alternatively, in step S208, generation unit 202 may generate a common key for controller 21 that has requested the association request, based on each controller identification information included in the association request of controller 21 in the same region and charging equipment identification information included in the association request of charger 22 and controller 21. Alternatively, generation unit 202 may generate a common key for controller 21 that has requested the association request, based on charging equipment identification information associated in charging equipment DB 2001 with each controller identification information included in the association request of controller 21 in the same region.

[0085] 12 is a sequence diagram showing an example of operations related to downloading an encrypted software program in the provisioning phase. The request sending unit 222 of the controller 21 sends a request to send the encrypted software program (step S211).

[0086] The encryption unit 203 of the management system 20 encrypts the software program based on the common key (step S212), and the notification unit 213 transmits a notification that the encrypted software program is ready for distribution (step S213).

[0087] When the controller 21 receives the notification that distribution preparation is complete, the request sending section 222 sends a download request for the encrypted software program (step S214).

[0088] When request receiving section 201 in management system 20 receives the download request, data transmitting section 212 transmits the encrypted software program to controller 21 that has made the request (step S215).

[0089] Data receiving unit 223 downloads the encrypted software program from management system 20 and stores the downloaded encrypted software program on a non-volatile recording medium (step S216). This completes the series of processes related to downloading the encrypted software program in the provisioning phase.

[0090] (Operation Phase) Next, the operation phase will be described. A series of operations in the operation phase will be simply described with reference to Figs. 13 and 14 .

[0091] FIG. 13 is a flowchart briefly illustrating the overall operation in the operation phase. For example, when the controller 21 is powered on, the connection status of the charger 22 connected to the controller 21 is determined (step S221). For example, if the controller 21 or the charger 22 is stolen, the connection status between the controller 21 and the charger 22 changes. If there is no change in the connection status (step S221: no change), decryption processing of the encrypted software program stored in the controller 21 is performed (step S222). On the other hand, if there is a change in the connection status (step S221: change), permission from the administrator is determined (step S223). If there is permission from the administrator, the process proceeds to step S222 and decryption processing is performed. On the other hand, if there is no permission from the administrator, startup of the controller 21 is stopped.

[0092] Fig. 14 is a flowchart briefly explaining the decryption process shown in Fig. 13. For example, a cloud session is established (step S231). Then, a common key is distributed to controller 21 (step S232). Then, the encrypted software program is decrypted in controller 21 (step S233).

[0093] Next, the functional units in the operation phase will be explained in more detail.

[0094] When the controller 21 is powered on, the charger information acquisition unit 221 of the controller 21 acquires charger identification information that identifies the connected charger 22. Here, if multiple chargers 22 are connected to the controller 21, the charger information acquisition unit 221 acquires charger identification information from each of the multiple chargers 22. Specifically, for example, the charger information acquisition unit 221 transmits a transmission request for charger identification information to the connected charger 22. Then, upon receiving the transmission request from the controller 21, the charger 22 transmits charger identification information that identifies its own charger 22 to the controller 21. Then, the charger identification information that identifies the charger 22 is received from the charger 22 connected to the controller.

[0095] The request sending unit 222 of the controller 21 sends a request to send a common key to the management system 20. For example, the request to send a common key may include information indicating the connection status of the charger 22. The information indicating the connection status of the charger 22 is, for example, charging equipment identification information acquired by the charging equipment information acquisition unit 221. Furthermore, for example, the request to send a common key may include controller identification information that identifies the controller itself and the charging equipment identification information acquired by the charging equipment information acquisition unit 221. Here, the request to send a common key may be made separately into a connection status confirmation request and a key request. Note that an example of making separate requests for connection status confirmation and a key request will be described later using a sequence diagram.

[0096] The request receiving unit 201 of the management system 20 receives from the controller 21 a transmission request in response to activation of the controller 21, the transmission request including charger identification information that identifies the charger 22 connected to the controller 21, and a transmission request for a key used by a software program that controls the charger 22 connected to the controller 21 to decrypt an encrypted software program. This transmission request may include information indicating the connection status of the charger 22 connected to the controller 21. More specifically, for example, the transmission request may include controller identification information that identifies the controller 21 and charger identification information that identifies the charger 22.

[0097] Next, for example, detection unit 211 detects a change in the connection status between controller 21 that has issued the transmission request and charger 22 connected to requesting controller 21, based on the charging equipment identification information included in the transmission request. As a specific detection method, for example, when the connection status has been registered in advance, detection unit 211 may determine whether the charging equipment identification information identifying charger 22 connected to controller 21 at the time of registration differs from the charging equipment identification information included in the transmission request. For example, when the charging equipment identification information identifying the charger connected to controller 21 at the time of registration differs from the charging equipment identification information included in the transmission request, detection unit 211 detects that the connection status between controller 21 and the charger has changed. On the other hand, when the charging equipment identification information identifying charger 22 connected to controller 21 at the time of registration is the same as the charging equipment identification information included in the transmission request, detection unit 211 detects that the connection status between controller 21 and the charger has not changed. More specifically, for example, detection unit 211 detects a change in the connection status between controller 21 and charger 22 based on the charger identification information included in the transmission request and the charger identification information associated with the controller identification information included in the transmission request in charger DB 2001. For example, detection unit 211 detects that there has been a change in the connection status between controller 21 and charger 22 if the charger identification information associated with the controller identification information included in the transmission request in charger DB 2001 is different from the charger identification information included in the transmission request.

[0098] For example, in the charger DB 2001 shown in FIG. 9 , controller ID "C001" is associated with charger IDs "EVC001," "EVC002," and "EVC003." For example, a transmission request includes the controller ID "C001" and the charger IDs "EVC001" and "EVC002." In such a case, the detection unit 211 detects that there has been a change in the connection status between the controller 21 and the charger 22. On the other hand, for example, a transmission request includes the controller ID "C001" and the charger IDs "EVC001," "EVC002," and "EVC003." In such a case, the detection unit 211 detects that there has been no change in the connection status between the controller 21 and the charger 22.

[0099] Furthermore, for example, detection unit 211 may detect a change in the connection status in more detail. For example, when the transmission request does not include at least any of the charging equipment identification information associated with the controller identification information included in the transmission request in charging equipment DB 2001, detection unit 211 detects that charger 22 identified by the charging equipment identification information not included in the transmission request has been removed from controller 21. For example, when the charging equipment identification information included in the transmission request is not included in the charging equipment identification information associated with the controller identification information included in the transmission request in charging equipment DB 2001, detection unit 211 detects that charger 22 identified by the charging equipment identification information included in the transmission request has been newly connected to controller 21. For example, detection unit 211 may detect a change between the number of charging equipment identification information associated with the controller identification information included in the transmission request in charging equipment DB 2001 and the number of charging equipment identification information included in the transmission request.

[0100] If the detection unit 211 detects that there is no change in the connection status, the data transmission unit 212 of the management system 20 transmits the common key generated by the generation unit 202 to the controller 21 .

[0101] The data receiving unit 223 of the controller 21 receives the common key. Specifically, for example, the data receiving unit 223 may receive the common key and store the common key in a volatile recording medium. An example of a volatile recording medium will be described in the configuration example of a computer. Then, the decryption unit 224 decrypts the encrypted software program and stores the decrypted software program in a volatile recording medium. For example, an example of a volatile recording medium will be described in the configuration example of a computer. As a result, if the power to the controller 21 is turned off, the decrypted software program is lost. Furthermore, the deletion unit 225 deletes the common key from the volatile memory after decryption by the decryption unit 224. As a result, the encrypted software program cannot be decrypted unless the common key is received again.

[0102] On the other hand, when the detection unit 211 detects a change in the connection status, the data transmission unit 212 of the management system 20 may not transmit the common key generated by the generation unit 202 to the controller 21. Furthermore, when the detection unit 211 detects a change in the connection status, the notification unit 213 of the management system 20 may notify an administrator of the change in the connection status. The administrator here is the LOB administrator described above. As a notification method, for example, the notification unit 213 may notify the administrator using an electronic message, email, or the like. As a notification method, for example, the notification unit 213 may output the change in the connection status to the terminal device 24 of the LOB administrator. The output method is not particularly limited to display, audio output, or the like.

[0103] Furthermore, the notification unit 213 may notify changes in the connection status in an identifiable manner. For example, the notification unit 213 may notify an increase or decrease in the number of chargers 22 connected to the controller 21, charger identification information identifying a newly connected charger 22, charger identification information identifying a charger 22 that has become disconnected, etc.

[0104] As a specific example of notification, for example, when the number of charging devices 22 connected to the controller 21 is decreasing, the notification unit 213 notifies the controller 21 of a request to monitor for the occurrence of a malfunction of the charging devices 22 connected to the controller 21 or theft of the charging devices 22.

[0105] If the controller 21 is stolen, it may be possible to connect and use another charger 22. Therefore, as another notification example, the notification unit 213 notifies a request to monitor for theft of the controller 21 when the number of chargers 22 connected to the controller 21 increases.

[0106] Furthermore, construction work to add more chargers 22 may be performed at the installation location. In such a case, a change may occur in the connection status between the controller 21 and the chargers 22. Therefore, as another notification example, when the detection unit 211 detects a change in the connection status, the notification unit 213 may notify the administrator of a request to check the construction status at the installation location. For example, it is assumed that more chargers 22 have been installed but the additional chargers 22 have not been registered. Therefore, when the number of chargers 22 connected to the controller 21 has increased, the notification unit 213 may notify the administrator of a request to check the status of the application for adding more controllers 21.

[0107] Furthermore, the permission accepting unit 214 accepts permission from the administrator to distribute the common key to the controller 21. Specifically, for example, the permission accepting unit 214 accepts permission from the administrator to distribute the common key to the controller 21 via the terminal device 24 of the LOB administrator.

[0108] Then, for example, when permission is received, the data transmission unit 212 transmits the common key to the controller 21 that has issued the transmission request. Note that the processing of each functional unit by the controller 21 after transmitting the common key is as described above, and therefore detailed description thereof will be omitted.

[0109] 15 is an explanatory diagram showing an example of a screen on the terminal device 24 of the LOB administrator. Fig. 15 shows an example of a notification when an increase in the number of chargers 22 connected to the controller 21 is detected. For example, the screen of the terminal device 24 of the LOB administrator displays the serial number of the controller 21, a detection of an increase in the number of chargers 22, and the serial numbers of unregistered chargers 22. "Unregistered" here means that the charger 22 is not associated with controller identification information in the charger DB 2001.

[0110] 15, the screen also includes a permission button. For example, when the permission button is pressed, the permission accepting unit 214 accepts permission from the administrator to distribute the common key to the controller 21.

[0111] The screen of the terminal device 24 of the LOB manager may further include a confirmation button for confirming the application status for construction work at the installation location of the controller 21. When the confirmation button is pressed, the notification unit 213 causes the LOB manager's terminal device 24 to display a list of the application status for construction work. The screen may further display map information of the installation location of the controller 21.

[0112] In the above example, a shared key is distributed when it is detected that there is no change in the connection status between the controller 21 and the charger 22 connected to the controller 21. For example, a shared key may be distributed when it is detected that there is no change in another controller 21 in the same area as the controller 21. A specific example of such a case will be described below.

[0113] For example, when the controller 21 is powered on, the controller information acquisition unit 226 of the controller 21 acquires controller identification information that identifies other controllers 21 in the same area as the controller 21. The acquisition method is the same as the example described in the provisioning phase, so a detailed description will be omitted.

[0114] The request sending unit 222 of the controller 21 sends a request to send a common key to the management system 20. The request to send a common key includes controller identification information that identifies the controller and the controller identification information acquired by the controller information acquisition unit 226. Here, the request to send a common key may be made separately into a request to confirm the controller 21 in the area and a key request.

[0115] The request receiving unit 201 of the management system 20 then receives a request to transmit the common key from the controller 21. Next, the detection unit 211 detects a change in the controller 21 that is in the same region as the controller 21 that has requested the transmission request for the common key. For example, if the controller identification information registered in the controller association DB 2002 together with the controller identification information that identifies the controller 21 that has requested the transmission request differs from the controller identification information included in the transmission request, the detection unit 211 detects that there has been a change in the controller 21 that is in the same region as the controller 21 that has requested the transmission request.

[0116] The detection unit 211 may detect changes in the controllers 21 in the same area in more detail. For example, the detection unit 211 may detect whether the controller identification information registered in the controller association DB 2002 together with the controller identification information identifying the controller 21 that has made the transmission request differs from the controller identification information included in the transmission request.

[0117] When the detection unit 211 detects that there is no change in the controller 21 in the same area, the data transmission unit 212 of the management system 20 transmits the common key generated by the generation unit 202 to the controller 21. Note that the subsequent processing is the same as in the example where no change in the connection status is detected, and therefore detailed description will be omitted.

[0118] On the other hand, when the detection unit 211 detects a change in the controllers 21 in the same area, the notification unit 213 of the management system 20 notifies the administrator of the change in the controllers 21 in the same area. Specifically, the notification unit 213 outputs the change to, for example, the administrator's terminal device. The output method is not particularly limited to display, audio output, etc.

[0119] If the controller identification information registered in the controller association DB 2002 together with the controller identification information identifying the controller 21 that has made the transmission request and the controller identification information included in the transmission request are all different, it is possible that the controller 21 has been moved to another area. The controller 21 may have been moved to another area if the controller 21 has been stolen or if the installation location of the controller 21 has been changed. Therefore, for example, if all of the controller identification information are different, the notification unit 213 issues at least one of a request to monitor for theft of the controller 21 and a request to confirm changes in the installation status of the controller 21.

[0120] Furthermore, the notification unit 213 may notify, as a change, controller identification information that is not included in the controller identification information included in the transmission request, among the controller identification information registered in the controller association DB 2002 together with the controller identification information identifying the controller 21 that has made the transmission request. The notification unit 213 may notify, as a change, controller identification information that is not included in the controller identification information registered in the controller association DB 2002 together with the controller identification information identifying the controller 21 that has made the transmission request.

[0121] Then, the permission receiving unit 214 may receive permission from the administrator to distribute the common key to the controller 21. The subsequent processing is as described above, and therefore a detailed description thereof will be omitted.

[0122] Furthermore, the detection of each change by detection unit 211 may be combined. For example, detection unit 211 may detect a change in the connection status between controller 21 and charging device 22 connected to controller 21, and a change in controller 21 located in the same area. Then, if detection unit 211 does not detect a change in the connection status or a change in controller 21 located in the same area, data transmission unit 212 of management system 20 may transmit the common key generated by generation unit 202 to controller 21. On the other hand, if detection unit 211 detects either a change in the connection status or a change in controller 21 located in the same area, notification unit 213 may notify the administrator of the detected change.

[0123] In addition, the administrator may not permit distribution of the shared key. For example, if the data receiving unit 223 does not receive the shared key within a certain time after the request transmitting unit 222 transmits a request to transmit the shared key, the stopping unit 227 may stop activation of the controller 21. Here, stopping activation means turning off the power. Alternatively, if the permission accepting unit 214 accepts that the administrator does not permit distribution of the shared key, the notification unit 213 may notify the controller 21 that the shared key will not be distributed. Then, the stopping unit 227 may stop activation in response to this notification. In this way, the stopping unit 227 stops activation if the shared key is not received. In this way, if the detection unit 211 detects a change in the connection status, the shared key may not be distributed to the controller 21, and the activation of the controller 21 may be stopped.

[0124] 16 is a sequence diagram showing a first operation example related to distribution of a common key when a change in the connection status in the operation phase is detected. First, when the controller 21 is powered on (step S241), the charger information acquisition unit 221 acquires charger identification information that identifies the connected charger 22 (step S242). If multiple chargers 22 are connected to the controller 21, in step S242, the charger information acquisition unit 221 acquires charger identification information from each of the multiple chargers 22. The charger 22 transmits the charger identification information to the controller 21 (step S243).

[0125] The request sending unit 222 of the controller 21 sends a request to send the common key to the management system 20 (step S244). For example, the request to send the common key may include controller identification information that identifies the controller 21 and the charger identification information acquired by the charger information acquisition unit 221. Note that if multiple chargers 22 are connected to the controller 21, the request to send the common key includes the multiple pieces of charger identification information acquired by the charger information acquisition unit 221.

[0126] When the request receiving unit 201 of the management system 20 receives a request to transmit the shared key, the detecting unit 211 checks for a change in the connection status between the controller 21 and the charger 22 (step S245). When the detecting unit 211 detects a change in the connection status, the notifying unit 213 notifies the LOB administrator's terminal device 24 of the change in the connection status (step S246). Note that in step S246, the notifying unit 213 may also notify the controller 21 of the change in the connection status. The LOB administrator's terminal device 24 accepts permission from the LOB administrator to distribute the shared key (step S247). The permission acceptance unit 214 then transmits a notification of the acceptance of the permission to the management system 20. Then, when the permission accepting unit 214 receives the notification of the acceptance of the permission and thereby accepts permission from the LOB administrator to distribute the shared key, the data transmitting unit 212 transmits the shared key to the controller 21 (step S248).

[0127] When data receiving unit 223 receives the common key, decryption unit 224 decrypts the encrypted software program and stores the decrypted software program on a volatile recording medium (step S249). Then, deletion unit 225 deletes the common key (step S250). Then, from step S250 onwards, controller 21 can execute the decrypted software program.

[0128] FIG. 17 is a sequence diagram showing an example of operation when a request for transmitting a common key is divided into a connection status confirmation request and a key request. FIG. 17 illustrates the portion surrounded by a dotted line in FIG. 16 . For example, the request transmitting unit 222 transmits a connection status confirmation request (step S261). The connection status confirmation request includes, for example, controller identification information for identifying the controller 21 and the charging equipment identification information acquired by the charging equipment information acquiring unit 221 in step S242. When the request receiving unit 201 of the management system 20 receives the connection status confirmation request, the detecting unit 211 checks for a change in the connection status between the controller 21 and the charging equipment 22 (step S245). Then, when the detecting unit 211 detects a change in the connection status, the notifying unit 213 notifies the terminal device 24 of the LOB administrator of the change in the connection status and also notifies the controller 21 of the change in the connection status (step S246). Then, when the controller 21 receives notification of a change in the connection status, the request sending unit 222 of the controller 21 sends a key request to the management system 20 (step S262). For example, if the data receiving unit 223 has not received the common key, the request sending unit 222 sends a key request to the management system 20 at predetermined time intervals (step S263). In this way, if the data receiving unit 223 has not received the common key, the request sending unit 222 may repeatedly send key requests to the management system 20 at predetermined time intervals.

[0129] Fig. 18 is a sequence diagram showing a second example of operation related to the distribution of a shared key when a change in the connection status is detected in the operation phase. Fig. 17 illustrates an example in which the administrator permits transmission of the shared key in step S247, thereby distributing the shared key to the controller 21. Fig. 18 illustrates an example in which the administrator does not permit transmission of the shared key.

[0130] Steps S241 to S246 shown in FIG. 18 are the same as steps S241 to S246 shown in FIG. 16, and therefore detailed description thereof will be omitted.

[0131] Following step S246, for example, if the data receiving unit 223 fails to receive the common key within a certain time period after the request transmitting unit 222 transmits the common key transmission request in step S244, the stopping unit 227 stops the activation of the own controller 21 (step S271). For example, as shown in FIG. 17 , a case will be described in which the common key transmission request is divided into a connection status confirmation request and a key request. For example, if the data receiving unit 223 fails to receive the common key within a certain time period after transmitting the key request, the stopping unit 227 may stop the activation of the own controller 21 in step S271.

[0132] 19 is a sequence diagram showing an example of an operation related to distribution of a common key when it is detected that there is no change in the connection status in the operation phase. Steps S241 to S245 shown in FIG. 19 are the same as steps S241 to S245 shown in FIG. 16, and therefore detailed description thereof will be omitted.

[0133] If the detection unit 211 detects no change in the connection status in step S245, the data transmission unit 212 transmits the common key to the controller 21 that issued the transmission request (step S281). When the data reception unit 223 receives the common key, the decryption unit 224 decrypts the encrypted software program using the common key and stores the decrypted software program on a volatile recording medium (step S282). The deletion unit 225 then deletes the common key (step S283). From step S283 onward, the controller 21 can execute the decrypted software program.

[0134] FIG. 20 is a sequence diagram showing an example of operation when a request for transmitting a common key is divided into a connection status confirmation request and a key request. FIG. 20 illustrates the portion surrounded by a dotted line in FIG. 19 . For example, the request transmitting unit 222 transmits a connection status confirmation request (step S291). The connection status confirmation request includes, for example, controller identification information for identifying the controller 21 and the charging equipment identification information acquired by the charging equipment information acquiring unit 221 in step S242. When the request receiving unit 201 of the management system 20 receives the connection status confirmation request, the detecting unit 211 checks for a change in the connection status (step S245). If the detecting unit 211 detects that there is no change in the connection status, the notifying unit 213 notifies the controller 21 that there is no problem with the connection status (step S292). When the controller 21 receives the notification that there is no problem with the connection status, the request transmitting unit 222 of the controller 21 transmits a key request to the management system 20 (step S293). If there is no problem with the connection status, when the request receiving unit 201 of the management system 20 receives the key request, the data transmitting unit 212 of the management system 20 transmits the common key to the controller 21 that requested the key request (step S281).

[0135] This completes the explanation of the operation example.

[0136] The software program executed by the controller 21 to control the charging equipment 22 includes important information, such as how to control the charging equipment 22. For this reason, there is a possibility that the software program may be stolen. In other words, there is a risk that the software program executed by the controller 21 to control the charging equipment 22 may be leaked.

[0137] Furthermore, there is a possibility that charging spots may be operated unmanned. In this case, the controller controlling the charging equipment may be stolen. However, when a controller 21 is stolen, it is time-consuming to repeatedly check charging equipment identification information, such as the serial number of the charging equipment 22 connected to the controller 21. For this reason, it is thought that a thief will not perform such checks when stealing the controller 21. Therefore, the management system 20 generates a key for decrypting encrypted data of the software program used by the controller 21 to control the charging equipment 22, based on the charging equipment identification information that identifies the charging equipment 22 connected to the controller 21. This allows a key that is difficult to identify to be used as the key for decrypting the encrypted data. Therefore, it is possible to prevent leakage of the software program of the controller 21 that controls the charging equipment 22 that charges the rechargeable battery of an electric vehicle. In other words, it is possible to improve the confidentiality of the software program and the integrity of the software program. It is also possible to make it difficult to identify how the charging equipment 22 is being controlled. In other words, it is possible to improve tamper resistance. It is also possible to prevent tampering with the software program. In other words, it is possible to improve the authenticity of the software program.

[0138] Furthermore, when managing chargers 22 connected to controller 21, management system 20 is expected to receive, from controller 21, charger identification information that identifies chargers 22 connected to controller 21. Therefore, by using the charger identification information to generate a key, it is possible to prevent the software program of controller 21 from being leaked using a simple mechanism.

[0139] Alternatively, the key may be a common key. Therefore, the management system 20 encrypts the software program based on the common key. The management system 20 transmits the encrypted data to the controller 21. The controller 21 then receives the encrypted data.

[0140] For example, it is time-consuming to sequentially check the controller identification information that identifies multiple controllers 21 in the same area. For this reason, it is thought that a thief would not perform such checking when stealing a controller 21. Furthermore, for example, the management system 20 manages which chargers 22 are connected to each controller 21. For this reason, the management system 20 associates and registers the controller identification information with the charger identification information. In this way, by managing the connection relationship between each controller 21 and the charger 22 and using the charger identification information to generate a key, it is possible to suppress the leakage of the software program of the controller 21 with a simple mechanism.

[0141] Furthermore, when managing controllers 21, the management system 20 may manage controllers 21 in the same area. For example, it is time-consuming to sequentially check the charger identification information that identifies the chargers 22 connected to each of multiple controllers 21 in the same area. For this reason, it is conceivable that a thief would not perform such checking when stealing a controller 21. The management system 20 may acquire the controller identification information of the controller 21 and the controller identification information of other controllers 21 in the same area as the controller 21. The management system 20 may generate a key based on the charger identification information registered in association with the controller identification information and the charger identification information registered in association with the controller identification information of the other controllers 21. For example, the key may be a key for the controller 21 in the area. In this way, the management system 20 manages the connection relationship between each controller 21 and the charger 22 for each controller 21 in the same area, and uses the charger identification information that identifies the charger 22 connected to each of the multiple controllers 21 to generate the key. Therefore, a simple mechanism can be used to prevent the leakage of the software program of the controller 21.

[0142] Meanwhile, the controller 21 acquires charging equipment identification information that identifies the charging equipment 22 from the charging equipment 22 connected to the controller 21, and transmits the acquired charging equipment identification information to the management system 20. The controller 21 then receives from the management system 20 data that is encrypted data of a software program that controls the charging equipment 22 and that can be decrypted using a key generated using the transmitted charging equipment identification information. Therefore, the controller 21 transmits information necessary for managing the connection relationship between the controller 21 and the charging equipment 22 to the management system 20, and has the management system 20 generate a key for decrypting the encrypted data. Therefore, a simple mechanism can be used to prevent leakage of the software program of the controller 21.

[0143] Furthermore, for example, when the controller 21 is stolen, it is expected that the controller 21 will be powered off. Furthermore, if the controller 21 is stolen, another charger 22 may be connected to the controller 21, or nothing may be connected to the controller 21. For example, it is expected that the controller 21 will be powered on to verify the operation of the software program. Therefore, when the management system 20 receives from the controller 21 a transmission request for a key for decrypting the encrypted software program, which is a transmission request in response to the activation of the controller 21, the management system 20 detects a change in the connection status between the controller 21 and the charger 22. If the charger 22 currently connected to the controller 21 is the same as the charger 22 connected to the controller 21 at the time of registration, it is highly likely that the controller 21 has not been stolen. Therefore, if no change in the connection status is detected, the management system 20 transmits a decryption key to the controller 21. This can prevent leakage of the software program of the controller 21 that controls the charger 22 that charges the rechargeable battery of the electric vehicle. Therefore, it is difficult to identify how the charger 22 is being controlled. That is, tamper resistance can be improved. Furthermore, tampering of the software program can be prevented. In other words, the authenticity of the software program can be improved.

[0144] If the charger 22 currently connected to the controller 21 is different from the charger 22 connected to the controller 21 at the time of registration, the connection status has changed. That is, the controller 21 may have been stolen. Alternatively, a new charger 22 may have been connected to the controller 21. Alternatively, the charger 22 may have been removed from the controller 21. For example, the management system 20 may not transmit the decryption key if there is a change in the connection status. This can prevent the leakage of the software program of the controller 21 that controls the charger 22 that charges the rechargeable battery of the electric vehicle. Furthermore, if a change in the connection status is detected, the management system 20 notifies the administrator of the change. This allows the administrator to confirm the change in the connection status.

[0145] Furthermore, when the administrator checks the change in the connection status, there may be cases where the administrator finds that the change is not problematic and does not pose a risk of theft of the controller 21. Therefore, when the management system 20 receives permission from the administrator to send the key, the management system 20 may send the key to the controller 21. This allows the key to be distributed to the controller 21 when there is a change in the connection status but there is no risk of theft of the controller 21. Therefore, it is possible to improve the availability of the charging facility including the charging device 22 and the controller 21.

[0146] Meanwhile, the controller 21 transmits to the management system 20 a transmission request for a key for decrypting the encrypted software program, the key including charger identification information that identifies the charger 22 connected to the controller 21 when the controller 21 is started. This allows the controller 21 to notify the management system 20 of the connection relationship between the controller 21 and the charger 22 when the controller 21 is started. When the controller 21 receives the key in response to the transmission request, the controller 21 decrypts the encrypted software program and stores the decrypted software program in a volatile recording medium. The controller 21 then deletes the key. As a result, if the power supply to the controller 21 is turned off, the decrypted software program is lost. The controller 21 will not be able to decrypt the encrypted software program unless it receives the key again. For example, if the power supply to the controller 21 is turned off when the controller 21 is stolen, the decrypted software program will be lost. Without the decryption key, the encrypted software program cannot be decrypted. This prevents the software program in the controller 21 from being leaked.

[0147] Furthermore, as described above, if the connection status changes when the controller 21 is powered on, the management system 20 will not distribute a key to the controller 21 without permission from the administrator. Therefore, if the controller 21 is stolen, the connection status will change and the key will not be distributed, making it impossible to decrypt the encrypted software program.

[0148] Furthermore, if the controller 21 does not receive the key within a predetermined time after sending the key transmission request, the controller 21 stops operating. This makes it possible to prevent misuse of the controller 21 to which the key is not distributed.

[0149] This concludes the description of the embodiments. The embodiments may be modified. For example, in each embodiment, an example of suppressing leakage of a software program running on a controller has been described using a connection relationship between a controller that controls a charging device and a charging device connected to the controller as an example. The present invention may be applied to other examples as long as there is a connection relationship between a controller that controls a target device and a target device connected to the controller. For example, a Wi-Fi (registered trademark) parent device may be used instead of the controller, a repeater connected to the parent device may be used instead of a charging device connected to the controller, and each functional unit in each embodiment may be applied to an example in which the parent device suppresses leakage of a software program for controlling the repeater.

[0150] In addition, the respective embodiments may be combined. In the embodiments, the management systems 10 and 20 may be configured to include some of the functional units and information.

[0151] Furthermore, the embodiments are not limited to the above-described examples and can be modified in various ways. Furthermore, the configuration of the management systems 10 and 20 in the embodiments is not particularly limited. For example, the management systems 10 and 20 may be realized by a single device, such as a single server. When each functional unit of the management systems 10 and 20 is realized by a single device, the single device may be called, for example, a management device, an information processing device, or the like, and is not particularly limited. Alternatively, the management systems 10 and 20 in the embodiments may be realized by different devices for different functions or data. For example, each functional unit may be configured by multiple servers and realized as the management systems 10 and 20. For example, the management systems 10 and 20 may be realized by a database server including each DB and a server having each functional unit. Furthermore, in the embodiments, each piece of information may include some of the information described above. Furthermore, each piece of information may include information other than the information described above. Each piece of information may be divided into multiple pieces of information in more detail, or may be organized into a single DB.

[0152] Furthermore, an entire system including the management systems 10 and 20 and the controllers 11 and 21 may be realized.

[0153] Furthermore, the process of generating information to be displayed on the terminal device 24 of the LOB manager may be performed by the notification unit 213. This process may also be performed by the terminal device 24 of the LOB manager.

[0154] (Example of Computer Hardware Configuration) Next, an example of a hardware configuration in which each device, such as the management systems 10 and 20, the controllers 11 and 21, the system administrator's terminal device 23, and the LOB administrator's terminal device 24, described in the embodiment, is implemented by a computer will be described. Fig. 21 is an explanatory diagram showing an example of a computer hardware configuration. For example, some or all of each device can be implemented using any combination of a computer 80 and a program as shown in Fig. 21.

[0155] The computer 80 includes, for example, a processor 801, a ROM (Read Only Memory) 802, a RAM (Random Access Memory) 803, and a storage device 804. The computer 80 also includes a communication interface 805 and an input / output interface 806. The components are connected to each other, for example, via a bus 807. The number of each component is not particularly limited, and there may be one or more of each component.

[0156] The processor 801 controls the entire computer 80. The processor 801 may be, for example, a central processing unit (CPU), a digital signal processor (DSP), a graphics processing unit (GPU), a physics processing unit (PPU), a tensor processing unit (TPU), a quantum processor, or a combination thereof, and is not particularly limited.

[0157] The computer 80 also includes a ROM 802, a RAM 803, and a storage device 804. For example, the storage device 804 is an example of a non-volatile storage medium described in each embodiment. However, examples of non-volatile storage media are not limited to this. The RAM 803 is an example of a volatile storage medium described in each embodiment. However, examples of volatile storage media are not limited to this.

[0158] Examples of the storage device 804 include semiconductor memory such as flash memory, a hard disk drive (HDD), and a solid state drive (SSD). For example, the storage device 804 stores an operating system (OS) program, application programs, programs related to the embodiments, etc. Alternatively, the ROM 802 stores application programs, programs related to the embodiments, etc. The RAM 803 is used as a work area for the processor 801.

[0159] The processor 801 also loads programs stored in the storage device 804, ROM 802, etc. The processor 801 then executes each process coded in the program. The processor 801 may also download various programs via the communication network NT. The processor 801 also functions as a part or all of the computer 80. The processor 801 may then execute the processes or instructions in the illustrated flowchart based on the program.

[0160] The communication interface 805 is connected to a communication network NT such as a LAN or WAN (Wide Area Network) via a wireless or wired communication line. The communication network NT may be composed of multiple communication networks NT. As a result, the computer 80 is connected to external devices and external computers 80 via the communication networks NT. The communication interface 805 serves as an interface between the communication network NT and the inside of the computer 80. The communication interface 805 also controls the input and output of data from external devices and external computers 80.

[0161] Furthermore, the input / output interface 806 is connected to at least one of an input device, an output device, and an input / output device. The connection method may be wireless or wired. Examples of the input device include a keyboard, a mouse, and a microphone. Examples of the output device include a display device, a lighting device, and an audio output device that outputs audio. Examples of the input / output device include a touch panel display. Note that the input device, output device, and input / output device may be built into the computer 80 or may be external.

[0162] The hardware configuration of the computer 80 is an example. The computer 80 may have some of the components shown in FIG. 21 . The computer 80 may have components other than those shown in FIG. 21 . For example, the computer 80 may have a drive device or the like. The processor 801 may then read programs and data stored on a recording medium attached to the drive device or the like into the RAM 803. Examples of non-transitory tangible recording media include optical disks, flexible disks, magneto-optical disks, and USB (Universal Serial Bus) memories. As described above, the computer 80 may have input devices such as a keyboard and a mouse. The computer 80 may have an output device such as a display. The computer 80 may also have an input device, an output device, and an input / output device.

[0163] The computer 80 may also include various sensors (not shown). The types of sensors are not particularly limited. The computer 80 may also include an imaging device capable of capturing images or videos.

[0164] This concludes the description of the hardware configuration of each device. There are various variations in the method of realizing each device. For example, each device may be realized by any combination of a different computer and program for each component. Furthermore, multiple components of each device may be realized by any combination of a single computer and program.

[0165] Furthermore, some or all of the components of each device may be realized by circuits for specific applications. Furthermore, some or all of the components of each device may be realized by general-purpose circuits such as FPGAs (Field Programmable Gate Arrays). Furthermore, some or all of the components of each device may be realized by a combination of circuits for specific applications and general-purpose circuits. These circuits may be a single integrated circuit. Alternatively, these circuits may be divided into multiple integrated circuits. The multiple integrated circuits may be connected via a bus or the like.

[0166] Furthermore, when some or all of the components of each device are realized by a plurality of computers, circuits, etc., the plurality of computers, circuits, etc. may be centrally located or distributed.

[0167] The key generation method and key distribution method described in the embodiment may be implemented by a computer such as the management systems 10 and 20 .

[0168] The control methods described in the embodiments may be implemented by a computer such as the controllers 11 and 21 .

[0169] Each program, such as the key generation program, key distribution program, and management program described in the embodiments, is recorded on a computer-readable recording medium such as an HDD, SSD, flexible disk, optical disk, magneto-optical disk, or USB memory. Each program is executed by being read from the recording medium by a computer. Each program may also be distributed via a communication network NT.

[0170] The components of the management systems 10 and 20 and the controllers 11 and 21 in the above-described embodiments may be realized by dedicated hardware, such as a computer. Alternatively, each component may be realized by software. Alternatively, each component may be realized by a combination of hardware and software.

[0171] Although the present disclosure has been described above with reference to the embodiments, the present disclosure is not limited to the above embodiments. The configuration and details of each of the present disclosures may include embodiments to which various modifications that would be apparent to those skilled in the art are applied within the scope of the present disclosure. The present disclosure may include embodiments in which the details described herein are appropriately combined or substituted as necessary. For example, details described using a particular embodiment may also be applied to other embodiments to the extent that no contradiction occurs. For example, although multiple operations are described in sequence in the form of a flowchart, the order of description does not limit the order in which the multiple operations are performed. Therefore, when implementing the embodiments, the order of the multiple operations may be changed as long as it does not interfere with the content.

[0172] Some or all of the above-described embodiments can be described as follows: However, some or all of the above-described embodiments are not limited to the following.

[0173] (Supplementary Note 1) A management system comprising: a request receiving means that receives, from a controller, charging device identification information of a charging device connected to the controller; and a generating means that generates, based on the charging device identification information, a key for decrypting data encrypted by a software program for the controller to control the charging device. (Supplementary Note 2) The management system according to Supplementary Note 1, wherein the key is a common key, and the management system comprises: an encrypting means that encrypts the software program based on the common key; and a data transmitting means that transmits the encrypted data to the controller. (Supplementary Note 3) The management system according to Supplementary Note 1 or Supplementary Note 2, further comprising: a registering means that associates controller identification information that identifies the controller with the charging device identification information and registers the associated controller identification information, wherein the request receiving means receives the controller identification information and the charging device identification information, and the registering means associates the controller identification information and the charging device identification information received by the request receiving means and registers them. (Supplementary Note 4) The management system according to Supplementary Note 3, wherein the request receiving means acquires the controller identification information that identifies the controller and controller identification information that identifies other controllers in the same area as the controller, and the generating means further generates the key based on charging equipment identification information that is registered in association with the controller identification information that identifies the other controllers. (Supplementary Note 5) The management system according to any of Supplementary Notes 1 to 4, wherein the request receiving means acquires controller identification information that identifies the controller and controller identification information that identifies other controllers in the same area as the controller, and the generating means generates the key based on the controller identification information that identifies the other controllers. (Supplementary Note 6) The management system according to Supplementary Note 4 or Supplementary Note 5, wherein the request receiving means acquires controller identification information that identifies the controller and controller identification information that identifies other controllers in the same area as the controller, and the generating means generates the key based on the controller identification information that identifies the other controllers.(Supplementary Note 7) A controller capable of communicating with a management system and controlling a connected charging equipment, comprising: charging equipment information acquisition means for acquiring charging equipment identification information that identifies the charging equipment from the charging equipment; request transmission means for transmitting the acquired charging equipment identification information to the management system; and data receiving means for receiving from the management system data in which a software program for controlling the charging equipment is encrypted data that can be decrypted using a key generated using the charging equipment identification information. (Supplementary Note 8) A key generation method comprising: receiving charging equipment identification information of a charging equipment connected to the controller from the controller; and generating, by the controller based on the charging equipment identification information, a key for decrypting data encrypted by a software program for controlling the charging equipment. (Supplementary Note 9) A control method in which a controller capable of communicating with a management system and controlling a connected charging equipment acquires charging equipment identification information that identifies the charging equipment from the charging equipment, transmits the acquired charging equipment identification information to the management system, and receives from the management system data in which a software program for controlling the charging equipment is encrypted data that can be decrypted using a key generated using the charging equipment identification information. (Supplementary Note 10) A non-transitory computer-readable recording medium having recorded thereon a program for causing a computer to execute the following processes: receiving, from a controller, charging device identification information of a charging device connected to the controller; and generating, based on the charging device identification information, a key for decrypting data encrypted by a software program for controlling the charging device by the controller.(Supplementary Note 11) A non-transitory recording medium readable by a controller, the recording medium storing a program that causes a controller capable of communicating with a management system and controlling a connected charging equipment to execute the following processes: acquire charging equipment identification information that identifies the charging equipment from the charging equipment, transmit the acquired charging equipment identification information to the management system, and receive from the management system data in which a software program for controlling the charging equipment is encrypted data that can be decrypted by a key generated by the charging equipment identification information. (Supplementary Note 12) A program that causes a computer to execute the following processes: receive charging equipment identification information of a charging equipment connected to the controller from the controller, and generate, based on the charging equipment identification information, a key for the controller to decrypt data encrypted by a software program for controlling the charging equipment. (Supplementary Note 13) A program that can communicate with a management system and controls a connected charging equipment to execute the following processes: acquire charging equipment identification information that identifies the charging equipment from the charging equipment, transmit the acquired charging equipment identification information to the management system, and receive from the management system data in which a software program for controlling the charging equipment is encrypted data that can be decrypted by a key generated by the charging equipment identification information.

[0174] 10, 20 Management system 11, 21, 21-A, 21-B, 21-C Controller 22, 22-1, 22-2, 22-3, 22-4, 22-5, 22-6 Charging equipment 23 System administrator's terminal device 24 LOB administrator's terminal device 80 Computer 101, 201 Request receiving unit 102, 202 Generation unit 121, 221 Charging equipment information acquisition unit 122, 222 Request sending unit 123, 223 Data receiving unit 203 Encryption unit 204 Registration unit 211 Detection unit 212 Data sending unit 213 Notification unit 214 Permission acceptance unit 224 Decryption unit 225 Deletion unit 226 Controller information acquisition unit 227 Stop unit 801 Processor 802 ROM 803 RAM 804 Storage device 805 Communication interface 806 Input / output interface 807 Bus 2001 Charging device DB 2002 Controller association DB NT Communication network

Claims

1. a request receiving means for receiving, from the controller, charging device identification information of a charging device connected to the controller; a generation means for generating, based on the charging device identification information, a key for decrypting data encrypted by a software program for the controller to control the charging device; A management system comprising:

2. the key is a common key, encryption means for encrypting the software program based on the common key; a data transmitting means for transmitting the encrypted data to the controller; The management system of claim 1 , comprising:

3. a registration means for registering controller identification information for identifying the controller and the charging device identification information in association with each other; Equipped with the request receiving means receives the controller identification information and the charging equipment identification information; the registration means registers the controller identification information and the charging equipment identification information received by the request receiving means in association with each other. The management system according to claim 1 or 2.

4. the request receiving means acquires the controller identification information that identifies the controller and controller identification information that identifies other controllers that are in the same area as the controller; The generation means further generates the key based on charging device identification information registered in association with the controller identification information that identifies the other controller. The management system according to claim 3 .

5. the request receiving means acquires controller identification information that identifies the controller and controller identification information that identifies other controllers that are in the same area as the controller; the generating means generates the key based on the controller identification information that identifies the other controller. The management system according to claim 1 or 2.

6. A controller capable of communicating with the management system and controlling a connected charging device, a charging equipment information acquisition means for acquiring, from the charging equipment, charging equipment identification information for identifying the charging equipment; a request transmission means for transmitting the acquired charging device identification information to the management system; a data receiving means for receiving, from the management system, encrypted data that is a software program for controlling the charging device and that can be decrypted using a key generated based on the charging device identification information; A controller comprising:

7. receiving, from the controller, charging device identification information of a charging device connected to the controller; the controller generates a key for decrypting data encrypted by a software program for controlling the charging device based on the charging device identification information; Key generation method.

8. a controller capable of communicating with the management system and controlling the connected charging device; acquiring, from the charging equipment, charging equipment identification information that identifies the charging equipment; transmitting the acquired charging device identification information to the management system; receiving, from the management system, encrypted data of a software program for controlling the charging device, the encrypted data being decryptable by a key generated based on the charging device identification information; Control method.

9. On the computer, receiving, from the controller, charging device identification information of a charging device connected to the controller; the controller generates a key for decrypting data encrypted by a software program for controlling the charging device based on the charging device identification information; A program that executes a process.

10. A controller that can communicate with the management system and controls the connected charging device, acquiring, from the charging equipment, charging equipment identification information that identifies the charging equipment; transmitting the acquired charging device identification information to the management system; receiving, from the management system, encrypted data of a software program for controlling the charging device, the encrypted data being decryptable by a key generated based on the charging device identification information; A program that executes a process.

Images