WO2025004126A1 - In-vehicle device and vehicle authentication system - Google Patents

Abstract

An in-vehicle device 100 according to the present invention comprises: an authentication unit 130 for executing authentication processing in response to a request from an external terminal 200; and a communication unit 110 for transmitting and receiving information to/from the external terminal 200 and a server 300. The authentication unit 130 executes authentication processing via the server 300 when the external terminal 200 and the server 300 can communicate with each other, and executes authentication processing without going via the server 300 when communication between the external terminal 200 and the server 300 is interrupted.

Description

In-vehicle device and vehicle authentication system

The present invention relates to an in-vehicle device and a vehicle authentication system.

In recent years, the popularity of connected cars has led to an increase in the number of in-vehicle ECUs (Electrical Control Units). This has led to the widespread use of smart key systems that do not use physical keys to operate the vehicle. In such systems, mutual communication is carried out between mobile devices such as smartphones, in-vehicle control devices such as gateways, and server devices operated by administrators such as dealers, and authentication processing of operation information is carried out. There is a trend towards using tokens for this type of authentication due to security against wiretapping and the ease of maintaining authentication information.

However, in a system that performs authentication through mutual communication with a distant server, there is a risk that operations will not be possible in areas where communication with the server is not possible, such as underground parking lots. Prior art that anticipates such cases includes a method of performing authentication when communication between an external terminal and a server is interrupted, as described in Patent Document 1.

JP 2021-37889 A

Patent Document 1 describes an authentication method for when communication between an external terminal and a server is interrupted, in which multiple cryptographic tokens for authentication are acquired in advance between the external terminal and the server, and "authentication with the vehicle-side system is performed without using tokens when a specified operation is performed." The specified operation refers to "when a low-security level operation is performed" by assigning a security level to each operation performed on the vehicle from the external terminal in advance. This reduces the consumption of cryptographic tokens and prevents the vehicle from becoming inoperable when communication with the server is interrupted. However, this is merely a method of reducing risk, and if a high-security level operation is performed multiple times, the risk of the vehicle becoming inoperable in an area where communication is unavailable remains.

The present invention was made in consideration of the above problems, and aims to provide an in-vehicle device and a vehicle authentication system that prevents the vehicle from becoming inoperable even when communication between an external terminal and a server is interrupted.

In order to solve the above problems, the in-vehicle device according to the present invention includes an authentication unit that executes authentication processing in response to a request from an external terminal, and a communication unit that transmits and receives information between the external terminal and a server. When the external terminal and the server are able to communicate, the authentication unit executes authentication processing via the server, and when communication between the external terminal and the server is interrupted, the authentication unit executes authentication processing without going through the server.

According to the present invention, it is possible to prevent the vehicle from falling into a state in which it is impossible to operate even when communication between the external terminal and the server is interrupted.
Further features related to the present invention will become apparent from the description of the present specification and the accompanying drawings. Furthermore, the objects, configurations and effects other than those described above will become apparent from the following description of the embodiments.

1 is a block diagram showing the overall configuration of a vehicle authentication system according to an embodiment of the present invention. An example of the operation screen displayed on an external terminal. An example of an action screen prompting for user information. 6 is a flowchart showing a process of an external terminal according to the first embodiment of the present invention. 4 is a flowchart showing a process of the in-vehicle device according to the first embodiment of the present invention. 6 is a flowchart showing a process of a server according to the first embodiment of the present invention. 10 is a flowchart showing a process of an external terminal according to the second embodiment of the present invention. 10 is a flowchart showing a process of an in-vehicle device according to a second embodiment of the present invention.

The following describes the embodiment with reference to the drawings.

[Example 1]
FIG. 1 is a functional block diagram showing the configuration of a vehicle authentication system 1 according to a first embodiment of the present invention, which has an in-vehicle control device 100 (hereinafter simply referred to as the in-vehicle device 100), an external terminal 200, and a server device 300 (hereinafter simply referred to as the server 300).

In the vehicle authentication system 1, the user can instruct the vehicle 10 to perform various operations from the external terminal 200. When the in-vehicle device 100 installed in the vehicle 10 receives an operation from the external terminal 200, it authenticates whether the operation is a legitimate operation, and if the authentication is successful, it instructs other control ECUs in the vehicle 10 to perform the operation. In this embodiment, when the external terminal 200 can communicate with the server 300, authentication is performed using a token, and when the communication is interrupted, authentication between the in-vehicle device 100 and the external terminal 200 is performed by encryption key authentication using an encryption key.

The in-vehicle device 100 is mounted on the vehicle 10, and is connected to the external communication device 20, the door control ECU 30, the engine control ECU 40, and the GPS (Global Positioning System) receiver 50 via an in-vehicle communication path such as a CAN (Control Area Network), and performs communication. The external communication device 20 supports long-distance wireless communication standards such as 5G, and performs wireless communication with the server 300.

The in-vehicle device 100 is made up of a well-known microcomputer equipped with a memory and a CPU, and includes an in-vehicle communication unit 110, a random number generation unit 120, an authentication unit 130, an operation monitoring unit 140, and a storage unit 150. The storage unit 150 further includes a key information storage unit 160, a terminal information storage unit 170, a function switching information storage unit 180, and a log storage unit 190. Note that although the key information storage unit 160, the terminal information storage unit 170, the function switching information storage unit 180, and the log storage unit 190 are represented as separate blocks, they may be individually allocated to the storage area of a single storage medium, or may be arbitrarily arranged in the storage areas of multiple storage media.

The in-vehicle communication unit 110 is a well-known communication module that has the function of communicating with the external terminal 200 via wireless communication such as Wi-Fi (registered trademark) or Bluetooth (registered trademark). It also communicates with the server 300 via the external communication device 20. Note that in this embodiment, the in-vehicle communication unit 110 communicates with the external terminal 200 using a short-range communication standard, but if it supports a long-range communication standard such as 5G, it may have the function of communicating directly with the server 300 without going through the external communication device 20.

The random number generation unit 120 is a well-known module that generates random numbers to be used for encryption key authentication when communication between the external terminal 200 and the server 300 is interrupted.

The authentication unit 130 is a module that includes a server-via-server operation authentication unit 132, a terminal operation authentication unit 134, and a function switching authentication unit 136, and performs authentication of operation instructions from the external terminal 200 to the vehicle 10.

The server-mediated operation authentication unit 132 is in an active state when communication is possible between the external terminal 200 and the server 300, and performs authentication of the operation received from the external terminal 200. Specifically, the server-mediated operation authentication unit 132 performs authentication of the operation instruction received from the external terminal 200 via the server. In this embodiment, the server-mediated operation authentication unit 132 performs authentication using a token. The server-mediated operation authentication unit 132 transmits the token attached to the operation instruction received from the external terminal 200 to the server 300 via the external communication device 20 and performs verification of the validity of the token. If the token is authenticated by the server 300, the operation requested from the external terminal 200 is executed. Note that the token authentication method is not limited to the above method, and for example, the server 300 may encrypt the token information with an encryption key held by the server 300 and digitally sign the token, so that the server may be involved in the authentication method even if the vehicle 10 and the server 300 do not directly communicate with each other.

When communication between the external terminal 200 and the server 300 is interrupted, the terminal operation authentication unit 134 becomes active upon receiving a function switching request from the external terminal 200, and performs authentication of operation instructions between the external terminal 200 and the vehicle 10. In this embodiment, the terminal operation authentication unit 134 performs authentication of operation instructions by encryption authentication using an encryption key. Specifically, the encryption key encryption given to the operation information from the external terminal 200 is decrypted by a pair of encryption keys shared in advance between the external terminal 200 and the vehicle 10, and authentication is performed. If the operation is authenticated, the requested operation is executed.

The function switching authentication unit 136 switches between the active states of the server-via-operation authentication unit 132 and the terminal operation authentication unit 134 in response to a function switching request received from the external terminal 200. Specifically, it compares function switching information, including the user's password and biometric information such as face and fingerprint, attached to the function switching request with pre-registered regular function switching information to authenticate the function switching. If the function switching request is authenticated, it sets the server-via-operation authentication unit 132 to an inactive state and the terminal operation authentication unit 134 to an active state, and switches the authentication for the operation request from the external terminal 200 from authentication using a token (token authentication) to authentication using an encryption key (encryption key authentication). Note that the user information used for this switching may not be input from the external terminal 200, but may be input, for example, from a camera or navigation system installed in the vehicle.

The operation monitoring unit 140 starts monitoring the in-vehicle communication unit 110, the external communication device 20, and the engine control ECU 40 when the authentication method of the authentication unit 130 is switched from token authentication to encryption key authentication. The monitoring of the in-vehicle communication unit 110 or the external communication device 20 monitors the communication state between the vehicle and the server, and if the communication state with the server is possible but an operation request by encryption key authentication from an external terminal continues, a notification is sent to the external terminal and the authentication method is switched to token authentication. The monitoring of the engine control ECU 40 monitors the travel distance from the engine start after switching to encryption key authentication, and if an operation request by encryption key authentication from an external terminal continues even after driving a certain distance or more after switching to encryption key authentication, the authentication method is switched to token authentication. The reason for switching to token authentication in this way is that there is a high possibility of being subjected to a cyber attack by a third party when the external communication function of the vehicle is active or when encryption authentication has continued for a certain period of time or more. When this function is used to forcibly switch the authentication method, the terminal information and communication log of the external terminal 200 currently communicating, current location information from the GPS receiver 50, and the timestamp of the switch are stored in the log storage unit 190. If communication between the vehicle 10 and the server 300 is possible, the information stored in the log storage unit 190 is sent to the server 300 to notify the server 300 of the possibility of unauthorized use (cyber attack). In addition, if unauthorized use is discovered, encryption key authentication using the encryption key used this time will not be possible unless the external terminal that performed the communication is reconfigured by the server 300 as a legitimate terminal. This monitoring is performed to prevent unauthorized and continuous use of authentication methods that do not go through the server.

The key information storage unit 160 stores encryption key information that has been shared in advance between the external terminal 200 and the vehicle 10.

The terminal information storage unit 170 stores the identification information of the external terminal acquired when registering the external terminal 200 that communicates with the in-vehicle device 100.

The function switching information storage unit 180 stores user information used by the function switching authentication unit 136.

The log storage unit 190 stores information when the operation monitoring unit 140 forcibly switches the authentication method.

Next, the functional configuration of the external terminal 200 will be described. The external terminal 200 is made up of a well-known microcomputer equipped with a memory and a CPU, and includes a terminal communication unit A210, a terminal communication unit B220, a display unit 230, an operation unit 240, a data generation unit 250, and a storage unit 260. The storage unit 260 further includes a terminal key information storage unit 270, a token storage unit 280, and a terminal function switching information storage unit 290. Note that although the terminal key information storage unit 270, the token storage unit 280, and the terminal function switching information storage unit 290 are represented as separate blocks, they may be individually allocated to the storage area of a single storage medium, or may be arbitrarily arranged in the storage areas of multiple storage media.

The terminal communication unit A210 communicates with the server 300 using a long-distance communication standard such as 5G (fifth generation mobile communication system).

The terminal communication unit B220 is a well-known communication module that has the function of communicating with the in-vehicle device 100 via wireless communication such as Wi-Fi (registered trademark) or Bluetooth (registered trademark). Note that in this embodiment, communication with the server 300 is performed by the terminal communication unit A210, and communication with the in-vehicle device 100 is performed by the terminal communication unit B220, but if the communication standards can be unified or if one module is used that supports multiple communication standards, the terminal communication units may be combined into one module.

The display unit 230 displays on the LCD screen the operations that the user can currently perform on the vehicle 10, as shown in FIG. 2.

The operation unit 240 acquires input of operations performed by the user in response to the display on the display unit 230.

The data generation unit 250 includes a terminal function switching authentication unit 252 and a cryptography generation unit 254, and generates data to be sent to the vehicle 10. Normally, a token is attached to the operation information obtained from the operation unit 240 and the data is sent to the in-vehicle device 100. When the authentication method is switched to encryption key authentication, an encryption key cipher is attached to the operation information and the data is sent to the in-vehicle device 100.

When communication between the external terminal 200 and the server 300 is interrupted, the terminal function switching authentication unit 252 of the data generation unit 250 causes the display unit 230 to display a screen that asks the user whether to switch the authentication method. If the user requests to switch the authentication method, the data generation unit 250 causes the display unit 230 to display a screen that asks the user to enter function switching information such as a password or biometric information as shown in FIG. 3, and checks whether the entered information matches the function switching information that was registered in advance. If the information matches, data for an authentication method switching request is generated with the acquired user information attached, and is sent to the in-vehicle device 100.

When the authentication method is switched to encryption key authentication, the encryption code generation unit 254 of the data generation unit 250 uses the encryption key to generate an encryption code to be assigned to the operation information.

The terminal key information storage unit 270 stores the encryption key used when the authentication method is switched to encryption key authentication.

The token storage unit 280 stores a token issued by the server 300, which is added to the operation information during token authentication by the authentication method. Note that the number of tokens stored is not limited to one, and multiple tokens may be stored as in Patent Document 1.

The terminal function switching information storage unit 290 stores user information such as passwords and biometric information required for switching authentication methods.

Next, the functional configuration of the server 300 will be described. The server 300 includes a terminal information authentication unit 310, a token authentication unit 320, a token generation unit 330, a server communication unit 340, and a storage unit 350. The storage unit 350 further includes a terminal information storage unit 360 and a server token storage unit 370.

The server 300 issues a token to the external terminal 200 and authenticates the token with the vehicle 10. Note that the terminal information storage unit 360 and the server token storage unit 370 are represented as separate blocks, but they may be individually allocated to the storage area of a single storage medium, or may be arbitrarily arranged in the storage areas of multiple storage media.

When the terminal information authentication unit 310 first communicates with the external terminal 200, it links the terminal information of the external terminal 200 with the information of the paired vehicle 10 and stores them in the terminal information storage unit 360. From the next time an external terminal accesses the unit, it checks whether the information of the external terminal that accessed the unit matches the information stored in the terminal information storage unit 360, and if they match, it allows the token generation unit 330 to issue a token.

The token authentication unit 320 authenticates whether the token sent from the vehicle 10 is genuine, and if it is genuine, returns a positive response to the vehicle 10.

The token generation unit 330 issues a token to the external terminal 200, and stores the currently issued token information and the issued terminal information as a set in the server token storage unit 370. A new token is issued to the external terminal 200 when an issuance request from the external terminal 200 is permitted by the terminal information authentication unit 310, or when the token authentication sent from the vehicle 10 is successful. In addition, an expiration date is set for the issued token, and if the token expiration date has expired or if the token authentication from the vehicle 10 has failed, the current token information stored in the server token storage unit 370 is discarded, and authentication processing cannot be performed with that token.

The server communication unit 340 is an existing wireless communication module that communicates between the external terminal 200 and the vehicle 10 or the in-vehicle device 100 using a long-distance communication standard such as 5G.

The terminal information storage unit 360 stores the terminal information of the external terminal 200 that has been permitted to access by the terminal information authentication unit 310.

The server token storage unit 370 stores the currently valid tokens issued by the token generation unit 330 and the terminal information for which the tokens were issued.

Next, the processing executed by each processing unit in this embodiment will be described using a flowchart. FIG. 4 is a flowchart of the processing executed by the external terminal 200 according to the first embodiment.

First, in step 100, the external terminal 200 sends its own terminal information to the server 300, requests the issuance of a token, and proceeds to step 101. In step 101, the external terminal 200 waits for a response from the server 300, and if the terminal authentication is successful, it proceeds to step 102, and if it is unsuccessful, it proceeds to step 100.

In step 102, the external terminal 200 stores the token issued by the server 300 in the token storage unit 280 and proceeds to step 103.

In step 103, the external terminal 200 checks the communication status with the server 300 and proceeds to step 104. In step 104, if the communication status between the external terminal 200 and the server 300 is available, the process proceeds to step 105, and if the communication status is interrupted, the process proceeds to step 111. From here on, steps 105 to 110 represent the authentication process using a token, and steps 111 to 125 represent the process flow for authentication process using encryption key cryptography.

In step 105, the data generation unit 250 checks the expiration date of the token stored in the token storage unit 280 and proceeds to step 106. In step 106, if the expiration date of the token stored in the token storage unit 280 is within the expiration date, the process proceeds to step 107; if the expiration date has expired, the currently stored token is discarded and the process proceeds to step 100.

In step 107, the data generation unit 250 reads the operation information input by the user from the operation unit 240, and proceeds to step 108.

In step 108, the data generation unit 250 generates transmission data by adding the token stored in the token storage unit 280 to the operation information read from the operation unit 240, and transmits the data from the terminal communication unit B220 to the vehicle 10, and proceeds to step 109. In step 109, the external terminal 200 waits for a response to the operation information from the vehicle 10, and if the response is positive, proceeds to step 110, and if the response is negative, discards the currently stored token and proceeds to step 100.

In step 110, the external terminal 200 discards the token sent to the vehicle 10, stores the newly issued token from the server 300 in the token storage unit 280, and proceeds to step 103.

If the communication state between the external terminal 200 and the server 300 is interrupted in step 104, then in step 111 the terminal function switching authentication unit 252 displays a screen for the user to confirm whether or not to switch the authentication method, and proceeds to step 112. In step 112, the terminal function switching authentication unit 252 waits for input from the user, and if the input read from the operation unit 240 indicates that switching of the authentication function is necessary, it proceeds to step 113, and if not, it proceeds to step 103.

In step 113, the terminal function switching authentication unit 252 displays a screen on the display unit 230 requesting the user to input function switching information such as a password and biometric information as shown in FIG. 3, and then proceeds to step 114.

In step 114, the terminal function switching authentication unit 252 waits for input from the user, compares and authenticates the function switching information read from the operation unit 240 with the function switching information stored in the terminal function switching information storage unit 290, and proceeds to step 115. In step 115, if the authentication of the function switching information is successful, the process proceeds to step 116; if it is unsuccessful, the process proceeds to step 103.

In step 116, the data generation unit 250 adds the function switching information authenticated in step 114 to the authentication method switching request, transmits it from the terminal communication unit B220 to the vehicle 10, and proceeds to step 117. In step 117, the terminal function switching authentication unit 252 waits for a response to the authentication method switching request from the vehicle 10, and proceeds to step 118 if the response is positive, or to step 103 if the response is negative.

In step 118, the terminal function switching authentication unit 252 checks the communication state between the terminal communication unit A210 and the server 300, and proceeds to step 119. In step 119, if the communication state with the server 300 is not available, the process proceeds to step 121; if the communication state is available, the process proceeds to step 120.

In step 120, the terminal function switching authentication unit 252 switches the authentication method from encryption key authentication to token authentication, and proceeds to step 103.

In step 121, the terminal function switching authentication unit 252 checks whether forced switching of the authentication method has been performed by the vehicle 10. If forced switching has not been performed, the process proceeds to step 122. If forced switching has been performed, the process stops operation of the vehicle 10 by the external terminal 200 and ends the process.

In step 122, the data generation unit 250 reads the user's operation from the operation unit 240, and proceeds to step 123. This operation is any operation commanded by the user to the vehicle 10.

In step 123, the data generation unit 250 generates transmission data based on the operation information read from the operation unit 240, transmits an operation request from the terminal communication unit B220 to the vehicle 10, and proceeds to step 124.

In step 124, the encryption key encryption generator 254 receives an encryption key encryption request including random number information from the vehicle 10, generates an encryption key encryption from the received random number and the encryption key stored in the terminal key information storage unit 270, and proceeds to step 125.

In step 125, the data generation unit 250 generates transmission data from the encryption key encryption generated by the encryption generation unit 254 in step 124, transmits the data from the terminal communication unit B220 to the vehicle 10, and proceeds to step 118 after receiving a response from the vehicle 10.

FIG. 5 is a flowchart of the process executed by the in-vehicle device 100 according to the first embodiment.

First, in step 200, the in-vehicle device 100 checks whether a request to switch the authentication method has been received from the external terminal 200. If there is a request to switch, the process proceeds to step 201. If there is no request to switch, the process proceeds to step 221. From here on, steps 201 to 220 represent the process flow of authentication processing using encryption key encryption, and steps 221 to 226 represent the process flow of authentication processing using a token.

In step 201, the function switching authentication unit 136 performs a comparison and authentication between the function switching information, including the user's password and biometric information such as a facial image, contained in the authentication method switching request received from the external terminal 200, and the function switching information stored in the function switching information storage unit 180, and then proceeds to step 202. In step 202, if the authentication of the function switching information in step 201 is successful, the process proceeds to step 204, and if it is unsuccessful, the process proceeds to step 203.

In step 203, the authentication unit 130 transmits a negative response to the authentication method switching request from the in-vehicle communication unit 110 to the external terminal 200, and proceeds to step 200. In step 204, the authentication unit 130 transmits a positive response to the authentication method switching request from the in-vehicle communication unit 110 to the external terminal 200, and proceeds to step 205.

In step 205, the function switching authentication unit 136 switches the authentication method of the in-vehicle device 100 in response to an operation request from the external terminal 200 from token authentication to encryption key encryption authentication. At the same time, the operation monitoring unit 140 starts saving the communication contents and timestamps between the in-vehicle device 100 and the external terminal 200 after the authentication method switching, and the information of the external terminal 200 in the log storage unit 190, and proceeds to step 206.

In step 206, it is confirmed whether operation monitoring by the operation monitoring unit 140 is being performed. If it is being performed, the process proceeds to step 208. If it is not being performed, the process proceeds to step 207. In step 207, the operation monitoring unit 140 starts monitoring the communication state between the vehicle 10 and the server 300 by the external communication device 20, and the distance traveled by the vehicle 10 after the engine control ECU 40, and proceeds to step 208. Note that if the authentication method for operation information from the external terminal 200 is encryption key authentication for a certain period of time or more even though the communication state between the vehicle 10 and the server 300 has returned to communication-enabled, or if the distance traveled by the vehicle 10 since switching to encryption key authentication exceeds a certain distance, the operation monitoring unit 140 determines that the operation state of the vehicle is NG.

In step 208, the authentication unit 130 waits to receive an operation request from the external terminal 200, and if an operation request is received, the process proceeds to step 209. If no operation request is received, the process continues to wait.

In step 209, the random number generation unit 120 generates a random number for the encryption key encryption and proceeds to step 210.

In step 210, the random number generation unit 120 transmits the random number information generated in step 209 from the in-vehicle communication unit 110 to the external terminal 200, and then proceeds to step 211.

In step 211, the authentication unit 130 waits to receive the encryption key cipher from the external terminal 200, and if an encryption key cipher is received, the process proceeds to step 212.

In step 212, the terminal operation authentication unit 134 decrypts the encryption key encryption received from the external terminal 200 using the encryption key stored in the key information storage unit 160, and then proceeds to step 213.

In step 213, the terminal operation authentication unit 134 checks whether the encryption key encryption decrypted in step 212 matches the random number generated by the random number generation unit 120 in step 209. If they match, the process proceeds to step 214; if they do not match, the process proceeds to step 200.

In step 214, the authentication unit 130 sends a negative response to the external terminal 200 and proceeds to step 200.

In step 215, the authentication unit 130 sends a positive response to the external terminal 200 and proceeds to step 216.

In step 216, the authentication unit 130 performs the operation requested by the external terminal 200 and proceeds to step 217.

In step 217, the operation monitoring unit 140 checks whether the current operation status of the vehicle 10 is in an operation NG state, and if it is, proceeds to step 218, and if it is not, proceeds to step 206.

In step 218, the operation monitoring unit 140 forcibly switches the authentication method from encryption key encryption authentication to token authentication, locks the current encryption key so that it cannot be used for authentication, and proceeds to step 219.

In step 219, the operation monitoring unit 140 monitors the communication state between the vehicle 10 and the server 300, and if communication is possible, the process proceeds to step 220. If communication is not possible, the process waits.

In step 220, the operation monitoring unit 140 combines the latest log in the log storage unit 190 and the current location information from the GPS receiver 50, and transmits this as an unauthorized use notification from the external vehicle communication device 20 to the server 300, and ends the authentication process.

If there is no request to switch the authentication method in step 200, in step 221, the authentication unit 130 waits for an operation request and token from the external terminal 200, and if they are received, proceeds to step 222. If they are not received, it continues to wait.

In step 222, the server-via-operation authentication unit 132 extracts the token information attached to the operation request received in step 221, transmits a token authentication request from the exterior vehicle communication device 20 to the server 300, and proceeds to step 223. In step 223, it waits for a response to the token authentication request from the server 300, and proceeds to step 225 if the authentication is successful, or proceeds to step 224 if the authentication is unsuccessful.

In step 224, the authentication unit 130 sends a negative response to the external terminal 200 and proceeds to step 200.

In step 225, the authentication unit 130 sends a positive response to the external terminal 200 and proceeds to step 226.

In step 226, the authentication unit 130 performs the operation requested by the external terminal 200 and proceeds to step 200.

FIG. 6 is a flowchart of the process executed by the server 300 according to the first embodiment.

First, in step 300, the server 300 determines the type of request it has received. If the request is a token issuance request received from the external terminal 200, it proceeds to step 301. If the request is a token authentication request received from the vehicle 10, it proceeds to step 307.

If the received request is for token issuance, in step 301, the terminal information authentication unit 310 performs a comparison authentication between the terminal information received from the external terminal 200 and the terminal information stored in the terminal information storage unit 360, and then proceeds to step 302.

In step 302, if the terminal information authentication unit 310 compares the terminal information performed in step 301 and the results show a match, it proceeds to step 304, and if the results show a match, it proceeds to step 303.

In step 303, the terminal information authentication unit 310 sends a negative response from the server communication unit 340 to the external terminal 200, and proceeds to step 300.

In step 304, the terminal information authentication unit 310 sends a positive response from the server communication unit 340 to the external terminal 200, and proceeds to step 305.

In step 305, the token generation unit 330 issues a new token, stores the token information in the server token storage unit 370, and proceeds to step 306.

In step 306, the token generation unit 330 transmits the token from the server communication unit 340 to the external terminal 200, and the process proceeds to step 300.

If the request received in step 300 is for token authentication, in step 307, the token authentication unit 320 performs authentication using the token information received from the vehicle 10 and the token information stored in the server token storage unit 370, and proceeds to step 308.

In step 308, the token authentication unit 320 checks the result of the authentication performed in step 307, and if the authentication is successful, the process proceeds to step 310, and if the authentication is unsuccessful, the process proceeds to step 309.

In step 309, the token authentication unit 320 sends a negative response from the server communication unit 340 to the vehicle 10, and proceeds to step 300.

In step 310, the token authentication unit 320 sends a positive response from the server communication unit 340 to the vehicle 10, and proceeds to step 311.

In step 311, the token generation unit 330 issues an update token and proceeds to step 312.

In step 312, the token generation unit 330 transmits the token issued in step 311 to the external terminal 200 from the server communication unit 340, and then proceeds to step 300.

As described above, according to this embodiment, the authentication method for the operation request sent from the external terminal 200 to the vehicle 10 is switched depending on the communication status between the external terminal 200 and the server. Specifically, when communication between the external terminal 200 and the server 300 is interrupted, authentication is performed using an encryption key generated by the external terminal 200 for the operation request sent from the external terminal 200 to the vehicle 10. This makes it possible to avoid the risk of the vehicle becoming inoperable even in a situation where communication between the external terminal 200 and the server 300 is interrupted.

[Example 2]
Next, a second embodiment of the present invention will be described with reference to Figures 7 and 8. In this embodiment, the system configuration is the same as in the first embodiment, but it differs from the first embodiment in that the user's operation is performed directly on the vehicle 10, not through the external terminal 200. An operation performed directly on the vehicle 10 refers to, for example, a case where the door control ECU 30 is requested to open or close the door using a physical button on the door, or a case where the engine control ECU 40 is requested to start the engine using a smart push key.

FIG. 7 is a flowchart showing the processing executed by the external terminal 200 according to the second embodiment. Note that the same processes as those executed in the first embodiment, explained in FIG. 4, are given the same reference numerals, and the explanation is omitted. Also, the processing executed by the server 300 is the same as that in FIG. 6 according to the first embodiment, and therefore the explanation is omitted.

If, in step 106, the token stored in the token storage unit 280 is within its expiration date, in step 407, the data generation unit 250 receives information about the operation performed directly by the user on the vehicle 10, and the process proceeds to step 108. The subsequent processing is the same as that described using FIG. 4.

If the vehicle 10 does not forcibly switch the authentication method in step 121, the data generation unit 250 receives information about the operation performed directly by the user on the vehicle 10 in step 421, and the process proceeds to step 123. The subsequent processing is the same as the processing described with reference to FIG. 4.

FIG. 8 is a flowchart showing the process performed by the in-vehicle device 100 according to the second embodiment. Note that the same processes as those performed in the second embodiment described in FIG. 5 are denoted by the same reference numerals, and the description thereof will be omitted.

In step 500, the authentication unit 130 checks whether the other ECUs connected to the in-vehicle device 100 have been directly operated by the user, and if so, proceeds to step 501. If no direct operation has been performed by the user, the process waits.

In step 501, the authentication unit 130 transmits the operation information requested by the user from the other ECU to the external terminal 200, and then proceeds to step 200.

Steps 500 and 501 are performed when the user directly operates the vehicle 10, and transition to step 200 occurs as an interrupt.

According to this embodiment, even if the user directly issues operational instructions to the vehicle, the operational information is sent from the vehicle to the external terminal and authenticated, so it is possible to prevent the vehicle from becoming inoperable even if communication between the external terminal and the server is cut off.

The present invention is not limited to the above-described embodiment, but includes various modifications. For example, the above-described embodiment has been described in detail to clearly explain the present invention, and is not necessarily limited to having all of the configurations described.

In addition, in the processing flows of the present invention in Figures 4 to 8, there is processing in which two or more devices wait for a response from the other party, but this is not necessarily limited to continuing to wait for a response from the other party, and if there is no response for a certain period of time, a timeout process may be performed to terminate the processing, etc.

In addition, in the case where token authentication fails in Figures 4 and 8, the external terminal 200 reissues the token by sending the terminal information to the server 300 again, but it is not limited to using the terminal information to reissue the token. For example, when issuing a token from the server 300 to the external terminal 200, a refresh token may be issued at the same time, and when requesting token reissue, the external terminal 200 may make the reissue request using the refresh token rather than the terminal information.

In addition, in the present invention, token authentication is used for authentication of operations via the server, and encryption key cryptography is used for authentication of terminal operations, but the present invention is not limited to this authentication method, and it is sufficient that the authentication method is different depending on whether or not authentication is performed by the server. For example, instead of token authentication, an electronic signature using an encryption key by the server may be applied.

In addition, although in the present invention token authentication is performed between the vehicle 10 and the server 300, the token authentication method is not limited to this, and it is sufficient that a server is involved in authenticating operations between the external terminal 200 and the vehicle 10. For example, when an operation is performed from the external terminal 200 to the vehicle 10, a token is sent to the server 300, and after token authentication, the server 300 signs the token with an encryption key and returns it. A method in which the external terminal attaches the returned signed token to an operation request, and the vehicle 10 verifies the signature with an encryption key to confirm that the operation has been authenticated by the server 300 may also be used.

Furthermore, each embodiment does not need to stand alone, and the functions of each embodiment may be implemented simultaneously.

Furthermore, the above-mentioned configurations, functions, processing units, processing means, etc. may be realized in part or in whole in hardware, for example by designing them as integrated circuits.

Furthermore, each of the above configurations, functions, etc. may be realized by software that causes a processor to realize each function. Information such as programs, tables, files, etc. that realize each function can be stored in a recording device such as memory, a hard disk, or an SSD (Solid State Drive), or in recording media such as IC cards, SD cards, DVDs, or various recording media installed in the microcomputer.

The above-described embodiment of the present invention provides the following effects.

(1) An example of an in-vehicle device according to the present invention includes an authentication unit that executes authentication processing in response to a request from an external terminal, and a communication unit that transmits and receives information between the external terminal and a server. When the external terminal and the server are able to communicate, the authentication unit executes authentication processing via the server, and when communication between the external terminal and the server is interrupted, the authentication unit executes authentication processing without going through the server.

The above configuration makes it possible to prevent the vehicle from becoming inoperable even if communication between the external terminal and the server is interrupted.

(2) The device further includes a generation unit that generates information to be used in the authentication process, the communication unit transmits the information to the external terminal and receives cryptographic information in which the information is encrypted by the external terminal, and the authentication unit executes the authentication process using a token issued by the server when the external terminal and the server are able to communicate with each other, and executes the authentication process using the cryptographic information when communication between the external terminal and the server is interrupted. Specifically, the process of (1) is executed in this manner.

(3) When the communication interruption between the external terminal and the server is resolved, the authentication unit switches from authentication processing using cryptographic information to authentication processing using a token. Because cryptographic authentication processing involves the risk of being subject to cyber attacks from third parties, it is preferable to switch to token authentication in this manner as soon as the token becomes available.

(4) The authentication unit stops the authentication process when the vehicle's external communication function is capable of communication and communication between the external terminal and the server remains interrupted. If the vehicle's external communication function is capable of communication, a third party may use the communication function to launch a cyber attack, so the authentication process is stopped to prevent the internal program from being tampered with, etc.

(5) The vehicle further includes an operation monitoring unit that monitors the communication status with the server, and when a communication interruption between the external terminal and the server continues and the communication interruption between the server and the vehicle is resolved, the operation monitoring unit stops the authentication process using the encryption information and transmits information on the communicating external terminal and current location information to the server. When the communication interruption between the server and the vehicle is resolved, token authentication becomes possible again, so it is preferable to stop the high-risk encryption authentication process and further transmit various information to the server for use in log analysis.

(6) The operation monitoring unit further monitors the distance traveled since the start of the vehicle's engine, and stops the authentication process using the encryption information when the distance traveled during the authentication process using the encryption information exceeds a certain distance. If the authentication process using the encryption information continues for too long, it increases the possibility of being subjected to a cyber attack from the outside, so this restriction is imposed on the authentication process using the encryption information to eliminate that risk.

(7) When switching between authentication processes, authentication using a password obtained from an external terminal or the user's biometric information is required. From the perspective of ensuring security, it is preferable to process in this manner.

(8) When switching between authentication processes, authentication using a password or the user's biometric information obtained from the in-vehicle device is required. As with (7), this type of processing is preferable from the perspective of ensuring security.

(9) Also, one example of a vehicle authentication system according to the present invention is a vehicle authentication system that includes a server, an external terminal, and an in-vehicle device, and switches between authentication processing methods between the external terminal and the in-vehicle device depending on the communication state between the server and the external terminal. The in-vehicle device includes an authentication unit that executes authentication processing in response to a request from the external terminal, and a communication unit that transmits and receives information between the external terminal and the server. When the external terminal and the server are able to communicate, the authentication unit executes authentication processing via the server, and when communication between the external terminal and the server is interrupted, the authentication unit executes authentication processing without going through the server. Such a system can be expected to achieve the same effects as the in-vehicle device according to (1).

1...vehicle system, 10...vehicle, 100...vehicle-mounted device, 110...vehicle-mounted communication unit, 120...random number generation unit, 130...authentication unit, 140...operation monitoring unit, 200...external terminal 300...server

Claims (9)

an authentication unit that executes authentication processing in response to a request from an external terminal;
A communication unit that transmits and receives information between the external terminal and a server,
the authentication unit executes the authentication process via the server when the external terminal and the server are capable of communicating with each other, and executes the authentication process without going through the server when communication between the external terminal and the server is interrupted.
13. An in-vehicle device comprising: The in-vehicle device according to claim 1 ,
A generating unit that generates information used in the authentication process,
The communication unit transmits the information to the external terminal, and receives encrypted information obtained by encrypting the information by the external terminal;
the authentication unit executes the authentication process using a token issued by the server when the external terminal and the server are able to communicate with each other, and executes the authentication process using the encryption information when communication between the external terminal and the server is interrupted.
13. An in-vehicle device comprising: The in-vehicle device according to claim 2,
the authentication unit switches the authentication process from using the encryption information to using the token when the communication interruption between the external terminal and the server is resolved.
13. An in-vehicle device comprising: The in-vehicle device according to claim 3,
the authentication unit stops the authentication process when an external communication function of the vehicle is capable of communication and a communication interruption between the external terminal and the server continues.
13. An in-vehicle device comprising: The in-vehicle device according to claim 4,
An operation monitoring unit that monitors a communication state with the server is further provided,
When the communication interruption between the external terminal and the server continues and the communication interruption between the server and the vehicle is resolved, the operation monitoring unit stops the authentication process using the encryption information and transmits information about the external terminal in communication and current location information to the server.
13. An in-vehicle device comprising: The in-vehicle device according to claim 5,
The operation monitoring unit further monitors a mileage of the vehicle from engine start, and when the mileage during the execution of the authentication process using the encryption information exceeds a certain distance, stops the authentication process using the encryption information.
13. An in-vehicle device comprising: The in-vehicle device according to claim 3,
When switching the authentication process, authentication using a password or biometric information of the user acquired from the external terminal is required.
13. An in-vehicle device comprising: The in-vehicle device according to claim 3,
When switching the authentication process, authentication using a password or biometric information of the user acquired from the in-vehicle device is required.
13. An in-vehicle device comprising: A vehicle authentication system including a server, an external terminal, and an in-vehicle device, the system switching an authentication processing method between the external terminal and the in-vehicle device depending on a communication state between the server and the external terminal,
The in-vehicle device includes:
an authentication unit that executes an authentication process in response to a request from the external terminal;
A communication unit that transmits and receives information between the external terminal and a server,
the authentication unit executes the authentication process via the server when the external terminal and the server are capable of communicating with each other, and executes the authentication process without going through the server when communication between the external terminal and the server is interrupted.
A vehicle authentication system comprising:

Images