Vehicle function activation method and device

Abstract

The present disclosure relates to a vehicle function activation method and device. The vehicle function activation method according to one embodiment of the present disclosure comprises steps in which: request information generated in a user terminal is verified in a server, and an electronic signature of the server is assigned and then is transferred to a vehicle; and validity verification of the electronic signature of the server, validity determination of the request information, and reuse determination are performed in the vehicle, and an electronic control device inside the vehicle is controlled on the basis of the results thereof so as to activate vehicle functions. According to the disclosure, a verification chain structure based on a stepwise verification is formed among the user terminal, the server and a vehicle function activation device, and thus forgery, falsification, and replay attacks on a request message can be prevented and unauthorized activation of vehicle functions can be prevented.

Description

Method and device for activating vehicle functions

[0001] The present disclosure relates to a state control technology for vehicle functions, and more specifically, to a method and apparatus for controlling the activation or deactivation of vehicle functions based on a verification chain structure that performs stepwise verification on request information exchanged between a user terminal, a server, and a vehicle function activation device equipped in a vehicle.

[0002] The following description merely provides background information related to the present embodiment and does not constitute prior art.

[0003] Recently, vehicles have been evolving into connected vehicles that include multiple electronic control units and communication functions, and vehicle manufacturers are introducing Feature on Demand (FoD) services that allow for the selective use of vehicle functions even after the vehicle has been delivered. In these services, vehicle functions such as adaptive cruise control, automatic emergency braking, lane keeping assist, and parking assist can be activated and used based on specific conditions or authorization information.

[0004] In a FoD service environment, the active status of vehicle functions may change based on authorization information or activation-related information generated or managed outside the vehicle. During this process, the aforementioned information may be transmitted to the vehicle, and the transmission method may take various forms, such as network communication or an internal vehicle interface.

[0005] However, there is a possibility of security vulnerabilities arising from such a function activation structure. For example, if activation-related information generated or transmitted externally is intercepted or falsified, vehicle functions could be activated without proper authorization. Furthermore, there is a possibility that vehicle functions could be abnormally activated due to replay attacks where previously used activation information is reused, or through the theft of authentication credentials.

[0006] Furthermore, as information related to function activation is transmitted through the user terminal, server, and vehicle, it may be difficult for the vehicle to sufficiently assess the reliability of the information generated or transmitted at each stage, potentially leading to limitations in relying on externally transmitted information. In particular, in structures where the use of vehicle functions is determined by processing results from outside the vehicle, problems may arise where it is difficult to verify their validity from within the vehicle. In such cases, communication protection or user authentication alone may not be sufficient to adequately prevent unauthorized activation of vehicle functions.

[0007] Therefore, technical means are required to ensure reliability throughout the entire process of generating, transmitting, and verifying information used to activate vehicle functions.

[0008] The present disclosure aims to provide a technology capable of verifying the validity and authenticity of a vehicle function activation request in an environment where the vehicle function activation request is generated and transmitted from outside the vehicle.

[0009] Specifically, the present disclosure aims to provide a method and apparatus for activating vehicle functions that can verify whether the vehicle function activation request information has been tampered with or forged, and whether the requesting entity has the authority, by applying a structure that performs stepwise verification on request information exchanged between a user terminal, a server, and a vehicle.

[0010] In addition, the purpose is to provide a vehicle function control technology capable of determining whether to process a request for vehicle function activation through user authentication and identification information verification.

[0011] The problems that the present invention aims to solve are not limited to those mentioned above, and other unmentioned problems will be clearly understood by a person skilled in the art from the description below.

[0012] According to one aspect of the present disclosure, a method for activating a vehicle function is provided by a vehicle function activation device equipped in a vehicle. The method may include: receiving a request message from a server containing request information for activating a vehicle function and an electronic signature generated with the server's private key; verifying the validity of the electronic signature generated with the server's private key using the server's public key; determining the validity of vehicle identification information and function identification information included in the request information; determining whether the request message is a reuse of a previously processed message; and, if it is determined that the electronic signature generated with the server's private key is valid and the request message is not a reused message, controlling at least one electronic control unit equipped in the vehicle to activate a vehicle function corresponding to the function identification information.

[0013] According to one embodiment, whether the request message is a reuse of a previously processed message can be determined by comparing the counter value included in the request information with the counter value stored inside the vehicle. Additionally, the counter value stored inside the vehicle can be increased after the vehicle function is activated, and the verification of the electronic signature can be performed within the hardware security module. Furthermore, the request information can be removed from the vehicle's internal storage after the vehicle function is activated. Meanwhile, if the request information includes an activation maintenance time parameter, the vehicle function can be controlled to remain active for a set period regardless of the vehicle's ignition status; if the activation maintenance time parameter is not included, the vehicle function can be controlled to be deactivated when it is detected that the vehicle's ignition status has been switched to off.

[0014] According to another aspect of the present disclosure, a vehicle function activation device is provided for a vehicle. The device may include a communication unit that receives a request message from a server, the request message including request information for vehicle function activation and an electronic signature generated with the server's private key; at least one memory that stores instructions; and at least one processor that executes the instructions. The at least one processor may be configured to verify the validity of the electronic signature generated with the server's private key using the server's public key, determine the validity of vehicle identification information and function identification information included in the request information, determine whether the request message is a reuse of a previously processed message, and if it is determined that the electronic signature is valid and the request message is not a reused message, control at least one electronic control unit for the vehicle to activate a vehicle function corresponding to the function identification information.

[0015] According to another aspect of the present disclosure, a method for supporting vehicle function activation performed by a server is provided. The method may include the steps of: receiving a request message from a user terminal comprising request information for vehicle function activation and a first electronic signature generated with the private key of the user terminal; verifying the validity of the first electronic signature using the public key of the user terminal; determining whether the vehicle function activation request is valid based on terminal identification information, user identification information, and vehicle identification information included in the request information; generating a second electronic signature with the server's private key for the request information; and transmitting the request information and the generated second electronic signature to a vehicle. According to one embodiment, the request information and the generated second electronic signature may be transmitted to a vehicle after receiving a user authentication completion message from the user terminal.

[0016] According to another aspect of the present disclosure, a method for requesting the activation of a vehicle function performed by a user terminal is provided. The method may include the steps of: receiving a request for the activation of a vehicle function from a user; generating request information for the activation of a vehicle function; generating a first electronic signature for the request information using the private key of the user terminal; transmitting the request information and the first electronic signature to a server; receiving a response message from a server containing a second electronic signature for the request information; verifying the validity of the second electronic signature using the public key of the server; performing user authentication if the second electronic signature is valid; and transmitting an authentication completion message to a server when user authentication is successfully completed. The user authentication may be performed using at least one of biometric authentication, a password, or the input of a personal identification number, and may be performed after verifying whether the request information included in the response message matches the request information generated by the user terminal.

[0017] According to an embodiment of the present disclosure, a verification chain structure is formed in which electronic signature verification and user authentication are sequentially performed between a user terminal, a server, and a vehicle function activation device, thereby ensuring the authenticity and integrity of the vehicle function activation request information.

[0018] In addition, falsification or alteration of request information can be prevented through stepwise verification of user terminal electronic signatures and server electronic signatures, and activation of vehicle functions by reused messages can be prevented through comparison of counter values ​​included in the request information.

[0019] In addition, by verifying the correspondence between user identification information and vehicle identification information, it is possible to control that vehicle functions are activated only for authorized users.

[0020] In addition, by removing the request information after the vehicle function is activated, the possibility of exposure of information stored inside the vehicle can be reduced.

[0021] The effects of the present disclosure are not limited to those mentioned above, and other unmentioned effects will be clearly understood by a person skilled in the art from the description below.

[0022] Figure 1 is a diagram illustrating the concept of the FoD service ecosystem.

[0023] FIG. 2 is a diagram illustrating the conceptual configuration of a vehicle function activation system according to one embodiment of the present disclosure.

[0024] FIG. 3 is a sequence diagram illustrating a vehicle function activation procedure between a user terminal, a server, and a vehicle function activation device according to one embodiment of the present disclosure.

[0025] FIG. 4 is a flowchart illustrating the operation procedure of a vehicle function activation processing method performed at a user terminal according to one embodiment of the present disclosure.

[0026] FIG. 5 is a flowchart illustrating the operation procedure of a vehicle function activation processing method performed on a server according to one embodiment of the present disclosure.

[0027] FIG. 6 is a flowchart illustrating the operation procedure of a vehicle function activation processing method performed in a vehicle function activation device according to one embodiment of the present disclosure.

[0028] FIG. 7 is a block diagram of an exemplary computing device for implementing a device for performing a method according to the present disclosure.

[0029] Some embodiments of the present disclosure are described in detail below with reference to exemplary drawings. It should be noted that in assigning reference numerals to the components of each drawing, the same components are given the same reference numeral whenever possible, even if they are shown in different drawings. Furthermore, in describing the present disclosure, if it is determined that a detailed description of related known components or functions could obscure the essence of the present disclosure, such detailed description is omitted.

[0030] In describing the components of the embodiments according to the present disclosure, symbols such as first, second, i), ii), a), b), etc., may be used. These symbols are intended only to distinguish the components from other components, and the essence, order, or sequence of the components is not limited by the symbols. When a part in the specification is described as 'comprising' or 'having' a component, this means that, unless explicitly stated otherwise, it does not exclude other components but may include additional components.

[0031] The detailed description set forth below, together with the accompanying drawings, is intended to describe exemplary embodiments of the present disclosure and is not intended to represent the only embodiment in which the present disclosure may be practiced.

[0032] In this specification, the term “vehicle function” means an operation performed by an electronic control unit of a vehicle or a function provided by such operation, and may include functions related to the driving, safety, convenience, or performance of the vehicle. Examples of vehicle functions may include, but are not limited to, adaptive cruise control (ACC), autonomous emergency braking (AEB), lane support system (LSS), and parking assist system (PAS).

[0033] Figure 1 is a diagram illustrating the concept of the FoD service ecosystem.

[0034] Referring to Figure 1, the FoD service ecosystem consists of various components such as a manufacturer, a FoD server, vehicle users, connected vehicles, a connected control unit (CCU), and an electronic control unit (ECU).

[0035] The manufacturer develops and produces vehicles and ECUs, and implements various functions that can be provided by the vehicle. These functions may be installed in the ECU in an initially disabled state for FoD services, and the manufacturer can register information about the functions with the FoD server to provide them to the user selectively.

[0036] The FoD server can be configured to manage vehicle and user information, provide functions, and manage function status. For example, the FoD server can process function purchases, manage function usage rights, handle requests for function activation or deactivation, and transmit function control information to the vehicle. Additionally, the FoD server can transmit and receive data with the vehicle via Over-the-Air (OTA).

[0037] As the entity utilizing the FoD service, the vehicle user can select or manage functions through the vehicle's infotainment system or a user terminal. To use the FoD service, the vehicle user possesses Personally Identifying Information (PII) and manages payment information such as credit card numbers.

[0038] The vehicle is identified by a Vehicle Identification Number (VIN) and includes a CCU for communicating with an external network and one or more ECUs that perform vehicle functions.

[0039] The in-vehicle CCU is responsible for the connection between the external network and the internal network. For example, the CCU can communicate with the FoD server to receive function-related control information and transmit it to the corresponding ECU via the internal network.

[0040] The in-vehicle ECU can be configured to enable or disable functions after verifying function-related information transmitted from the CCU. Additionally, the ECU can utilize a Hardware Security Module (HSM) for security purposes.

[0041] Meanwhile, FoD (Feature on Demand) service is a subscription-based service designed to selectively provide vehicle features to vehicle users, allowing users to purchase, use, or cancel specific vehicle features as needed. FoD service can be provided online or offline in a connected vehicle environment, and features can be remotely activated or deactivated even after the vehicle has been delivered.

[0042] One or more service types may be provided in the FoD service. For example, a user can acquire the right to use a feature by applying for a subscription to a specific vehicle function. Additionally, the user can request cancellation for features that are no longer needed, and if the subscription period ends, the feature may automatically expire and be disabled. Furthermore, the right to use a feature held by a user can be transferred to another user or another vehicle.

[0043] In such FoD services, control information related to function activation is exchanged between the vehicle, user terminal, and server, and security procedures such as user authentication, vehicle identification, function authorization verification, and data integrity verification are required during this process. In particular, security technology is necessary to prevent functions from being activated by unauthenticated users or tampered messages during the process of remotely activating functions.

[0044] The present disclosure provides a method and apparatus for a user terminal, a server, and a vehicle to cooperate in such a FoD service environment to verify a vehicle function activation request and securely activate the function.

[0045] FIG. 2 is a diagram illustrating the conceptual configuration of a vehicle function activation system according to one embodiment of the present disclosure.

[0046] In the present disclosure, a structure is adopted in which a user terminal (210), a server (220), and a vehicle function activation device (230) cooperate to verify a vehicle function activation request.

[0047] A user terminal (210) is a device carried by a user and is configured to receive a request for vehicle function activation and generate request information. The user terminal (210) may include a smartphone, tablet, or personal computer. The user terminal (210) may be configured to generate request information corresponding to the vehicle function activation request, generate a digital signature for the request information using a private key stored in the user terminal, construct a request message, and then transmit it to a server (220).

[0048] Additionally, the user terminal (210) may be configured to verify a request message transmitted from the server (220), check whether the request information matches, and then perform user authentication. For example, the user terminal (210) may verify an electronic signature generated by the server using the server's public key and check whether the request information included in the received request message matches the request information generated by the user terminal. Subsequently, the user terminal (210) may be configured to perform user authentication using biometric authentication, password or PIN input, etc., and transmit the authentication result to the server (220).

[0049] The server (220) is configured to verify a vehicle function activation request message received from a user terminal (210), and if verification is complete, to generate a transcribed signature with its own private key for the same request information to construct the request message and then transmit it to a vehicle function activation device (230).

[0050] The server (220) may be configured to verify the electronic signature included in the received request message and to confirm the validity of the request information. For example, the server (220) may be configured to determine that a request is valid only when all the correspondence relationships between the pre-registered user, user terminal, and vehicle are satisfied by verifying the terminal identification information, user identification information, and vehicle identification information included in the request information in conjunction. Additionally, the server (220) may be configured to check the validity of the subscription status for the requested vehicle function. For example, if the subscription period has expired or there is no permission to use the function, the server (220) may not forward the function activation request to the vehicle. Additionally, the server (220) may be configured to determine whether to retransmit a previously processed message by checking the timestamp or counter value included in the request message.

[0051] If verification is successfully completed, the server (220) can be configured to generate an electronic signature for the same request information using its private key so that the vehicle function activation device (230) can generate a trusted request message and transmit it to the vehicle.

[0052] The vehicle function activation device (230) is a device provided inside the vehicle and connected to one or more electronic control units, configured to verify a request message transmitted from the server (220) and to control whether to execute a vehicle function based on the verification result of the request message. The vehicle function activation device (230) may be implemented as a Central Control Unit (CCU), a Telematics Control Unit (TCU), or an ECU, but is not limited thereto.

[0053] The vehicle function activation device (230) can verify the digital signature using the server's public key and confirm the validity of the parameters included in the request information. The vehicle function activation device (230) may be configured to determine whether to retransmit a previously processed message by comparing a timestamp or counter value included in the request message with a value stored inside the vehicle.

[0054] When both electronic signature verification and the validity of the request information are satisfied, the vehicle function activation device (230) may be configured to control an electronic control unit inside the vehicle to activate the corresponding vehicle function. The vehicle function activation device (230) may be configured not to continuously store the request information in the vehicle's internal storage medium after the function activation process.

[0055] As described above, the requested vehicle function is activated only when all verification procedures performed at the user terminal (210), server (220), and vehicle function activation device (230) are satisfied, thereby preventing unauthorized activation or deactivation of the vehicle function due to forgery, tampering, disguise, or retransmission attacks.

[0056] FIG. 3 is a sequence diagram illustrating a vehicle function activation procedure between a user terminal, a server, and a vehicle function activation device according to one embodiment of the present disclosure. The procedure illustrated in FIG. 3 is performed by the interaction of a user terminal (210), a server (220), and a vehicle function activation device (230).

[0057] The procedure according to Fig. 3 is performed under the following preconditions.

[0058] First, a pre-subscription for the vehicle function is completed. Accordingly, the user terminal (210) and the server (220) each securely store a certificate, token, or equivalent data used for the vehicle function activation request, and the server (220) holds subscription information for the vehicle function.

[0059] Second, the vehicle function activation procedure begins with the vehicle's ignition turned on. Once a vehicle function is activated, if the ignition is turned off, the corresponding function is deactivated by default; however, if the request information includes an activation duration parameter, the activation state is maintained for an exceptionally set period.

[0060] Third, parameters required for vehicle function activation requests may be included optionally depending on the type of function, security policies, and / or system settings. For example, since parameters capable of identifying vehicles or individuals can be sensitive in terms of security and privacy, they may be included in requests only when absolutely necessary for function-specific activation. Alternatively, the inclusion of parameters such as activation retention time may be determined by considering the trade-off between usability and security.

[0061] Fourth, communication between the user terminal (210) and the server (220), and between the server (220) and the vehicle function activation device (230), is performed using cellular communication, etc., and is protected through an encrypted channel.

[0062] Fifth, the user terminal (210), the server (220), and the vehicle function activation device (230) each maintain a counter value, and the progress status of the counter value is managed so that the validity of the counter value included in the request message can be verified. If electronic signature verification, verification of the validity of request information, or user authentication fails during the vehicle function activation procedure, the corresponding request message is treated as invalid and the counter value is not updated. Conversely, each entity can update the corresponding counter value only when the verification, authentication, etc. of each step is successfully completed and the corresponding request message is processed normally.

[0063] In the present disclosure, “request information” refers to a logical data set generated to process a request to activate or deactivate a vehicle function and transmitted between a user terminal (210), a server (220), and a vehicle function activation device (230). The request information may initially be generated by the user terminal (210), subsequently verified by the server (220), and transmitted to the vehicle function activation device (230) with the server’s digital signature added. The request information includes a plurality of parameters, and may include, for example, the following parameters.

[0064] (a) Terminal identification parameter: A parameter representing the unique identifier of the user terminal that generated the request, which can be used to verify whether the request originated from a pre-registered user terminal. This allows for blocking requests to enable features from unregistered user terminals. For example, it may include, but is not limited to, the IMEI (International Mobile Equipment Identity).

[0065] (b) User identification parameter: An identification parameter corresponding to the subscription user account, which can be used to determine whether the request was generated by a user who holds feature subscription rights.

[0066] (c) Vehicle identification parameter: A parameter for specifying the target vehicle for which the function will be activated, which can be used to verify the legitimacy of the request based on the association between a specific user and a specific user terminal and the vehicle. For example, it may include, but is not limited to, a Vehicle Identification Number (VIN).

[0067] (d) Function identification parameter: A parameter for identifying a specific vehicle function that is the target of an activation request, which can be used by the server to verify the function usage rights granted to the vehicle and user.

[0068] (e) On / Off Flag Parameter: A parameter that indicates whether to enable or disable a vehicle function.

[0069] (f) Activation retention time parameter: A parameter that defines the duration for which the feature is enabled, and can be used to determine whether to allow the use of the feature without additional authentication for the set time.

[0070] (g) Timestamp parameter: Can be used to identify requests that are delayed or previously used.

[0071] (h) Counter parameter: A monotonically incrementing value synchronized between entities, which can be used to prevent replay attacks resulting from the retransmission of the same request.

[0072] The above parameters may be optionally included depending on security policies or system settings, and the technical concept of the present disclosure is not limited thereto even if some parameters are omitted or replaced with values ​​of other forms.

[0073] Referring to FIG. 3, the user checks the list of available vehicle functions in the vehicle through the user terminal (210) and selects the function to be activated (S301).

[0074] The user terminal (210) generates request information containing parameters necessary for activating a selected vehicle function. The user terminal (210) generates an electronic signature for the request information using its private key, and then constructs a first request message including the request information, the electronic signature, and its public key. In another embodiment, if the user terminal's public key or certificate is pre-registered with the server, the first request message may be constructed to include the request information and an electronic signature generated with the user terminal's private key for the request information. The first request message is transmitted to the server (220) (S302).

[0075] The server (220) receives a first request message, verifies the electronic signature included in the first request message, and verifies the validity of the request information. The server (220) verifies whether the request information was generated by the user terminal by verifying the electronic signature included in the first request message using the public key of the user terminal. The server (220) verifies the validity of the parameters included in the request information and checks the subscription status of the vehicle function that the user intends to activate, whether it is linked to a specific vehicle, and whether the counter value is valid (S303). For example, the server (220) may re-verify the validity of the subscription status to block requests generated by falsification or unauthorized use of the request information. For example, the server (220) may verify the linkage relationship between a specific user terminal, a specific user, and a specific vehicle using the terminal identification information (IMEI), personal identification information (PII), and vehicle identification information (VIN) included in the request information. Through this, it is confirmed whether the request information was generated based on the correspondence relationship between the user terminal, the user, and the vehicle that was previously registered.

[0076] When verification is successfully completed, the server (220) generates a digital signature with its private key for the same request information, and then constructs a second request message including the request information, the digital signature, and its public key. In another embodiment, if the server's public key or certificate is pre-registered on the user terminal, the second request message may be constructed to include the request information and the digital signature generated with the server's private key for the request information. The second request message is transmitted to the user terminal (210) (S304). Subsequently, the server (220) updates its counter value (e.g., increments by 1) (S305). The counter value is a monotonically increasing value indicating the processing order of the request message, and can be used to determine whether a previously processed message is reused as well as whether there is an issue with the order of the messages.

[0077] When the user terminal (210) receives the second request message, it verifies the digital signature generated by the server using the server's public key and checks whether the request information stored by the user terminal is identical to the request information included in the second request message (S306). If it is confirmed that they are identical, the user terminal (210) performs a user authentication procedure (S307). The user authentication procedure can be performed using various authentication means, such as fingerprint recognition, password, or PIN input.

[0078] When user authentication is successfully completed, the user terminal (210) sends an authentication completion message to the server (220) (S308) and updates its counter value (e.g., increments by 1) (S309).

[0079] When the server (220) receives an authentication completion message, it sends a third request message containing the same content as the second request message sent to the user terminal (210) to the vehicle function activation device (230) (S310).

[0080] When the vehicle function activation device (230) receives a third request message, it verifies the digital signature using the server's public key and checks the validity of the parameters included in the request information.

[0081] The vehicle function activation device (230) determines whether to retransmit a previously processed message by comparing the timestamp or counter value included in the third request message with a value stored inside the vehicle. For example, if the received counter value is inconsistent with the counter value stored inside the vehicle function activation device (230) or does not conform to a monotonically increasing rule, it can be determined that the message has been retransmitted.

[0082] When the validity of the electronic signature and request information is verified and it is determined that the message is not a retransmitted message, the vehicle function activation device (230) controls the electronic control unit inside the vehicle to activate the vehicle function according to the request information. After the vehicle function activation is completed, the vehicle function activation device (230) removes the received request information so that it is not continuously stored in the storage medium inside the vehicle (S311). The vehicle function activation device (230) updates its counter value (e.g., increments by 1) (S312).

[0083] Meanwhile, if the request information includes an activation maintenance time parameter, the vehicle function may remain active for a set period regardless of the vehicle's ignition status. After the set time has elapsed, the vehicle function is deactivated, and to use the vehicle function thereafter, a request message to activate the vehicle function must be received again from the server.

[0084] Conversely, if the request information does not include an activation duration parameter, the vehicle function is disabled when the vehicle's engine is turned off, and even if the engine is turned back on, the vehicle function will not be activated until a request message to activate the vehicle function is received again from the server.

[0085] The vehicle function activation procedure according to the present disclosure forms a verification chain structure in which a user terminal (210), a server (220), and a vehicle function activation device (230) perform verification step by step, and the following security characteristics are provided.

[0086] First, digital signature-based verification ensures the integrity and non-repudiation of data transmitted and received between entities, and allows each entity to verify the creator of the request message. Accordingly, forgery, alteration, or impersonation attacks on request messages can be prevented.

[0087] Second, the combination of server subscription information verification and user authentication at the user terminal can restrict the activation of functions by unauthorized users. In particular, by verifying the correspondence between terminal identification information, user identification information, and vehicle identification information together, the system can operate in such a way that function activation is permitted only when all combinations of a specific user, a specific terminal, and a specific vehicle are satisfied. For example, the server can determine whether a request is legitimate by checking the registration status of the terminal, the validity of the user account, the validity of subscription information, and the vehicle linkage status, and can prevent unauthorized use by third parties through user authentication performed at the user terminal.

[0088] Third, by checking the progress status of the counter value included in the request message, replay attacks caused by the retransmission of previously used request messages can be prevented. Each entity can block the reuse of past requests by verifying whether the received counter value conforms to a normal increment rule.

[0089] Fourth, the vehicle is configured so that information regarding function activation requests is not continuously stored inside, which can reduce the possibility of information related to function activation being leaked even if the vehicle is attacked. This reduces the possibility of personal information exposure and minimizes the attack surface.

[0090] Fifth, since the function activation procedure is performed based on the terminal possessed by the user, the function can be used through the same user authentication process even if the user changes vehicles. Accordingly, vehicle functions can be utilized in a manner that is not dependent on a specific vehicle.

[0091] Sixth, if the activation retention time parameter is set, the function can be maintained active for the set time regardless of the vehicle's ignition status (On / Off). For example, even if the vehicle's ignition is temporarily turned off for temporary parking or refueling and then turned back on, the vehicle function can be used continuously without additional authentication procedures. On the other hand, if the activation retention time parameter is not set, the vehicle function is deactivated when the vehicle's ignition is turned off, and even when restarted, the vehicle function can only be reactivated if a new request to activate the vehicle function is received from the server.

[0092] FIG. 4 is a flowchart illustrating the operation procedure of a vehicle function activation processing method performed at a user terminal (210) according to one embodiment of the present disclosure.

[0093] Referring to FIG. 4, the user can check a list of available vehicle functions through the user terminal (210) they possess and select a vehicle function they wish to activate. The user terminal (210) receives the vehicle function selected by the user (S401) and generates request information for activating the vehicle function (S402).

[0094] The user terminal (210) generates an electronic signature for the request information using the private key of the user terminal and constructs a request message and transmits it to the server (220) (S403). The request message includes the request information and the generated electronic signature, and may further include the public key or certificate of the user terminal depending on the embodiment.

[0095] When the user terminal (210) receives a response message from the server (220) containing the server's digital signature for the request information (S404), it verifies the digital signature included in the response message using the server's public key to determine whether the digital signature generated by the server is valid (S405).

[0096] If the electronic signature is determined to be invalid, the procedure is terminated.

[0097] If the electronic signature is determined to be valid, the user terminal (210) determines whether the request information included in the response message matches the request information generated by the user terminal (210) in step S402 (S406).

[0098] If it is determined that there is no match, the procedure is terminated, and the user terminal (210) performs the user authentication procedure only when it is determined that the request information matches (S407). The user authentication procedure can be performed using various authentication means, such as fingerprint recognition, password, or PIN input. Afterward, the user terminal (210) determines whether the user authentication was successful (S408).

[0099] If it is determined that user authentication has succeeded, the user terminal (210) sends an authentication completion message to the server (220) (S409) and simultaneously updates its counter value (e.g., increments by 1) (S410). On the other hand, if it is determined that user authentication has failed, the procedure is terminated.

[0100] In this way, the user terminal (210) determines whether to proceed with the vehicle function activation procedure based on the electronic signature verification of the request message transmitted from the server, the comparison of request information, and the user authentication result.

[0101] FIG. 5 is a flowchart illustrating the operation procedure of a vehicle function activation processing method performed in a server (220) according to one embodiment of the present disclosure.

[0102] Referring to FIG. 5, the server (220) receives a request message from the user terminal (210) that includes request information and a user terminal digital signature (S501).

[0103] The server (220) verifies the digital signature included in the request message using the public key of the user terminal to determine whether the digital signature generated by the user terminal is valid (S502).

[0104] If it is determined that the electronic signature is invalid, the server (220) may terminate the procedure or optionally respond to the user terminal (210) with a request rejection message.

[0105] If the electronic signature is determined to be valid, the server (220) determines the validity of the request information (S503).

[0106] For example, the server (220) may determine the validity of the request information by checking at least one of the following based on the parameters included in the request information, but is not limited thereto.

[0107] (i) whether the terminal identification parameter matches the previously registered terminal information,

[0108] (ii) whether user identification parameters correspond to user accounts linked to the terminal and vehicle,

[0109] (iii) whether the vehicle identification parameter corresponds to a vehicle registered in the above user account,

[0110] (iv) Whether the usage rights or subscription status for the vehicle function corresponding to the function identification parameter is valid.

[0111] If the request information is determined to be invalid, the server (220) may terminate the procedure or optionally respond to the user terminal (210) with a request rejection message.

[0112] If the request information is determined to be valid, the server (220) generates an electronic signature for the same request information using its private key and constructs a response message including the request information and the server electronic signature, and transmits it to the user terminal (210) (S504). Depending on the embodiment, the response message may further include the server's public key or certificate.

[0113] The server (220) updates its counter value (e.g., increments by 1) (S505).

[0114] When the server (220) receives an authentication completion message from the user terminal (210) indicating that user authentication is complete (S506), it transmits a message including request information and a server digital signature to the vehicle function activation device (230) (S507).

[0115] In this way, the server (220) determines whether to transmit a request for function activation to the vehicle in stages based on electronic signature verification, confirmation of the validity of the request information, and receipt of an authentication completion message.

[0116] FIG. 6 is a flowchart illustrating the operation procedure of a vehicle function activation processing method performed in a vehicle function activation device (230) according to one embodiment of the present disclosure.

[0117] Referring to FIG. 6, the vehicle function activation device (230) receives a message from the server (220) containing request information and a server digital signature (S601).

[0118] The vehicle function activation device (230) verifies the electronic signature included in the received message using the server's public key to determine whether the electronic signature generated by the server is valid (S602).

[0119] If the electronic signature is determined to be invalid, the procedure is terminated.

[0120] If the electronic signature is determined to be valid, the vehicle function activation device (230) determines the validity of the request information (S603).

[0121] For example, the vehicle function activation device (230) may verify at least one of the following based on parameters included in the request information, but is not limited thereto.

[0122] (i) whether the vehicle identification parameter corresponds to the vehicle, and

[0123] (ii) whether the function identification parameter corresponds to a vehicle function that is installed in or executable in the vehicle.

[0124] If the requested information is determined to be invalid, the procedure is terminated.

[0125] If the request information is determined to be valid, the vehicle function activation device (230) determines whether the received message corresponds to a replay of previously processed request information (S604). For example, the vehicle function activation device (230) compares the counter value and / or timestamp included in the received message with a previously stored internal reference value to determine whether the message is a duplicate message that has been received in the past.

[0126] If it is determined to be a retransmitted message, the procedure terminates.

[0127] If it is determined that the message is not a retransmitted message, the vehicle function activation device (230) controls the vehicle internal electronic control unit corresponding to the request information to activate the vehicle function (S605).

[0128] When the function activation is complete, the vehicle function activation device (230) removes the received request information for security purposes and updates its counter value (e.g., increases by 1) (S606).

[0129] As such, the vehicle function is activated only when all multiple security verifications (user terminal digital signature verification, server digital signature verification, and verification of request information validity and retransmission) are satisfied, and if any of the verifications fail, the vehicle function is not activated.

[0130] FIG. 7 is a block diagram of an exemplary computing device that can be used to implement a device for performing a method according to the present disclosure.

[0131] Referring to FIG. 7, the computing device (70) may include some or all of a memory (700), a processor (720), a storage (740), an input / output interface (760), and a communication interface (780). The computing device (70) may be a stationary computing device such as a desktop computer or a server, as well as a mobile computing device such as a laptop computer, a smartphone, or a vehicle electronic device. The computing device (70) may be implemented as a device constituting a user terminal (210), a server (220), or a vehicle function activation device (230), and may be implemented as various types of electronic devices such as a smartphone, a server device, an in-vehicle electronic control unit (ECU), or a telematics control unit (TCU). The computing device (70) may be configured to perform security-related processing such as generating a vehicle function activation request message, verifying an electronic signature, processing user authentication, verifying the validity of request information, and generating a vehicle control command.

[0132] Memory (700) may store a program that enables the processor (720) to perform a method or operation according to various embodiments of the present disclosure. For example, the program may include a plurality of instructions executable by the processor (720), and at least some of the methods according to the present disclosure may be performed by executing the plurality of instructions by the processor (720). Memory (700) may be composed of a single memory or multiple memories. In this case, information required to perform a method or operation according to various embodiments of the present disclosure may be stored in a single memory or distributed among multiple memories. If memory (700) is composed of multiple memories, the multiple memories may be physically separated. Memory (700) may include at least one of volatile memory and non-volatile memory. For example, volatile memory may include Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM), and non-volatile memory may include flash memory.

[0133] The processor (720) may include at least one core and can execute instructions stored in memory (700). The processor (720) may be composed of a single processor or multiple processors and may be configured to perform operations such as generating and verifying digital signatures, processing user authentication, verifying request messages, and generating vehicle control commands.

[0134] Storage (740) includes a storage medium that retains stored data even if the power supplied to the computing device (70) is cut off. For example, storage (740) may include non-volatile memory, magnetic tape, optical disk, magnetic disk, etc. A program stored in storage (740) may be loaded into memory (700) before being executed by the processor (720). Storage (740) may store a file written in a programming language, and a program generated from the file by a compiler, etc. may be loaded into memory (700). Storage (740) may store data to be processed by the processor (720) and / or data processed by the processor (720). Storage (740) may be configured to store a public key or certificate for digital signature verification, a counter value, subscription information, and authentication-related data.

[0135] The input / output interface (760) may include input devices such as a keyboard, mouse, touch display, microphone, etc., and output devices such as a display, speaker, etc. Through the input / output interface (760), the user can trigger the execution of a program by the processor (720) and / or check the processing results of the processor (720).

[0136] The communication interface (780) can provide access to internal and external networks. The communication interface (780) can support cellular communication, wireless LAN, Bluetooth, or telematics communication. The communication interface (780) can support communication with the vehicle's internal network and can be configured to transmit and receive control signals to and from the electronic control unit, for example, via CAN (Controller Area Network), LIN (Local Interconnect Network), or vehicle Ethernet. The computing device (70) can communicate with other devices through the communication interface (780).

[0137] Each component of the device or method according to the present invention may be implemented in hardware or software, or in a combination of hardware and software. Additionally, the function of each component may be implemented in software, and a microprocessor may be implemented to execute the function of the software corresponding to each component.

[0138] Various embodiments of the systems and techniques described herein may be realized as digital electronic circuits, integrated circuits, field programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include being implemented as one or more computer programs executable on a programmable system. A programmable system comprises a storage system, at least one input device, and at least one programmable processor (which may be a special-purpose processor or a general-purpose processor) coupled to receive data and instructions from at least one output device and to transmit data and instructions to them. Computer programs (which are also known as programs, software, software applications, or code) include instructions for the programmable processor and are stored on a "computer-readable recording medium."

[0139] Computer-readable recording media include all types of recording devices in which data that can be read by a computer system is stored. Such computer-readable recording media may be non-volatile or non-transitory media such as ROM, CD-ROM, magnetic tape, floppy disk, memory card, hard disk, magneto-optical disk, and storage device, and may also include transitory media such as data transmission media. Additionally, computer-readable recording media may be distributed across networked computer systems, and computer-readable code may be stored and executed in a distributed manner.

[0140] Although the flowcharts and timing diagrams in this specification describe each process as being executed sequentially, this is merely an illustrative explanation of the technical concept of one embodiment of the present disclosure. In other words, a person skilled in the art to which one embodiment of the present disclosure belongs may modify and adapt the flowcharts and timing diagrams in various ways, such as changing the order described in the flowcharts and timing diagrams or executing one or more of the processes in parallel, without departing from the essential characteristics of one embodiment of the present disclosure; therefore, the flowcharts and timing diagrams are not limited to a chronological order.

[0141] The above description is merely an illustrative explanation of the technical concept of the present embodiment, and a person skilled in the art to which the present embodiment belongs would be able to make various modifications and variations within the scope of the essential characteristics of the present embodiment. Accordingly, the present embodiments are intended to explain, not limit, the technical concept of the present embodiment, and the scope of the technical concept of the present embodiment is not limited by these embodiments. The scope of protection of the present embodiment shall be interpreted by the claims below, and all technical concepts within an equivalent scope shall be interpreted as being included within the scope of rights of the present embodiment.

[0142] CROSS-REFERENCE TO RELATED APPLICATION

[0143] This patent application claims priority to Korean patent application No. 10-2025-0025851 filed on February 27, 2025, the entire contents of which are incorporated into this patent application by reference.

Claims

1. A method performed by a vehicle function activation device provided in a vehicle, A process of receiving a request message from a server containing request information for activating vehicle functions and an electronic signature generated with the server's private key; A process of verifying the validity of an electronic signature generated by the private key of the said server using the public key of the said server; A process for determining the validity of vehicle identification information and function identification information included in the above request information; A process for determining whether the above request message is a reuse of a previously processed message; and A method comprising the process of activating a vehicle function corresponding to the function identification information by controlling at least one electronic control unit equipped in a vehicle when it is determined that an electronic signature generated with the private key of the server is valid and the request message is not a reused message.

2. In Paragraph 1, A method characterized by determining whether the above request message is a reuse of a previously processed message by comparing a counter value included in the request information with a counter value stored inside the vehicle.

3. In Paragraph 1, A method further comprising the process of increasing a counter value stored inside the vehicle by a predefined value after activating the vehicle function.

4. In Paragraph 1, A method characterized by the verification of an electronic signature generated with the private key of the above-mentioned server being performed within a hardware security module.

5. In Paragraph 1, A method further comprising the process of removing the request information from the vehicle internal storage after activating the vehicle function.

6. In Paragraph 1, If the above request information includes an activation maintenance time parameter, A method further comprising the process of controlling at least one electronic control unit to maintain the activated state of the vehicle function regardless of the vehicle's starting state for a time set by the activation maintenance time parameter from the time the vehicle function is activated.

7. In Paragraph 1, If the above request information does not include the activation retention time parameter, A method further comprising the process of controlling the at least one electronic control unit to disable the vehicle function when it is detected that the vehicle's ignition status is switched to off.

8. In a vehicle function activation device equipped in a vehicle, A communication unit that receives a request message from a server including request information for activating vehicle functions and an electronic signature generated with the server's private key; At least one memory for storing instructions; and Includes at least one processor, The above at least one processor executes the above instructions, Verify the validity of the digital signature generated by the private key of the said server using the public key of the said server, and Determine the validity of the vehicle identification information and function identification information included in the above request information, and Determine whether the above request message is a reuse of a previously processed message, and A vehicle function activation device configured to activate a vehicle function corresponding to the function identification information by controlling at least one electronic control unit equipped in the vehicle when it is determined that an electronic signature generated with the private key of the server is valid and the request message is not a reused message.

9. In Paragraph 8, A vehicle function activation device configured such that at least one processor compares a counter value included in the request information with a counter value stored inside the vehicle to determine whether the request message is a reuse of a previously processed message.

10. In Paragraph 8, A vehicle function activation device configured such that at least one processor increases a counter value stored inside the vehicle by a predefined value after activating the vehicle function.

11. In Paragraph 8, A vehicle function activation device configured to perform validation of an electronic signature generated with the private key of the above server within a hardware security module.

12. In Paragraph 8, A vehicle function activation device configured such that at least one processor removes the request information from the vehicle internal storage after activating the vehicle function.

13. In Paragraph 8, If the above request information includes an activation maintenance time parameter, A vehicle function activation device configured such that the above-mentioned at least one processor controls at least one electronic control unit provided in a vehicle so that the activation state of the vehicle function is maintained regardless of the vehicle's starting state for a time set by the activation maintenance time parameter from the time the vehicle function is activated.

14. In Paragraph 8, If the above request information does not include the activation retention time parameter, A vehicle function activation device configured such that the above-mentioned at least one processor controls at least one electronic control unit provided in the vehicle to disable the vehicle function when it is detected that the vehicle's ignition state is switched to off.

15. In the method performed by the server, A process of receiving a request message from a user terminal that includes request information for activating vehicle functions and a first electronic signature generated with the private key of the user terminal; A process of verifying the validity of the first electronic signature using the public key of the user terminal; A process of determining whether a request for vehicle function activation based on the request information is valid, based on terminal identification information, user identification information, and vehicle identification information included in the request information; The process of generating a second digital signature using the server's private key for the above request information; and A method comprising the process of transmitting the above request information and the generated second electronic signature to a vehicle.

16. In Paragraph 15, The process of transmitting the above request information and the generated second electronic signature to the vehicle is, A method characterized by being performed after receiving an authentication completion message indicating that user authentication has been completed from the above-mentioned user terminal.

17. In a method performed by a user terminal, The process of receiving a request from the user to activate vehicle functions; A process of generating request information for activating the above vehicle function; A process of generating a first electronic signature for the above request information using the private key of the user terminal; The process of transmitting the above request information and the above first electronic signature to the server; A process of receiving a response message from the above server that includes the request information and a second digital signature generated with the server's private key; A process of verifying the validity of the second electronic signature using the public key of the server above; A process of performing user authentication when the above second electronic signature is verified as valid; and A method including the process of sending an authentication completion message to the server when user authentication is successfully completed.

18. In Paragraph 17, A method characterized in that the above user authentication is performed using at least one of biometric authentication, password, or personal identification number input.

19. In Paragraph 17, A method further comprising a process of checking whether the request information included in the above response message matches the request information generated at the user terminal.

20. In Paragraph 19, A method characterized in that the above user authentication is performed when the above second electronic signature is verified to be valid and the request information included in the above response message is confirmed to match the request information generated at the above user terminal.

Images