In-vehicle device and vehicle authentication system

Abstract

An in-vehicle device 100 according to the present invention comprises: an authentication unit 130 for executing authentication processing in response to a request from an external terminal 200; and a communication unit 110 for transmitting and receiving information to / from the external terminal 200 and a server 300. The authentication unit 130 executes authentication processing via the server 300 when the external terminal 200 and the server 300 can communicate with each other, and executes authentication processing without going via the server 300 when communication between the external terminal 200 and the server 300 is interrupted.

Description

In-vehicle device and vehicle authentication system

[0001] The present invention relates to an in-vehicle device and a vehicle authentication system.

[0002] In recent years, the popularity of connected cars has led to an increase in the number of in-vehicle ECUs (Electrical Control Units). This has led to the widespread adoption of smart key systems, which do not require physical keys for vehicle operation. In such systems, authentication of operational information is performed through mutual communication between mobile devices such as smartphones, in-vehicle control devices such as gateways, and server devices operated by administrators such as dealers. For security reasons against wiretapping and ease of maintaining authentication information, there is a trend toward using token-based authentication.

[0003] However, in a system that performs authentication through mutual communication with such a distant server, there is a risk that operations may become impossible in areas where communication with the server is not possible, such as an underground parking lot.Patent Document 1, which describes a prior art method for performing authentication when communication between an external terminal and a server is interrupted, addresses this issue.

[0004] JP 2021-37889 A

[0005] Patent Document 1 describes an authentication method for when communication between an external terminal and a server is interrupted, in which multiple cryptographic tokens for authentication are acquired in advance between the external terminal and the server, and "authentication with the vehicle-side system is performed without using tokens when a predetermined operation is performed." These predetermined operations refer to "when a low-security level operation is performed," with a security level assigned in advance to each operation performed on the vehicle from the external terminal. This technology reduces the consumption of cryptographic tokens and prevents the vehicle from becoming inoperable when communication with the server is interrupted. However, this is merely a method for reducing risk, and the risk of the vehicle becoming inoperable in a communication-disabled area remains if a high-security level operation is performed multiple times.

[0006] The present invention has been made in consideration of the above-mentioned problems, and aims to provide an in-vehicle device and a vehicle authentication system that do not cause the vehicle to become inoperable even when communication between an external terminal and a server is interrupted.

[0007] In order to solve the above problems, the in-vehicle device of the present invention comprises an authentication unit that performs authentication processing in response to a request from an external terminal, and a communication unit that transmits and receives information between the external terminal and a server, and when the external terminal and the server are able to communicate, the authentication unit performs authentication processing via the server, and when communication between the external terminal and the server is interrupted, performs authentication processing without going through the server.

[0008] According to the present invention, it is possible to prevent a vehicle from becoming inoperable even when communication between an external terminal and a server is interrupted. Further features related to the present invention will become apparent from the description of this specification and the accompanying drawings. Furthermore, problems, configurations, and advantages other than those described above will become apparent from the following description of the embodiments.

[0009] FIG. 1 is a block diagram showing the overall configuration of a vehicle authentication system according to an embodiment of the present invention. FIG. 1 is an example of an operation screen displayed on an external terminal. FIG. 2 is an example of an operation screen prompting input of user information. FIG. 2 is a flowchart showing processing of an external terminal according to an embodiment 1 of the present invention. FIG. 3 is a flowchart showing processing of an in-vehicle device according to an embodiment 1 of the present invention. FIG. 4 is a flowchart showing processing of a server according to an embodiment 1 of the present invention. FIG. 5 is a flowchart showing processing of an external terminal according to an embodiment 2 of the present invention.

[0010] Hereinafter, an embodiment will be described with reference to the drawings.

[0011] [Example 1] Figure 1 is a functional block diagram showing the configuration of a vehicle authentication system 1 according to Example 1 of the present invention, which has an in-vehicle control device 100 (hereinafter simply referred to as the in-vehicle device 100), an external terminal 200, and a server device 300 (hereinafter simply referred to as the server 300).

[0012] In the vehicle authentication system 1, a user can instruct the vehicle 10 to perform various operations from the external terminal 200. When the in-vehicle device 100 installed in the vehicle 10 receives an operation from the external terminal 200, it authenticates whether the operation is legitimate, and if the authentication is successful, it instructs other control ECUs in the vehicle 10 to perform the operation. In this embodiment, when the external terminal 200 can communicate with the server 300, authentication is performed using a token, and when the communication is interrupted, authentication between the in-vehicle device 100 and the external terminal 200 is performed using encryption key authentication.

[0013] The in-vehicle device 100 is mounted on a vehicle 10, and is connected to an exterior communication device 20, a door control ECU 30, an engine control ECU 40, and a GPS (Global Positioning System) receiver 50 via an in-vehicle communication path such as a CAN (Control Area Network), and performs communication. The exterior communication device 20 supports long-distance wireless communication standards such as 5G, and performs wireless communication with a server 300.

[0014] The in-vehicle device 100 is made up of a well-known microcomputer equipped with a memory and a CPU, and includes an in-vehicle communication unit 110, a random number generation unit 120, an authentication unit 130, an operation monitoring unit 140, and a storage unit 150. The storage unit 150 further includes a key information storage unit 160, a terminal information storage unit 170, a function switching information storage unit 180, and a log storage unit 190. Although the key information storage unit 160, the terminal information storage unit 170, the function switching information storage unit 180, and the log storage unit 190 are represented as separate blocks, they may be individually allocated to storage areas of a single storage medium, or may be arbitrarily arranged in storage areas of multiple storage media.

[0015] The in-vehicle communication unit 110 is a well-known communication module having a function of communicating with the external terminal 200 via wireless communication such as Wi-Fi (registered trademark) or Bluetooth (registered trademark). It also communicates with the server 300 via the exterior communication device 20. Note that in this embodiment, the in-vehicle communication unit 110 communicates with the external terminal 200 using a short-range communication standard, but if the in-vehicle communication unit 110 supports a long-range communication standard such as 5G, it may have a function of communicating directly with the server 300 without going through the exterior communication device 20.

[0016] The random number generation unit 120 is a well-known module that generates a random number to be used for encryption key authentication when communication between the external terminal 200 and the server 300 is interrupted.

[0017] The authentication unit 130 is a module that includes a server-mediated operation authentication unit 132 , a terminal operation authentication unit 134 , and a function switching authentication unit 136 , and that authenticates operation instructions from the external terminal 200 to the vehicle 10 .

[0018] The server-mediated operation authentication unit 132 is active when communication between the external terminal 200 and the server 300 is possible, and authenticates an operation received from the external terminal 200. Specifically, the server-mediated operation authentication unit 132 authenticates an operation instruction received from the external terminal 200 via the server. In this embodiment, the server-mediated operation authentication unit 132 performs authentication using a token. The server-mediated operation authentication unit 132 transmits a token attached to an operation instruction received from the external terminal 200 to the server 300 via the exterior communication device 20 and checks whether the token is valid. If the token is authenticated by the server 300, the operation requested by the external terminal 200 is executed. Note that the token authentication method is not limited to the above method. For example, the server 300 may encrypt token information using an encryption key held by the server 300 and digitally sign the token, so that the server may be involved in the authentication method even if the vehicle 10 and the server 300 do not directly communicate with each other.

[0019] When communication between the external terminal 200 and the server 300 is interrupted, the terminal operation authentication unit 134 receives a function switching request from the external terminal 200 and becomes active, and performs authentication of operation instructions between the external terminal 200 and the vehicle 10. In this embodiment, the terminal operation authentication unit 134 performs authentication of operation instructions by encryption authentication using an encryption key. Specifically, the encryption key encryption assigned to the operation information from the external terminal 200 is decrypted using a pair of encryption keys shared in advance between the external terminal 200 and the vehicle 10, and authentication is performed. If the operation is authenticated, the requested operation is executed.

[0020] The function switching authentication unit 136 switches the active state of the server-mediated operation authentication unit 132 and the terminal operation authentication unit 134 in response to a function switching request received from the external terminal 200. Specifically, the function switching authentication unit 136 compares function switching information, including the user's password and biometric information such as face and fingerprint, attached to the function switching request with pre-registered authorized function switching information to authenticate the function switching. If the function switching request is authenticated, the function switching authentication unit 136 sets the server-mediated operation authentication unit 132 to an inactive state and the terminal operation authentication unit 134 to an active state, thereby switching authentication for operation requests from the external terminal 200 from authentication using a token (token authentication) to authentication using an encryption key (encryption key authentication). Note that the user information used for this switching may not be input from the external terminal 200, but may be input, for example, from a camera or navigation system installed in the vehicle.

[0021] When the authentication method of the authentication unit 130 is switched from token authentication to encryption key authentication, the operation monitoring unit 140 begins monitoring the in-vehicle communication unit 110, the exterior communication device 20, and the engine control ECU 40. The monitoring of the in-vehicle communication unit 110 or the exterior communication device 20 monitors the communication status between the vehicle and the server. If communication with the server is possible but an operation request using encryption key authentication from an external terminal continues, the operation monitoring unit 140 sends a notification to the external terminal and switches the authentication method to token authentication. The monitoring of the engine control ECU 40 also monitors the distance traveled since the engine was started after switching to encryption key authentication. If an operation request using encryption key authentication from an external terminal continues even after driving a certain distance or more after switching to encryption key authentication, the authentication method is switched to token authentication. The reason for switching to token authentication in this way is that there is a high possibility of cyberattacks by third parties when the vehicle's external communication function is enabled or when encryption authentication has continued for a certain period of time or more. When this function forcibly switches the authentication method, the terminal information and communication log of the external terminal 200 currently communicating, current location information from the GPS receiver 50, and the timestamp of the switch are saved in the log storage unit 190. If communication between the vehicle 10 and the server 300 is possible, the information saved in the log storage unit 190 is sent to the server 300 to notify the server 300 of the possibility of unauthorized use (cyber attack). Furthermore, if unauthorized use is discovered, encryption key authentication using the encryption key used this time cannot be performed unless the external terminal that performed communication is reconfigured by the server 300 as a legitimate terminal. This monitoring is performed to prevent the unauthorized repeated use of authentication methods that do not go through the server.

[0022] The key information storage unit 160 stores encryption key information that has been shared in advance between the external terminal 200 and the vehicle 10 .

[0023] The terminal information storage unit 170 stores identification information of the external terminal 200 that communicates with the in-vehicle device 100 and that is acquired when the external terminal 200 is registered.

[0024] The function switching information storage unit 180 stores user information used by the function switching authentication unit 136 .

[0025] The log storage unit 190 stores information when the operation monitoring unit 140 forcibly switches the authentication method.

[0026] Next, the functional configuration of the external terminal 200 will be described. The external terminal 200 is made up of a well-known microcomputer equipped with a memory and a CPU, and includes a terminal communication unit A 210, a terminal communication unit B 220, a display unit 230, an operation unit 240, a data generation unit 250, and a storage unit 260. The storage unit 260 further includes a terminal key information storage unit 270, a token storage unit 280, and a terminal function switching information storage unit 290. Note that although the terminal key information storage unit 270, the token storage unit 280, and the terminal function switching information storage unit 290 are represented as separate blocks, they may be individually allocated to storage areas of a single storage medium, or may be arbitrarily arranged in storage areas of multiple storage media.

[0027] The terminal communication unit A210 communicates with the server 300 using a long-distance communication standard such as 5G (fifth generation mobile communication system).

[0028] The terminal communication unit B220 is a well-known communication module having a function of communicating with the in-vehicle device 100 via wireless communication such as Wi-Fi (registered trademark) or Bluetooth (registered trademark). Note that in this embodiment, communication with the server 300 is performed by the terminal communication unit A210, and communication with the in-vehicle device 100 is performed by the terminal communication unit B220, but if the communication standards can be unified or if one module is used that supports multiple communication standards, the terminal communication units may be combined into one module.

[0029] The display unit 230 displays on the liquid crystal screen the operations that the user can currently perform on the vehicle 10, as shown in FIG.

[0030] The operation unit 240 acquires input of an operation performed by the user in response to the display on the display unit 230 .

[0031] The data generation unit 250 includes a terminal function switching authentication unit 252 and an encryption generation unit 254, and generates data to be transmitted to the vehicle 10. Normally, a token is attached to the operation information obtained from the operation unit 240 and transmitted to the in-vehicle device 100, and when the authentication method is switched to encryption key authentication, an encryption key encryption is attached to the operation information and transmitted to the in-vehicle device 100.

[0032] When communication between the external terminal 200 and the server 300 is interrupted, the terminal function switching authentication unit 252 of the data generation unit 250 causes the display unit 230 to display a screen asking the user whether to switch the authentication method. When the user requests switching of the authentication method, the display unit 230 displays a screen as shown in FIG. 3 that requests input of function switching information such as a password or biometric information, and checks whether the input information matches the function switching information registered in advance. If the information matches, the data generation unit 250 generates data for an authentication method switching request that includes the acquired user information and transmits the data to the in-vehicle device 100.

[0033] When the authentication method is switched to encryption key authentication, the encryption generating section 254 of the data generating section 250 generates an encryption code to be attached to the operation information using an encryption key.

[0034] The terminal key information storage unit 270 stores the encryption key used when the authentication method is switched to encryption key authentication.

[0035] The token storage unit 280 stores a token issued by the server 300 and assigned to operation information during token authentication by an authentication method. The number of stored tokens is not limited to one, and multiple tokens may be stored as in Patent Document 1.

[0036] The terminal function switching information storage unit 290 stores user information such as passwords and biometric information required for switching authentication methods.

[0037] Next, a description will be given of the functional configuration of the server 300. The server 300 includes a terminal information authentication unit 310, a token authentication unit 320, a token generation unit 330, a server communication unit 340, and a storage unit 350. The storage unit 350 further includes a terminal information storage unit 360 and a server token storage unit 370.

[0038] The server 300 issues a token to the external terminal 200 and authenticates the token with respect to the vehicle 10. Although the terminal information storage unit 360 and the server token storage unit 370 are represented as separate blocks, they may be individually allocated to the storage area of ​​a single storage medium, or may be arbitrarily arranged in the storage areas of multiple storage media.

[0039] When the terminal information authentication unit 310 first communicates with the external terminal 200, the terminal information of the external terminal 200 is linked to the information of the paired vehicle 10 and stored in the terminal information storage unit 360. When an external terminal accesses the terminal information authentication unit 310 from the next time onward, the terminal information authentication unit 310 checks whether the information of the accessing external terminal matches the information stored in the terminal information storage unit 360, and if they match, allows the token generation unit 330 to issue a token.

[0040] The token authentication unit 320 authenticates whether the token sent from the vehicle 10 is authentic, and if it is authentic, returns a positive response to the vehicle 10 .

[0041] The token generation unit 330 issues a token to the external terminal 200 and stores a set of currently issued token information and issued terminal information in the server token storage unit 370. A new token is generated for the external terminal 200 when an issuance request from the external terminal 200 is permitted by the terminal information authentication unit 310, or when a token sent from the vehicle 10 is successfully authenticated. An expiration date is set for the issued token, and when the token expiration date has expired or token authentication from the vehicle 10 has failed, the current token information stored in the server token storage unit 370 is discarded, making it impossible to perform authentication processing using that token.

[0042] The server communication unit 340 is an existing wireless communication module that communicates between the external terminal 200 and the vehicle 10 or the in-vehicle device 100 using a long-distance communication standard such as 5G.

[0043] The terminal information storage unit 360 stores the terminal information of the external terminal 200 that is permitted to access by the terminal information authentication unit 310 .

[0044] The server token storage unit 370 stores the currently valid token issued by the token generation unit 330 and information on the terminal to which the token is issued.

[0045] Next, the process executed by each processing unit in this embodiment will be described with reference to a flowchart of FIG. 4. FIG. 4 is a flowchart of the process executed by the external terminal 200 according to the first embodiment.

[0046] First, in step 100, the external terminal 200 transmits its own terminal information to the server 300, requests the server 300 to issue a token, and proceeds to step 101. In step 101, the external terminal 200 waits for a response from the server 300, and proceeds to step 102 if the terminal authentication is successful, or to step 100 if it is unsuccessful.

[0047] In step 102 , the external terminal 200 stores the token issued by the server 300 in the token storage unit 280 , and then proceeds to step 103 .

[0048] In step 103, the external terminal 200 checks the communication status with the server 300, and proceeds to step 104. In step 104, if the communication status between the external terminal 200 and the server 300 is communication possible, the process proceeds to step 105, and if the communication status is interrupted, the process proceeds to step 111. Thereafter, steps 105 to 110 represent the processing flow of the authentication process using a token, and steps 111 to 125 represent the processing flow of the authentication process using encryption key cryptography.

[0049] In step 105, the data generation unit 250 checks the expiration date of the token stored in the token storage unit 280, and proceeds to step 106. In step 106, if the expiration date of the token stored in the token storage unit 280 is within the expiration date, the process proceeds to step 107, and if the expiration date has passed, the currently stored token is discarded and the process proceeds to step 100.

[0050] In step 107, the data generating unit 250 reads the operation information input by the user from the operation unit 240, and the process proceeds to step .

[0051] In step 108, the data generation unit 250 generates transmission data by adding the token stored in the token storage unit 280 to the operation information read from the operation unit 240, and transmits the data from the terminal communication unit B220 to the vehicle 10, and then proceeds to step 109. In step 109, the external terminal 200 waits for a response to the operation information from the vehicle 10, and if the response is positive, proceeds to step 110, and if the response is negative, discards the currently stored token and proceeds to step 100.

[0052] In step 110 , the external terminal 200 discards the token transmitted to the vehicle 10 , stores the newly issued token from the server 300 in the token storage unit 280 , and then proceeds to step 103 .

[0053] If the communication state between the external terminal 200 and the server 300 is a communication interruption state in step 104, the terminal function switching authentication unit 252 displays a screen for the user to confirm whether or not to switch the authentication method in step 111, and proceeds to step 112. In step 112, the terminal function switching authentication unit 252 waits for input from the user, and if the input read from the operation unit 240 indicates that switching of the authentication function is necessary, proceeds to step 113, and if not, proceeds to step 103.

[0054] In step 113, terminal function switching authentication unit 252 causes display unit 230 to display a screen requesting the user to input function switching information such as a password and biometric information as shown in FIG.

[0055] In step 114, terminal function switching authentication unit 252 waits for input from the user, compares the function switching information read from operation unit 240 with the function switching information stored in terminal function switching information storage unit 290, and performs authentication, and then proceeds to step 115. In step 115, if the authentication of the function switching information is successful, the process proceeds to step 116, and if it is unsuccessful, the process proceeds to step 103.

[0056] In step 116, data generation unit 250 adds the function switching information authenticated in step 114 to the authentication method switching request, transmits the request from terminal communication unit B220 to vehicle 10, and proceeds to step 117. In step 117, terminal function switching authentication unit 252 waits for a response to the authentication method switching request from vehicle 10, and proceeds to step 118 if the response is positive, or proceeds to step 103 if the response is negative.

[0057] In step 118, the terminal function switching authentication unit 252 checks the communication state between the terminal communication unit A210 and the server 300, and proceeds to step 119. In step 119, if the communication state with the server 300 is communication impossible, the process proceeds to step 121, and if communication is possible, the process proceeds to step 120.

[0058] In step 120 , terminal function switch authentication unit 252 switches the authentication method from encryption key authentication to token authentication, and the process proceeds to step 103 .

[0059] In step 121, the terminal function switching authentication unit 252 checks whether forced switching of the authentication method has been performed by the vehicle 10. If forced switching has not been performed, the process proceeds to step 122; if forced switching has been performed, the operation of the external terminal 200 on the vehicle 10 is stopped and the process ends.

[0060] In step 122, the data generating unit 250 reads the user's operation from the operation unit 240, and the process proceeds to step 123. This operation is any operation commanded to the vehicle 10 by the user.

[0061] In step 123, the data generating unit 250 generates transmission data based on the operation information read from the operation unit 240, and transmits an operation request from the terminal communication unit B220 to the vehicle 10, and the process proceeds to step .

[0062] In step 124, the encryption generator 254 receives an encryption key encryption request including random number information from the vehicle 10, generates an encryption key encryption from the received random number and the encryption key stored in the terminal key information memory unit 270, and proceeds to step 125.

[0063] In step 125, the data generation unit 250 generates transmission data from the encryption key encryption generated by the encryption generation unit 254 in step 124, transmits the data from the terminal communication unit B220 to the vehicle 10, and proceeds to step 118 after receiving a response from the vehicle 10.

[0064] FIG. 5 is a flowchart of the process executed by the in-vehicle device 100 according to the first embodiment.

[0065] First, in step 200, the in-vehicle device 100 checks whether a request to switch the authentication method has been received from the external terminal 200, and if there is a request to switch, the process proceeds to step 201, and if there is no request to switch, the process proceeds to step 221. Thereafter, steps 201 to 220 represent the processing flow of authentication processing using encryption key cryptography, and steps 221 to 226 represent the processing flow of authentication processing using a token.

[0066] In step 201, the function switching authentication unit 136 compares the function switching information, including the user's password and biometric information such as a facial image, contained in the authentication method switching request received from the external terminal 200, with the function switching information stored in the function switching information storage unit 180, and then proceeds to step 202. In step 202, if the authentication of the function switching information in step 201 is successful, the process proceeds to step 204, and if it is unsuccessful, the process proceeds to step 203.

[0067] In step 203, the authentication unit 130 transmits a negative response to the authentication method switching request from the in-vehicle communication unit 110 to the off-vehicle terminal 200, and the process proceeds to step 200. In step 204, the authentication unit 130 transmits a positive response to the authentication method switching request from the in-vehicle communication unit 110 to the off-vehicle terminal 200, and the process proceeds to step 205.

[0068] In step 205, the function switching authentication unit 136 switches the authentication method of the in-vehicle device 100 for an operation request from the external terminal 200 from token authentication to encryption key encryption authentication. At the same time, the operation monitoring unit 140 starts saving, in the log storage unit 190, the content of communication between the in-vehicle device 100 and the external terminal 200 after the authentication method switching, timestamps, and information about the external terminal 200, and then proceeds to step 206.

[0069] In step 206, it is confirmed whether operation monitoring by the operation monitoring unit 140 is being performed, and if it is being performed, the process proceeds to step 208, and if it is not being performed, the process proceeds to step 207. In step 207, the operation monitoring unit 140 starts monitoring the communication state between the vehicle 10 and the server 300 via the exterior communication device 20, and the distance traveled by the vehicle 10 since the engine control ECU 40, and then the process proceeds to step 208. Note that if the authentication method for operation information from the external terminal 200 has been encryption key authentication for a certain period of time or more even though the communication state between the vehicle 10 and the server 300 has returned to a communicable state, or if the distance traveled by the vehicle 10 since switching to encryption key authentication exceeds a certain distance, the operation monitoring unit 140 determines that the operation state of the vehicle is NG.

[0070] In step 208, the authentication unit 130 waits for an operation request from the external terminal 200, and if an operation request is received, the process proceeds to step 209. If no operation request is received, the process continues to wait.

[0071] In step 209, the random number generation unit 120 generates a random number for encryption key encryption, and the process proceeds to step 210.

[0072] In step 210 , the random number generation unit 120 transmits the random number information generated in step 209 from the in-vehicle communication unit 110 to the external terminal 200 , and the process proceeds to step 211 .

[0073] In step 211 , the authentication unit 130 waits for the receipt of an encryption key cipher from the external terminal 200 , and if the encryption key cipher is received, the process proceeds to step 212 .

[0074] In step 212 , the terminal operation authentication unit 134 decrypts the encryption key encryption received from the external terminal 200 using the encryption key stored in the key information storage unit 160 , and then proceeds to step 213 .

[0075] In step 213, the terminal operation authentication unit 134 checks whether the encryption key encryption decrypted in step 212 matches the random number generated by the random number generation unit 120 in step 209. If they match, the process proceeds to step 214; if they do not match, the process proceeds to step 200.

[0076] In step 214, the authentication unit 130 sends a negative response to the external terminal 200 and the process proceeds to step 200.

[0077] In step 215 , the authentication unit 130 sends an affirmative response to the external terminal 200 , and the process proceeds to step 216 .

[0078] In step 216 , the authentication unit 130 performs the operation requested by the external terminal 200 , and then proceeds to step 217 .

[0079] In step 217, the operation monitoring unit 140 checks whether the current operation state of the vehicle 10 is in an operation NG state. If it is in an operation NG state, the process proceeds to step 218; if it is not in an operation NG state, the process proceeds to step 206.

[0080] In step 218, the operation monitoring unit 140 forcibly switches the authentication method from encryption key encryption authentication to token authentication, locks the current encryption key so that it cannot be used for authentication, and then proceeds to step 219.

[0081] In step 219, the operation monitoring unit 140 monitors the communication state between the vehicle 10 and the server 300, and if communication is possible, the process proceeds to step 220. If communication is not possible, the process remains on standby.

[0082] In step 220, the operation monitoring unit 140 combines the latest log in the log storage unit 190 and the current location information from the GPS receiver 50 and transmits it as a notice of unauthorized use from the exterior vehicle communication device 20 to the server 300, thereby completing the authentication process.

[0083] If there is no request to switch the authentication method in step 200, the authentication unit 130 waits in step 221 for reception of an operation request and a token from the external terminal 200, and if they are received, proceeds to step 222. If there is no reception, the authentication unit 130 continues to wait.

[0084] In step 222, the server-mediated operation authentication unit 132 extracts the token information attached to the operation request received in step 221, transmits a token authentication request from the exterior-vehicle communication device 20 to the server 300, and proceeds to step 223. In step 223, the process waits for a response to the token authentication request from the server 300, and proceeds to step 225 if the authentication is successful, or proceeds to step 224 if the authentication is unsuccessful.

[0085] In step 224 , the authentication unit 130 sends a negative response to the external terminal 200 and proceeds to step 200 .

[0086] In step 225 , the authentication unit 130 sends an affirmative response to the external terminal 200 , and the process proceeds to step 226 .

[0087] In step 226, the authentication unit 130 performs the operation requested by the external terminal 200, and then the process proceeds to step 200.

[0088] FIG. 6 is a flowchart of a process executed by the server 300 according to the first embodiment.

[0089] First, in step 300, the server 300 determines the type of request it has received. If the request is a token issuance request received from the external terminal 200, the process proceeds to step 301. If the request is a token authentication request received from the vehicle 10, the process proceeds to step 307.

[0090] If the received request is for token issuance, in step 301, the terminal information authentication unit 310 performs comparative authentication using the terminal information received from the external terminal 200 and the terminal information stored in the terminal information storage unit 360, and then proceeds to step 302.

[0091] In step 302, if the terminal information authentication unit 310 finds that the terminal information matches as a result of the comparison performed in step 301, it proceeds to step 304; if not, it proceeds to step 303.

[0092] In step 303 , the terminal information authentication unit 310 transmits a negative response from the server communication unit 340 to the external terminal 200 , and the process proceeds to step 300 .

[0093] In step 304 , the terminal information authentication unit 310 transmits an affirmative response from the server communication unit 340 to the external terminal 200 , and the process proceeds to step 305 .

[0094] In step 305 , the token generating unit 330 issues a new token, stores the token information in the server token storage unit 370 , and then proceeds to step 306 .

[0095] In step 306, the token generating unit 330 transmits the token from the server communication unit 340 to the external terminal 200, and the process proceeds to step 300.

[0096] If the request received in step 300 is token authentication, in step 307, the token authentication unit 320 performs authentication using the token information received from the vehicle 10 and the token information stored in the server token memory unit 370, and then proceeds to step 308.

[0097] In step 308, the token authentication unit 320 checks the result of the authentication performed in step 307, and proceeds to step 310 if the authentication is successful, or to step 309 if the authentication is unsuccessful.

[0098] In step 309, the token authentication unit 320 transmits a negative response from the server communication unit 340 to the vehicle 10, and the process proceeds to step 300.

[0099] In step 310 , the token authentication unit 320 sends a positive response from the server communication unit 340 to the vehicle 10 , and the process proceeds to step 311 .

[0100] In step 311 , the token generating unit 330 issues a token for renewal, and the process proceeds to step 312 .

[0101] In step 312 , the token generating unit 330 transmits the token issued in step 311 to the external terminal 200 via the server communication unit 340 , and the process proceeds to step 300 .

[0102] As described above, according to this embodiment, the authentication method for an operation request transmitted from the external terminal 200 to the vehicle 10 is switched depending on the communication status between the external terminal 200 and the server. Specifically, when communication between the external terminal 200 and the server 300 is interrupted, authentication is performed using an encryption key generated by the external terminal 200 in response to the operation request transmitted from the external terminal 200 to the vehicle 10. This makes it possible to avoid the risk of the vehicle becoming inoperable even when communication between the external terminal 200 and the server 300 is interrupted.

[0103] Next, a second embodiment of the present invention will be described with reference to Figures 7 and 8. In this embodiment, the system configuration is the same as that of the first embodiment, but it differs from the first embodiment in that the user performs operations directly on the vehicle 10, rather than through the external terminal 200. An operation performed directly on the vehicle 10 refers to, for example, a case where the door control ECU 30 is requested to open or close the door using a physical button on the door, or a case where the engine control ECU 40 is requested to start the engine using a smart push key.

[0104] Fig. 7 is a flowchart showing the processing executed by the external terminal 200 according to the second embodiment. Note that the same processes as those executed in the first embodiment, which were explained in Fig. 4, are denoted by the same reference numerals, and the explanation thereof will be omitted. Also, the processing executed by the server 300 is the same as that in Fig. 6 according to the first embodiment, and therefore the explanation thereof will be omitted.

[0105] If the expiration date of the token stored in the token storage unit 280 is not yet reached in step 106, the data generation unit 250 receives information about the operation performed directly by the user on the vehicle 10 in step 407, and the process proceeds to step 108. The subsequent processing is the same as the processing described with reference to FIG.

[0106] If the vehicle 10 has not forcibly switched the authentication method in step 121, the data generation unit 250 receives information about an operation performed directly by the user on the vehicle 10 in step 421, and the process proceeds to step 123. The subsequent processing is the same as the processing described with reference to FIG.

[0107] 8 is a flowchart showing the process performed by the in-vehicle device 100 according to the second embodiment. The same processes as those performed in the second embodiment, which are explained in FIG. 5, are denoted by the same reference numerals, and the explanation thereof will be omitted.

[0108] In step 500, the authentication unit 130 checks whether the other ECUs connected to the in-vehicle device 100 have been directly operated by the user, and if so, proceeds to step 501. If no direct operation has been performed by the user, the authentication unit 130 waits.

[0109] In step 501 , the authentication unit 130 transmits operation information requested by the user from the other ECU to the external terminal 200 , and then the process proceeds to step 200 .

[0110] Steps 500 and 501 are executed when the user directly operates the vehicle 10, and the process proceeds to step 200 by interruption.

[0111] According to this embodiment, even if the user directly gives operational instructions to the vehicle, the operational information is sent from the vehicle to the external terminal and authenticated, so it is possible to prevent the vehicle from becoming inoperable even if communication between the external terminal and the server is cut off.

[0112] It should be noted that the present invention is not limited to the above-described embodiment, and includes various modifications. For example, the above-described embodiment has been described in detail to clearly explain the present invention, and the present invention is not necessarily limited to an embodiment having all of the described configurations.

[0113] Furthermore, in the processing flows of the present invention in Figures 4 to 8, there is processing in which two or more devices wait for a response from the other party, but this is not necessarily limited to continuing to wait for a response from the other party, and if there is no response for a certain period of time, a timeout processing such as terminating the processing may be performed.

[0114] Also, in Figures 4 and 8, if token authentication fails, the external terminal 200 sends terminal information to the server 300 again to reissue the token, but the use of terminal information for token reissue is not limited to this. For example, when issuing a token from the server 300 to the external terminal 200, a refresh token may be issued at the same time, and when requesting token reissue, the external terminal 200 may make the reissue request using the refresh token rather than the terminal information.

[0115] In addition, although the present invention uses token authentication for server-mediated operation authentication and encryption key cryptography for terminal operation authentication, the present invention is not limited to these authentication methods, and any authentication method may be used depending on whether or not authentication is performed by a server. For example, instead of token authentication, a digital signature using an encryption key from a server may be applied.

[0116] Furthermore, although in the present invention, token authentication is performed between the vehicle 10 and the server 300, the token authentication method is not limited to this, and it is sufficient that a server is involved in authenticating an operation between the external terminal 200 and the vehicle 10. For example, when an operation is performed from the external terminal 200 to the vehicle 10, a token is transmitted to the server 300, and the server 300 authenticates the token, signs the token with an encryption key, and returns the signed token. A method in which the external terminal attaches the returned signed token to an operation request, and the vehicle 10 verifies the signature with an encryption key to confirm that the operation is authenticated by the server 300, may also be used.

[0117] Furthermore, each embodiment does not need to be independent, and the functions of each embodiment may be implemented simultaneously.

[0118] Furthermore, the above-described configurations, functions, processing units, processing means, etc. may be partly or entirely realized in hardware by designing them as integrated circuits, for example.

[0119] Furthermore, each of the above configurations, functions, etc. may be realized by software that causes a processor to realize each function. Information such as programs, tables, and files that realize each function can be stored in a storage device such as a memory, hard disk, or SSD (Solid State Drive), or in a storage medium such as an IC card, SD card, or DVD, or various storage media installed in a microcomputer.

[0120] The above-described embodiment of the present invention provides the following advantageous effects.

[0121] (1) An example of an in-vehicle device according to the present invention includes an authentication unit that performs authentication processing in response to a request from an external terminal, and a communication unit that transmits and receives information between the external terminal and a server. When the external terminal and the server are able to communicate, the authentication unit performs the authentication processing via the server, and when communication between the external terminal and the server is interrupted, the authentication unit performs the authentication processing without going through the server.

[0122] With the above configuration, it is possible to prevent the vehicle from becoming inoperable even when communication between the external terminal and the server is interrupted.

[0123] (2) The device further includes a generation unit that generates information used in the authentication process, the communication unit transmits the information to the external terminal, and receives encrypted information obtained by encrypting the information from the external terminal, and the authentication unit executes the authentication process using a token issued by the server when the external terminal and the server can communicate with each other, and executes the authentication process using the encrypted information when communication between the external terminal and the server is interrupted. The process of (1) is specifically executed in this manner.

[0124] (3) When the communication interruption between the external terminal and the server is resolved, the authentication unit switches from authentication processing using encryption information to authentication processing using tokens. Because encryption authentication processing carries the risk of being subject to cyber attacks by third parties, it is preferable to switch to token authentication as quickly as possible once the token becomes available.

[0125] (4) The authentication unit stops the authentication process when the vehicle's external communication function is able to communicate and communication between the external terminal and the server continues to be disrupted. If the vehicle's external communication function is able to communicate, there is a possibility that a third party may use the communication function to launch a cyber attack, so the authentication process is stopped to prevent internal programs from being tampered with.

[0126] (5) The vehicle further includes an operation monitoring unit that monitors the communication status with the server, and when a communication interruption between the external terminal and the server continues and the communication interruption between the server and the vehicle is resolved, the operation monitoring unit stops the authentication process using the encrypted information and transmits information about the communicating external terminal and current location information to the server. When the communication interruption between the server and the vehicle is resolved, token authentication becomes possible again, so it is preferable to stop the high-risk encrypted authentication process and further transmit various information to the server to use for log analysis.

[0127] (6) The operation monitoring unit further monitors the distance traveled since the engine was started, and stops the authentication process using the encryption information when the distance traveled during the authentication process using the encryption information exceeds a certain distance. If the authentication process using the encryption information continues for too long, the possibility of being subjected to a cyber-attack from outside increases, so this restriction is imposed on the authentication process using the encryption information to eliminate that risk.

[0128] (7) When switching between authentication processes, authentication using a password or biometric information of the user obtained from an external terminal is required. From the viewpoint of ensuring security, such processing is preferable.

[0129] (8) When switching between authentication processes, authentication using a password or biometric information of the user obtained from the in-vehicle device is required. As with (7), this type of processing is preferable from the perspective of ensuring security.

[0130] (9) Another example of a vehicle authentication system according to the present invention is a vehicle authentication system that includes a server, an external terminal, and an in-vehicle device, and switches between authentication methods between the external terminal and the in-vehicle device depending on the state of communication between the server and the external terminal, wherein the in-vehicle device includes an authentication unit that performs authentication processing in response to a request from the external terminal, and a communication unit that transmits and receives information between the external terminal and the server, and the authentication unit performs authentication processing via the server when communication between the external terminal and the server is possible, and performs authentication processing without going through the server when communication between the external terminal and the server is interrupted. Such a system can also be expected to have the same effects as the in-vehicle device according to (1).

[0131] 1... Vehicle system, 10... Vehicle, 100... In-vehicle device, 110... In-vehicle communication unit, 120... Random number generation unit, 130... Authentication unit, 140... Operation monitoring unit, 200... External terminal, 300... Server

Claims

1. An in-vehicle device comprising: an authentication unit which executes authentication processing in response to a request from an external terminal; and a communication unit which transmits and receives information between the external terminal and a server, wherein the authentication unit executes the authentication processing via the server when the external terminal and the server are able to communicate, and executes the authentication processing without going through the server when communication between the external terminal and the server is interrupted.

2. An in-vehicle device as described in claim 1, further comprising a generation unit that generates information to be used in the authentication process, wherein the communication unit transmits the information to the external terminal and receives cryptographic information in which the information is encrypted by the external terminal, and wherein the authentication unit, when the external terminal and the server are capable of communicating with each other, executes the authentication process using a token issued by the server, and, when communication between the external terminal and the server is interrupted, executes the authentication process using the cryptographic information.

3. An in-vehicle device as described in claim 2, characterized in that the authentication unit switches from the authentication process using the encryption information to the authentication process using the token when a communication interruption between the external terminal and the server is resolved.

4. An in-vehicle device as described in claim 3, characterized in that the authentication unit stops the authentication process when the vehicle's external communication function is capable of communication and communication between the external terminal and the server is still interrupted.

5. An in-vehicle device as described in claim 4, further comprising an operation monitoring unit that monitors the communication status with the server, wherein when a communication interruption between the external terminal and the server continues and the communication interruption between the server and the vehicle is resolved, the operation monitoring unit stops the authentication process using the encryption information and transmits information about the external terminal in communication and current location information to the server.

6. An in-vehicle device as described in claim 5, wherein the operation monitoring unit further monitors the distance traveled since the engine of the vehicle was started, and when the distance traveled during the execution of the authentication process using the encryption information exceeds a certain distance, the authentication process using the encryption information is stopped.

7. An in-vehicle device according to claim 3, wherein when switching the authentication process, authentication using a password or biometric information of the user obtained from the external terminal is required.

8. An in-vehicle device according to claim 3, wherein when switching the authentication process, authentication using a password or biometric information of the user acquired from the in-vehicle device is required.

9. A vehicle authentication system comprising a server, an external terminal, and an in-vehicle device, and switching an authentication processing method between the external terminal and the in-vehicle device depending on the communication state between the server and the external terminal, wherein the in-vehicle device comprises an authentication unit that executes authentication processing in response to a request from the external terminal, and a communication unit that transmits and receives information between the external terminal and the server, and wherein the authentication unit executes the authentication processing via the server when the external terminal and the server are able to communicate, and executes the authentication processing without going through the server when communication between the external terminal and the server is interrupted.

Images