JP4321303B2 - Program distribution system and in-vehicle gateway device - Google Patents

Description

  The present invention relates to a program distribution system including a program distribution device that distributes a program for executing access to a vehicle ECU to an in-vehicle gateway device, and an in-vehicle gateway device to which the program is distributed from the program distribution device, and the program distribution system. It is related with the vehicle-mounted gateway apparatus used in the inside.

  There is an OSGi (Open Service Gateway Initiative) framework as a mechanism in which a program distribution apparatus distributes a specific program to a gateway apparatus. By the way, in the case where the program distribution device distributes a program for executing access to the vehicle ECU to the in-vehicle gateway device, if the program is counterfeited or tampered with by a third party maliciously, On the other hand, there is a risk that unauthorized access may be performed, and in such a case, there is a problem that a great trouble is caused in traveling of the vehicle.

  As a solution to such a problem, there may be a method in which only a program developed and verified by a reliable program developer can be distributed to the in-vehicle gateway device, but this restricts the program developer. Therefore, there is a problem that the program to be distributed is limited. On the other hand, it is possible to prepare a security environment that prohibits access to the vehicle ECU and execute the program only in the environment where the security is ensured. There is a problem that you can not.

  The present invention has been made in view of the above circumstances, and its purpose is to prevent a program distributed from the program distribution device to the in-vehicle gateway device from executing unauthorized access to the vehicle ECU. Therefore, an object of the present invention is to provide a program distribution system and an in-vehicle gateway device that can appropriately ensure the reliability of the program.

According to the first aspect of the present invention, the program distribution device creates an electronic signature by performing a cryptographic operation with a single encryption key on the program to which the access right identifier is added, and creates the program, the access right identifier, the electronic The signature and another encryption key paired with one encryption key are distributed to the in-vehicle gateway device. On the other hand, when the program distribution device distributes a program, an access right identifier, an electronic signature, and other encryption keys, the in-vehicle gateway device performs cryptographic operations using the other encryption keys on the program to which the access right identifier is added. An electronic signature is created, and an electronic signature created by performing cryptographic operations with one cryptographic key by the program distribution device is compared with an electronic signature created by performing cryptographic operations with another cryptographic key by itself. When the validity of the electronic signature is determined and it is detected that the electronic signature is valid, the access right to each vehicle ECU is set for a plurality of vehicle ECUs based on the access right identifier, and the vehicle in which the access right is set Allows access to ECU, access by running a program that is distributed from the program distribution apparatus to a vehicle ECU, which allow the access It is executed, whereas, to prevent access to the vehicle ECU which access is not set.

That is, according to the present invention, the program distribution device distributes the program to which the access right identifier is added to the in-vehicle gateway device, while the in-vehicle gateway device uses a plurality of access right identifiers based on the access right identifier distributed from the program distribution device. Since the access right to each vehicle ECU is set for each vehicle ECU, permission or prohibition of access to the vehicle ECU of the program can be set by the access right identifier. In addition, at this time, since the program with the access right identifier added between them is configured to be cryptographically distributed, the program and the access right identifier can be prevented from being counterfeited or falsified by a third party. Can be properly protected. Thereby, it is possible to prevent a program distributed from the program distribution device to the in-vehicle gateway device from executing unauthorized access to the vehicle ECU, thereby appropriately ensuring the reliability of the program. be able to.

According to the second aspect of the present invention, the program distribution device creates an electronic signature by performing a cryptographic operation with a single encryption key on the program to which the access right identifier is added, and creates the program, the access right identifier, the electronic The signature and another encryption key paired with one encryption key are distributed to the in-vehicle gateway device. On the other hand, when the program distribution device distributes a program, an access right identifier, an electronic signature, and other encryption keys, the in-vehicle gateway device performs cryptographic operations using the other encryption keys on the program to which the access right identifier is added. An electronic signature is created, and an electronic signature created by performing cryptographic operations with one cryptographic key by the program distribution device is compared with an electronic signature created by performing cryptographic operations with another cryptographic key by itself. To determine the validity of the electronic signature. Then, when the in-vehicle gateway device detects that the electronic signature is valid, the program execution device sets the access right to each vehicle ECU based on the access right identifier, and the access right is set. The access to the vehicle ECU is permitted , the program distributed from the program distribution device is executed, and the access to the vehicle ECU for which the access is permitted is performed . Prohibit access.

That is, according to the present invention, the program distribution device distributes the program with the access right identifier added to the in-vehicle gateway device, while the program execution device distributes the access right identifier distributed from the program distribution device to the in-vehicle gateway device. Since the access right to each vehicle ECU is set for a plurality of vehicle ECUs based on the above, permission or prohibition of access to the vehicle ECU of the program is made in the same manner as described in claim 1 above. It can be set by an access right identifier. In addition, at this time, since the program with the access right identifier added between them is configured to be cryptographically distributed, the program and the access right identifier can be prevented from being counterfeited or falsified by a third party. Can be properly protected. Thereby, it is possible to prevent a program distributed from the program distribution device to the in-vehicle gateway device from executing unauthorized access to the vehicle ECU, thereby appropriately ensuring the reliability of the program. be able to.

  According to the program distribution system of the third aspect, the certificate authority transmits one encryption key and another encryption key to the program distribution device and transmits another encryption key to the in-vehicle gateway device. The program distribution device creates an electronic signature by performing a cryptographic operation with the one encryption key transmitted from the certificate authority on the program to which the access right identifier is added, from the program, the access right identifier, the electronic signature, and the certificate authority. The other transmitted encryption key is distributed to the in-vehicle gateway device. On the other hand, when a program, an access right identifier, an electronic signature, and other encryption keys are distributed from the program distribution device, the in-vehicle gateway device receives another encryption key distributed from the program distribution device and another transmitted from the certificate authority. Compare the encryption key to determine the validity of the other encryption key, and if it detects that the other encryption key is valid, the encryption operation using the other encryption key is performed on the program with the access right identifier added. To create an electronic signature.

  That is, according to the present invention, since the encryption key transmitted from the certificate authority is used to perform the cryptographic operation on the program with the access right identifier added between the two, the cryptographic operation is distributed. It is possible to protect the encryption key used for the falsification and falsification by a third party maliciously, and more appropriately protect the program and the access right identifier from the falsification and falsification by a third party malicious. Then, by managing the encryption key used by the program distribution apparatus by a certificate authority different from the program distribution apparatus, the relationship between the program distribution apparatus and the certificate authority in the entire system is n (n is a natural number). There is also an advantage that can be extended to.

  Hereinafter, an embodiment of the present invention will be described with reference to the drawings. The program here is a program for executing access to the vehicle ECU. FIG. 1 schematically shows the overall configuration of the program distribution system. The program distribution system 1 includes a program development device 2, a program distribution device 3, an authentication station 4, and an in-vehicle gateway device 5.

  The program development device 2 is a device handled by a program developer (individual or corporation) mainly for the purpose of developing a program. A personal computer having a development environment for developing a program and a communication function for communicating the program. It consists of computers and servers.

  The program distribution device 3 is a device handled by a program distributor (individual or corporation) mainly for the purpose of distributing a program developed by the program developer to the in-vehicle gateway device 5, and has a distribution function for distributing the program. It has a server etc. As an example of the relationship between the program developer and the program distributor, the program distributor is a side that provides a specific application service to the public, and the program developer provides the specific application service to the public. This is the side that develops the application programs necessary to do this.

  The certificate authority 4 is managed and operated by an organization different from the program developer and program distributor, and is configured to centrally manage encryption keys (public keys and secret keys). In the present embodiment, the certificate authority 4 transmits a certificate storing a pair of public key and private key to the program distribution device 3 and transmits the public key to the in-vehicle gateway device 5. That is, the secret key is one encryption key in the present invention, and the public key is another encryption key in the present invention.

  The in-vehicle gateway device 5 is mounted on the vehicle, and when the program and the access identifier are distributed from the program distribution device 3, the access right to the vehicle ECU 6 is set based on the access right identifier, and the access right is set. The access to the vehicle ECU 6 is permitted and the access to the vehicle ECU 6 for which the access right is not set is prohibited. The vehicle ECU 6 here is, for example, a navigation ECU (navigation ECU) 7, a door ECU 8, an engine ECU 9, an air conditioner ECU 10, a meter ECU 11, or the like.

  Next, the effect | action of an above-described structure is demonstrated with reference to FIG. 2 and FIG. FIG. 2 schematically shows the flow of data (program, access right identifier, electronic signature and public / private key) among the program opening device 2, the program distribution device 3, the certificate authority 4, and the in-vehicle gateway device 5. Yes. In this case, the program developer is a reliable developer in the entire system, and the program developed by the program developer is a sufficiently reliable program developed under high quality control. It is assumed that Further, here, a certificate storing a pair of public key and private key is transmitted from the certificate authority 4 to the program distribution apparatus 3 in advance, and the certificate authority 4 is transmitted to the in-vehicle gateway apparatus 5 in advance. It is assumed that the public key has been sent.

  The program development device 2 develops a program (step S1), creates an access right identifier corresponding to the developed program (step S2), adds an access right identifier to the program, and adds an access right identifier. The transmitted program is transmitted to the program distribution device 3.

  When the program distribution apparatus 3 transmits a program with an access right identifier added from the program development apparatus 2, the program distribution apparatus 3 transmits the program from the program development apparatus 2 using the private key of the certificate previously transmitted from the certificate authority 4. An electronic signature is created by performing a cryptographic operation with the secret key on the program and the access right identifier (step S3). Then, the program distribution device 3 distributes the program, the access right identifier, the electronic signature, and the public key of the certificate previously transmitted from the certificate authority 4 to the in-vehicle gateway device 5.

  When the program, the access right identifier, the electronic signature, and the public key of the certificate are distributed from the program distribution apparatus 3, the in-vehicle gateway apparatus 5 uses the public key transmitted from the certificate authority 4 in advance. The distributed public key is compared with the public key transmitted from the certificate authority 4 to determine the validity of the certificate (public key) (step S4). When the in-vehicle gateway device 5 detects that the two match and the public key is valid, the in-vehicle gateway device 5 uses the valid public key to disclose the program and the access right identifier distributed from the program distribution device 3. An electronic signature is created by performing a cryptographic operation with a key (step S5).

  Next, the in-vehicle gateway device 5 compares the electronic signature created by performing the cryptographic operation with the secret key by the program distribution device 3 with the electronic signature created by performing the cryptographic operation with the public key by itself. The validity of the signature is determined (step S6). Next, when the in-vehicle gateway device 5 detects that the two match and the electronic signature is valid, the in-vehicle gateway device 5 confirms the security of the program and the access right identifier (step S7). Then, the in-vehicle gateway device 5 sets the access right to the vehicle ECU 6 (step S8), and thereafter permits access to the vehicle ECU for which the access right is set and also to the vehicle ECU for which the access right is not set. Prohibit access.

  If the program attempts to execute access to the vehicle ECU 6 for which no access right has been set thereafter, the in-vehicle gateway device 5 stops the access or executes the program itself as necessary. Or stop. The in-vehicle gateway device 5 notifies the center to that effect or warns the user.

By the way, as described above, by using the certificate authority 4 different from the program distribution device 3, the program distribution device 3 performs a cryptographic operation using the secret key transmitted from the certificate authority 4,
The case where the in-vehicle gateway device 5 determines the validity of the public key using the public key transmitted from the certificate authority 4 has been described. This is due to the following reason. That is, when viewed from the in-vehicle gateway device 5, if the program distribution device 3 is sufficiently reliable, no problem occurs even if all the cryptographic operation procedures are entrusted to the program distribution device 3. However, if the program distribution apparatus 3 is not sufficiently reliable, if the entire cryptographic operation procedure is left to the program distribution apparatus 3, the public key is forged or altered in the middle. This is because it is difficult to save the case.

  Therefore, in the present embodiment, the use of the public / private key provided from the certificate authority 4 that can be trusted (at least higher in reliability than the program distribution device 3) can cause the above-described problems. It can be avoided in advance. That is, whether or not to use the public key / private key provided from the certificate authority 4 depends on the degree of reliability when the program distribution device 3 is viewed from the in-vehicle gateway device 5 and the security required in the system. It may be determined in consideration of the degree.

  In the above description, the program development apparatus 2 describes the case where the access right identifier is created after the program is developed. However, the program may be developed after the access right identifier is created. In the above, the case where the program development apparatus 2 adds an access identifier to the program and transmits the program to which the access right identifier is added to the program distribution apparatus 3 has been described. The program and the access right identifier may be separately transmitted to the program distribution apparatus 3, and the program distribution apparatus 3 may add the access right identifier to the program transmitted separately from the program development apparatus 2.

  Now, FIG. 3 schematically shows the configuration of the program distribution device 3 and the in-vehicle gateway device 5. When the program is transmitted from the application servers 12a to 12c managed by the application service provider, the program distribution device 3 performs cryptographic operation on the program and creates a database in a program management database for management. In this case, the application servers 12 a to 12 c may be configured with their functions incorporated in the program distribution device 3, or the functions may be configured separately from the program distribution device 3. Further, the application servers 12a to 12c may be configured to develop a program in which, for example, diagnostic information is taken from the in-vehicle gateway device 5.

  When the program and the access right identifier are distributed from the program distribution device 3, the in-vehicle gateway device 5 performs a cryptographic operation on the access right identifier added to the program by the cryptographic operation module in the service gateway function. When the security of the identifier is confirmed, the access right is managed by the access right management module in the service gateway function. The program distributed from the program distribution device 3 is executed on the OS (Operating System) of the navigation device together with the navigation program and the browser.

  As described above, according to the present embodiment, in the program distribution system 1, the program distribution device 3 distributes the program with the access right identifier added to the in-vehicle gateway 5 device, while the in-vehicle gateway device 5 Since the access right to the vehicle ECU 6 is set based on the access right identifier distributed from the program distribution device 3, permission or prohibition of access to the vehicle ECU 6 of the program can be set by the access right identifier. In addition, at this time, since the program to which the access right identifier is added is configured to be distributed by performing cryptographic operation, the program and the access right identifier are forged or altered by a third party maliciously. Can be adequately protected from. Thereby, it is possible to prevent the program distributed from the program distribution device 3 to the in-vehicle gateway device 5 from executing unauthorized access to the vehicle ECU, thereby appropriately improving the reliability of the program. Can be secured.

  In this case, since the encryption key transmitted from the certificate authority 4 is used to perform the encryption operation on the program with the access right identifier added between the two, it is used for the encryption operation. The public key can be protected from counterfeiting or tampering by a third party maliciously, and the program and the access right identifier can be more appropriately protected from counterfeiting or tampering by a third party maliciously. The public key / private key used by the program distribution device 3 is managed by the certificate authority 4 different from the program distribution device 3 in this way, so that the program distribution device 3 and the certificate authority 4 are connected to n ( There is also an advantage that it can be expanded to a relationship where n is a natural number).

The present invention is not limited to the above-described embodiment, and can be modified or expanded as follows.
Another ECU may be connected to the in-vehicle gateway device.
The program distributed from the program distribution device to the in-vehicle gateway device is not limited to the configuration in which the in-vehicle gateway device executes the program distributed from the program distribution device, and the program execution device is provided separately from the in-vehicle gateway device. The program may be executed by the program execution device.

  A configuration in which a public key cryptosystem using a pair of public key and secret key for encryption / decryption is adopted, and a secret key cryptosystem using the same secret key for encryption / decryption is adopted. It may be.

The figure which shows schematically the whole structure of one Embodiment of this invention. Sequence Diagram The figure which shows the structure of a program delivery apparatus and a vehicle-mounted gateway apparatus roughly

Explanation of symbols

In the drawings, 1 is a program distribution system, 2 is a program development device, 3 is a program distribution device, 4 is a certificate authority, 5 is an in-vehicle gateway device, and 6 is a vehicle ECU.

Claims (5)

A program distribution device for distributing a program for executing access to the vehicle ECU to the in-vehicle gateway device;
A program distribution system comprising an in-vehicle gateway device that distributes a program from a program distribution device,
The program distribution device creates an electronic signature by performing a cryptographic operation with a single encryption key on the program to which the access right identifier is added, and makes a pair with the program, the access right identifier, the electronic signature, and the single encryption key. Is delivered to the in-vehicle gateway device,
When the program, the access right identifier, the electronic signature, and other encryption keys are distributed from the program distribution device, the in-vehicle gateway device performs a cryptographic operation with the other encryption key on the program with the access right identifier added thereto, Create a signature and compare the electronic signature created by performing cryptographic operations with one cryptographic key by the program distribution device with the electronic signature created by performing cryptographic operations with another cryptographic key by itself. A vehicle in which the access right to each vehicle ECU is set for a plurality of vehicle ECUs based on the access right identifier when the validity of the signature is determined and it is detected that the electronic signature is valid. Allows access to ECU, access by executing a program that is distributed from the program distribution apparatus to a vehicle ECU, which allow the access Run, whereas, a program distribution system and inhibits access to the vehicle ECU which access is not set. A program distribution device for distributing a program for executing access to the vehicle ECU to the in-vehicle gateway device;
An in-vehicle gateway device to which a program is distributed from the program distribution device;
A program distribution system comprising a program execution device that executes a program distributed from a program distribution device to an in-vehicle gateway device,
The program distribution device creates an electronic signature by performing a cryptographic operation with a single encryption key on the program to which the access right identifier is added, and makes a pair with the program, the access right identifier, the electronic signature, and the single encryption key. Is delivered to the in-vehicle gateway device,
When the program, the access right identifier, the electronic signature, and other encryption keys are distributed from the program distribution device, the in-vehicle gateway device performs a cryptographic operation with the other encryption key on the program with the access right identifier added thereto, Create a signature and compare the electronic signature created by performing cryptographic operations with one cryptographic key by the program distribution device with the electronic signature created by performing cryptographic operations with another cryptographic key by itself. Determine the validity of the signature,
When the in-vehicle gateway device detects that the electronic signature is valid, the program execution device sets the access right to each vehicle ECU based on the access right identifier, and the access right is set. The access to the vehicle ECU is permitted , the program distributed from the program distribution device is executed, and the access to the vehicle ECU is permitted, while the access right is not set for the vehicle ECU. Program distribution system characterized by prohibiting In the program delivery system according to claim 1 or 2,
It has a certificate authority that manages encryption keys,
The certificate authority transmits one encryption key and another encryption key to the program distribution device and transmits the other encryption key to the in-vehicle gateway device,
The program distribution device creates an electronic signature by performing a cryptographic operation with the one encryption key transmitted from the certificate authority on the program to which the access right identifier is added, from the program, the access right identifier, the electronic signature, and the certificate authority. Deliver the transmitted other encryption key to the in-vehicle gateway device,
When the program, the access right identifier, the electronic signature, and other encryption keys are distributed from the program distribution device, the in-vehicle gateway device transmits another encryption key transmitted from the program distribution device and another encryption key transmitted from the certificate authority. To determine the validity of the other encryption key, and when it is detected that the other encryption key is valid, the encryption operation using the other encryption key is performed on the program with the access right identifier added. A program distribution system for creating an electronic signature. An electronic signature is created by performing a cryptographic operation with a single encryption key on a program that executes access to the vehicle ECU to which the access right identifier is added, and is associated with the program, the access right identifier, the electronic signature, and the single encryption key. An in-vehicle gateway device used in a program distribution system together with a program distribution device that distributes another encryption key to the in-vehicle gateway device,
When a program, an access right identifier, an electronic signature, and another encryption key are distributed from the program distribution device, an electronic signature is created by performing a cryptographic operation with another encryption key on the program to which the access right identifier is added, The validity of the electronic signature is verified by comparing the electronic signature created by performing the cryptographic operation with one encryption key by the program distribution device with the electronic signature generated by performing the cryptographic operation with another encryption key by itself. When the determination is made and it is detected that the electronic signature is valid, the access right to each vehicle ECU is set for a plurality of vehicle ECUs based on the access right identifier, and access to the vehicle ECU for which the access right is set is set. Permit and execute the program distributed from the program distribution device to execute access to the vehicle ECU that has permitted the access. Vehicle gateway apparatus and inhibits access to the vehicle ECU to but not set. In the in-vehicle gateway device according to claim 4,
Used in a program distribution system together with a certificate authority that manages encryption keys, and when a program, an access right identifier, an electronic signature, and other encryption keys are distributed from the program distribution apparatus, other encryption keys distributed from the program distribution apparatus Is compared with the other encryption key transmitted from the certificate authority to determine the validity of the other encryption key, and when it detects that the other encryption key is valid, the program with the access right identifier added An in-vehicle gateway device characterized in that an electronic signature is created by performing a cryptographic operation with another encryption key .

Images