JP6697404B2 - System and method of writing information - Google Patents

Description

  The present invention relates to a system for executing a key writing process to a device.

  In order for a module such as an in-vehicle device of an automobile to communicate safely with a server, the in-vehicle device needs to share secret information with the server. The vehicle-mounted device and the server can safely communicate by cryptographic communication using the shared secret information as a key.

  The shared key can be written in the in-vehicle device at the manufacturing plant. For example, a technique described in Patent Document 1 is known as a technique for writing a key in an in-vehicle device at a manufacturing factory.

  In Patent Document 1, "The private key registration system is a system used when registering, for example, a master key or a plurality of sub keys as an electronic key 2 in a vehicle. The external center 200 is information necessary for registration. The on-vehicle device center key 22 and the electronic key center key 23 are distributed to the internal center 20. The internal center 20 generates a secret key by the random number generator 31. The internal center 20 uses the generated secret key on the on-vehicle device center key 22. And the electronic key center key 23 is used for encryption processing, and the processed secret key is distributed to the vehicle and the electronic key 2. "

  Further, the method of Non-Patent Document 1 is known as a method of writing a key to an in-vehicle device. In Non-Patent Document 1, a key generator generates a message in which a key is encrypted, sends the message to a module without decrypting it, and the module internally decrypts the key and writes the key. Is listed. Further, Non-Patent Document 1 describes that a module outputs a verification message and a key generator verifies whether or not a key is written based on the verification message. .. By using the technique described in Non-Patent Document 1, the key can be securely written in the module.

JP, 2013-234519, A

Himanshu Singhal, Pradip Singh, “SHE on MPC5746C / MPC5748G,” Freescale Semiconductor, Inc., 2015.

  In a manufacturing process of a product such as an automobile, an automobile manufacturer does not always manufacture an automobile module, and a supplier may produce an automobile module and supply the automobile module to the automobile manufacturer. It is desirable that the key written in the module is not disclosed to anyone other than the user. However, in the module manufacturing factory of the supplier, when the key generated by the automobile manufacturer is written in the module, in the method of Patent Document 1, the key needs to be distributed to the supplier manufacturing factory, so the key may be disclosed to the supplier. There is.

  If the method of Non-Patent Document 1 is used, there is no possibility that the key will be disclosed to the supplier. However, the supplier needs to connect the system of the supplier and the system of the automobile manufacturer and send the verification message output by the module to the automobile manufacturer in order to confirm that the key is correctly written in the module.

  In the system configuration described above, the supplier needs to wait for the verification result by the automobile manufacturer, and needs to stop the production line or the like until the verification result is received. Further, when the verification result is received after manufacturing the module, it is necessary to collect the module and reset the module due to an error in the key writing process. Therefore, the system configuration described above is a factor that reduces the stability of the module manufacturing line and increases the module manufacturing cost.

  An object of the present invention is to provide a system capable of securely writing information to a device such as a module and verifying the success or failure of the information writing process in a system for manufacturing the device.

  A typical example of the invention disclosed in the present application is as follows. That is, a system including a first computer that manages manufacturing of a device, and a second computer that is connected to the first computer and that manages setting information set in the device, wherein the first computer is , A first processor, a first memory connected to the first processor, and a first network interface connected to the first processor, and the second computer is a second processor. A second memory connected to the second processor, and a second network interface connected to the second processor, the second memory being provided by the device and the second computer. Key information that is shared and that is used for encryption processing and decryption processing is stored, and the second processor sends a first message including a first ciphertext in which the setting information is encrypted using the key information. A second message including a second ciphertext that is generated and transmitted to the device via the first computer, and uses the key information to encrypt a part of the data included in the setting information. Generated and transmitted to the first computer, the first processor uses the key information from the device that stores the setting information acquired by decrypting the first ciphertext. By receiving a third message including a third ciphertext obtained by encrypting a part of information included in the setting information, and comparing the second message and the third message with each other. It is characterized by verifying whether or not the writing process of is successful.

  According to the present invention, the second computer can write the setting information such as the key to the device in a state of being hidden from the first computer, and the first computer can inquire the second computer. Therefore, the success or failure of the writing process of the setting information can be verified. Problems, configurations and effects other than those described above will be clarified by the following description of the embodiments.

FIG. 1 is a diagram showing a configuration example of a system of Example 1. FIG. 3 is a diagram showing an example of a hardware configuration and a software configuration of a center key management server according to the first embodiment. 3 is a diagram showing an example of a hardware configuration and a software configuration of a factory key management server of Example 1. FIG. FIG. 3 is a diagram showing an example of a hardware configuration and a software configuration of the manufacturing line terminal of the first embodiment. 3 is a diagram illustrating an example of a hardware configuration and a software configuration of the device according to the first exemplary embodiment. FIG. FIG. 6 is a diagram showing an example of device key information according to the first embodiment. FIG. 7 is a diagram showing an example of first key management message information of the first embodiment. 6 is a flowchart illustrating an outline of a key writing process according to the first embodiment. FIG. 6 is a sequence diagram illustrating the flow of processing in the key writing process of the first embodiment. FIG. 6 is a sequence diagram illustrating the flow of processing in the key writing process of the first embodiment. 6 is a flowchart illustrating an example of a message generation process executed by the center key management server according to the first embodiment. 6 is a flowchart illustrating an example of an application key writing process executed by the device according to the first exemplary embodiment. 6 is a flowchart illustrating an example of a verification message generation process executed by the device of the first embodiment. 6 is a flowchart illustrating an example of a verification process of an application key writing process executed by the factory key management server according to the first embodiment. 6 is a flowchart illustrating an example of a verification process of an application key writing process executed by the center key management server according to the first embodiment. FIG. 16 is a diagram showing an example of device key information according to the second embodiment. FIG. 16 is a diagram showing an example of first key management message information of the second embodiment.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. In each drawing, the same reference numerals are given to common configurations.

  FIG. 1 is a diagram illustrating a configuration example of a system according to the first embodiment.

  The system according to the first embodiment includes a center key management server 100, a factory key management server 110, a manufacturing line terminal 120, and a device 130. The factory key management server 110, the manufacturing line terminal 120, and the device 130 are included in the manufacturing factory. The system including the base and the center key management server 100 constitutes a different system.

  The center key management server 100 and the factory key management server 110 are connected via the first network 150. The factory key management server 110 and the production line terminal 120 are connected via the second network 160. Further, the production line terminal 120 and the device 130 are connected via the third network 170.

  The first network 150, the second network 160, and the third network 170 may be WAN (Wide Area Network), LAN (Local Area Network), or the like, for example. The present embodiment is not limited to the type of network and the connection method (wired or wireless).

  In the present embodiment, the center key management server 100 is described as on-premises, but the center key management server 100 may be realized by using a cloud system. In the present embodiment, the factory key management server 110 and the production line terminal 120 are described as separate devices, but the functions of each computer may be combined into one computer.

  In this embodiment, a key writing process of writing an application key issued by the center key management server 100 installed outside the manufacturing factory in the manufacturing process of the device 130 will be described as an example.

  The device 130 is a component (module) such as an in-vehicle device produced in a manufacturing factory. The center key management server 100 generates a key to be written in the device 130. The factory key management server 110 manages the entire manufacturing factory. Further, the factory key management server 110 receives the key generated by the center key management server 100, and transmits the key to the device 130 via the manufacturing line terminal 120. The production line terminal 120 is a terminal that relays between the factory key management server 110 and the device 130.

  FIG. 2 is a diagram illustrating an example of a hardware configuration and a software configuration of the center key management server 100 according to the first embodiment.

  The center key management server 100 has a processor 201, a memory 202, a storage device 203, a network interface 204, and an I / O interface 205 as hardware. The components are connected via a bus or the like.

  The processor 201 executes a program stored in the memory 202. The processor 201 executes processing according to a program to operate as a module having a predetermined function. In the following description, when a module is used as a subject, it indicates that the processor 201 is executing a program that implements the module.

  The memory 202 stores a program executed by the processor 201 and information used by the program. The memory 202 also includes a storage area such as a work area. The programs stored in the memory 202 will be described later.

  The storage device 203 stores data permanently. The storage device 203 may be, for example, an HDD (Hard Disk Drive) or an SSD (Solid State Drive). The data stored in the storage device 203 will be described later.

  The network interface 204 is an interface for communicating with an external device via a network. In this embodiment, the center key management server 100 connects to the first network 150 via the network interface 204.

  The I / O interface 205 is an interface for connecting to external devices such as the input device 206 and the output device 207. The input device 206 includes a keyboard, a mouse, a touch panel, etc., and the output device 207 includes a display, a touch panel, etc.

  The memory 202 of the center key management server 100 stores a program that realizes the control module 210.

  The control module 210 controls the center key management server 100 as a whole. The control module 210 also executes data encryption processing and data decryption processing. In this embodiment, it is assumed that the encryption process and the decryption process according to the common key cryptosystem are executed.

  The control module 210 includes a key generation module 211, a first encryption module 212, a first MAC generation module 213, a second decryption module 214, a second MAC verification module 215, a key derivation module 226, and a second derivation module. An encryption module 217 is included. The control module 210 includes a key generation module 211, a first encryption module 212, a first MAC generation module 213, a second decryption module 214, a second MAC verification module 215, a key derivation module 226, and a second decipher module 226. The two encryption modules 217 may be included as one cryptographic operation module.

  The key generation module 211 generates a random bit string as a key used for encryption or the like.

  The first encryption module 212 generates a ciphertext by encrypting the plaintext using a common key cryptosystem key. Specifically, the first encryption module 212 calculates the ciphertext by using the key of the common key cryptosystem and the first encryption function Enc1 having the plaintext as variables, as shown in Expression (1). ..

  Here, k represents a key of the common key cryptosystem, p represents plaintext, and c represents ciphertext.

  The first MAC generation module 213 generates the MAC value of the MAC generation target data using the key of the common key cryptosystem. Specifically, the first MAC generation module 213 uses the first MAC generation function GenMAC1 having variables of the key of the common key cryptosystem and the MAC generation target data, as shown in Expression (2), to generate a MAC value. To calculate.

  Here, m represents the MAC generation target data, and t represents the MAC value.

  The second decryption module 214 produces a plaintext by decrypting the ciphertext using the key of the common key cryptosystem. Specifically, the second decryption module 214 calculates the plaintext by using the second decryption function Dec2 having the common key cryptosystem key and the ciphertext as variables, as shown in Expression (3).

  The second MAC verification module 215 verifies the validity of the set of the MAC target data and the MAC value using the key of the common key cryptosystem. Specifically, the second MAC verification module 215 uses a second MAC verification function VerifyMAC2 having variables of the key of the common key cryptosystem, the MAC target data, and the MAC value, as shown in Expression (4). Then, the MAC value is verified.

  Here, v represents the verification result. The calculation result v is either “0” or “1”. "0" indicates failure and "1" indicates success.

  The key derivation module 216 generates a derivation key using the original key of the common key cryptosystem and the additional data. Specifically, the key derivation module 216 calculates the derived key by using the key derivation function KDF with the variables of the original key of the key of the common key cryptosystem and the additional data, as shown in Expression (5).

  Here, k represents the original key of the key of the common key cryptosystem, Data represents the additional data, and k_derived represents the derived key.

  The second encryption module 217 generates a ciphertext by encrypting the plaintext using the key of the common key cryptosystem. The second encryption module 217 has the same function as the first encryption module 212, but the function used for encryption is different. Since the second encryption module 217 is the same as the second encryption module 514 described later, the function used by the second encryption module 217 will be described in the description of the configuration of the device 130.

  The storage device 203 of the center key management server 100 stores the device key information 250 and the first key management message information 260. Details of the device key information 250 will be described with reference to FIG. Details of the first key management message information 260 will be described with reference to FIG. 7. The device key information 250 and the first key management message information 260 may be stored in the memory 202.

  FIG. 3 is a diagram illustrating an example of a hardware configuration and a software configuration of the factory key management server 110 according to the first embodiment.

  The factory key management server 110 has a processor 301, a memory 302, a storage device 303, a network interface 304, and an I / O interface 305 as hardware. The components are connected via a bus or the like. An input device 306 and an output device 307 are connected to the I / O interface 305.

  The processor 301, the memory 302, the storage device 303, the network interface 304, and the I / O interface 305 are the same as the processor 201, the memory 202, the storage device 203, the network interface 204, and the I / O interface 205. The input device 306 and the output device 307 are similar to the input device 206 and the output device 207.

  The memory 302 of the factory key management server 110 stores a program that realizes the control module 310.

  The control module 310 controls the entire factory key management server 110. The control module 310 also includes a message verification module 311 that verifies the success or failure of the application key writing process.

  The message verification module 311 determines whether or not the writing process of the application key has succeeded by comparing the two messages. Specifically, when the two messages match, the message verification module 311 determines that the application key writing process has succeeded.

  The storage device 303 of the factory key management server 110 stores the second key management message information 350. The second key management message information 350 has the same data structure as the first key management message information 260. The second key management message information 350 may be stored in the memory 302.

  FIG. 4 is a diagram illustrating an example of a hardware configuration and a software configuration of the manufacturing line terminal 120 according to the first embodiment.

  The production line terminal 120 has a processor 401, a memory 402, a storage device 403, a network interface 404, and an I / O interface 405 as hardware. The components are connected via a bus or the like. Further, an input device 406 and an output device 407 are connected to the I / O interface 405.

  The processor 401, memory 402, storage device 403, network interface 404, and I / O interface 405 are the same as the processor 201, memory 202, storage device 203, network interface 204, and I / O interface 205. The input device 406 and the output device 407 are similar to the input device 206 and the output device 207.

  The memory 402 of the production line terminal 120 stores a program that realizes a control module 410 that controls the entire production line terminal 120.

  The storage device 403 of the production line terminal 120 stores the writing message 440 received from the factory key management server 110 and the verification message 450 received from the device 130. The writing message 440 and the verification message 450 may be stored in the memory 402.

  FIG. 5 is a diagram illustrating an example of a hardware configuration and a software configuration of the device 130 according to the first embodiment.

  The device 130 has a processor 501, a memory 502, a storage device 503, and a network interface 504 as hardware. The components are connected via a bus or the like.

  The processor 501, the memory 502, the storage device 503, and the network interface 504 are the same as the processor 201, the memory 202, the storage device 203, and the network interface 204.

  The memory 502 of the device 130 stores a program that realizes the control module 510.

  The control module 510 controls the entire device 130. The control module 510 also executes data encryption processing and data decryption processing. In this embodiment, it is assumed that the encryption process and the decryption process according to the common key cryptosystem are executed.

  The control module 510 includes a first decryption module 511, a first MAC verification module 512, a writing module 513, a second encryption module 514, a second MAC generation module 515, and a key derivation module 516. The control module 510 includes a first decryption module 511, a first MAC verification module 512, a writing module 513, a second encryption module 514, a second MAC generation module 515, and a key derivation module 516. It may be included as one cryptographic operation module.

  The first decryption module 511 produces a plaintext by decrypting the ciphertext using the key of the common key cryptosystem. Specifically, the first decryption module 511 calculates the plaintext by using the first decryption function Dec1 having the common key cryptosystem key and the ciphertext as variables, as shown in Expression (6).

  Here, k represents a key of the common key cryptosystem, c represents ciphertext, and p represents plaintext.

  Note that the relationship shown in Expression (7) holds between the first encryption function Enc1 and the first decryption function Dec1.

  The first MAC verification module 512 verifies the validity of the set of the MAC target data and the MAC value using the key of the common key cryptosystem. Specifically, the first MAC verification module 512 uses a first MAC verification function VerifyMAC1 having variables of the key of the common key cryptosystem, the MAC target data, and the MAC value as shown in Expression (8). And verify.

  Here, m represents MAC target data, t represents a MAC value, and v represents a verification result. The calculation result v is either “0” or “1”. "0" indicates failure and "1" indicates success.

  Expression (8) can be transformed into Expression (9) using the first MAC generation function GenMAC1.

  Here, the function Compare represents a comparison function, and the value of the comparison function Compare (a, b) is “1” when a and b match and “0” when a and b do not match.

  The writing module 513 writes the key of the common key cryptosystem and the number of times the key is written (counter value).

  The second encryption module 514 generates a ciphertext by encrypting the plaintext using the key of the common key cryptosystem. Specifically, as shown in Expression (10), the second encryption module 514 calculates the ciphertext using the second encryption function Enc2 in which the common key cryptosystem key and the plaintext are variables. ..

  Note that the relationship shown in Expression (11) is established between the second encryption function Enc2 and the second decryption function Dec2.

  The second MAC generation module 515 generates the MAC value of the MAC generation target data using the key of the common key cryptosystem. Specifically, as shown in Expression (12), the second MAC generation module 515 uses the second MAC generation function GenMAC2 having variables of the key of the common key cryptosystem and the MAC generation target data as the MAC value. To calculate.

  The expression (4) can be transformed into the expression (13) by using the second MAC generation function GenMAC2.

  The key derivation module 516 generates a derivation key using the original key of the common key cryptosystem and the additional data. The key derivation module 516 uses the same key derivation function KDF as the key derivation module 216 to generate a derived key.

  The storage device 503 stores a device ID 550, an authentication key 560, an application key 570, and a counter value 580.

  The device ID 550 is identification information for uniquely identifying the device 130. The device ID 550 is set in the device 130 in advance. In this embodiment, it is assumed that the center key management server 100 grasps the device ID 550 of each device 130 before starting the application key writing process.

  The authentication key 560 is a key used for encryption processing and decryption processing. The authentication key 560 is shared with the center key management server 100 and the device 130 before starting the application key writing process.

  The application key 570 is an application key written in the device 130. The application key is a key used by an application running on the device 130. As will be described later, the center key management server 100 writes the application key in the device 130. If the old application key 570 exists when the application key is written, the writing module 513 updates the old application key 570 with the new application key 570.

  The counter value 580 is the number of times the application key 570 is written in the device 130. Before the application key writing process is started, the counter values held by the center key management server 100 and the device 130 are the same value.

  FIG. 6 is a diagram illustrating an example of the device key information 250 according to the first embodiment.

  The device key information 250 includes a record including a device ID 601, an authentication key 602, an application key 603, an application key counter 604, and a status 605. One record corresponds to one device 130.

  The device ID 601 and the authentication key 602 are columns that store the device ID and the authentication key shared by the center key management server 100 and the device 130.

  The application key 603 is a column that stores an application key to be written in the device 130.

  The application key counter 604 is a column that stores the number of times the application key is written (counter value).

  The state 605 is a column that stores the state of the application key writing process. The status 605 stores any one of “generated”, “written”, and “error”.

  “Generated” indicates a state where the success or failure of the writing process of the application key generated by the center key management server 100 has not been verified. “Writing completed” indicates that the verification result of the success or failure of the application key writing process is successful. “Error” indicates that the verification result of the success or failure of the writing process of the application key is failure.

  FIG. 7 is a diagram illustrating an example of the first key management message information 260 according to the first embodiment.

  The first key management message information 260 includes a record including a device ID 701, a writing message 702, a preverification message 703, a verification message 704, and a verification result 705. One record corresponds to one device 130.

  The data structure of the second key management message information 350 is the same as that of the first key management message information 260. However, since the first key management message information 260 is managed by the center key management server 100 and the second key management message information 350 is managed by the factory key management server 110, during the application key writing process is being executed. , Each information is updated asynchronously.

  The device ID 701 is the same as the device ID 601.

  The writing message 702 is a column that stores a writing message used for writing the application key.

  The preverification message 703 is a column that stores a preverification message for the factory key management server 110 to verify the success or failure of the application key writing process. As will be described later, the preverification message is generated by the center key management server 100.

  The verification message 704 is a column that stores a verification message for the center key management server 100 to verify the success or failure of the application key writing process. The verification message 704 is generated by the device 130.

  The verification result 705 is a column that stores the verification result of the success or failure of the application key writing process. The verification result 705 of the first key management message information 260 stores the result of the verification performed by the center key management server 100, and the verification result 705 of the second key management message information 350 includes the factory key management. The result of the verification performed by the server 110 is stored.

  Here, the formats of the writing message, the preverification message, and the verification message used in this embodiment will be described. In the following description, the symbol indicating the writing message is defined as “M”, the symbol indicating the verification message is defined as “M ′”, and the symbol indicating the pre-verification message is defined as “M′_pre”.

  First, the format of the writing message will be described.

  The write message is composed of three parts, an ID part, a ciphertext part, and a MAC part, as shown in Expression (14).

  Here, M_ID represents an ID part, M_enc represents a ciphertext part, and M_mac represents a MAC part. Further, the symbol "||" is a symbol indicating a combination of data.

  The ID part is generated from the device ID and the additional ID as shown in Expression (15).

  Here, ID_mod represents a device ID, and ID_additiona1 represents an additional ID.

  When there are a plurality of authentication keys or application keys, the additional ID includes information for uniquely identifying each key. The additional ID is given, for example, as in Expression (16).

  Here, ID_AuthKey represents an ID that identifies the authentication key, and ID_AppKey represents an ID that identifies the application key.

  The ciphertext part is generated using a key used for encryption and a first encryption function Enc1 having a value obtained by combining a counter value and an application key as variables, as shown in Expression (17). The key used for encryption is calculated using the authentication key and the key derivation function KDF having the first fixed value as a variable, as shown in Expression (18).

  Here, CNT_app represents a counter value, k_app represents an application key, k_auth represents an authentication key, and Const_1 represents a first fixed value.

  As the MAC unit (MAC value), as shown in Expression (19), a key for calculating the MAC value and a first MAC generation function GenMAC1 that uses a value obtained by combining the ID unit and the ciphertext unit as variables are used. Generated. The key for calculating the MAC value is calculated using the authentication key and the key derivation function KDF having the second fixed value as a variable, as shown in Expression (20).

  Here, Const_2 represents a second fixed value.

  Next, the formats of the pre-verification message and the verification message will be described.

  The verification message is composed of three parts, an ID part, a ciphertext part, and a MAC part, as shown in Expression (21).

  Here, M'_ID represents an ID part, M'_enc represents a ciphertext part, and M'_mac represents a MAC part.

  The preverification message is the ciphertext part of the verification message. That is, the relationship is as shown in equation (22).

  The ID part is generated from the device ID and the additional ID as shown in Expression (23).

  Here, ID_mod represents the device ID 550, and ID_additional represents the additional ID. The ID part of the verification message has the same value as the ID part of the writing message.

  The ciphertext part is generated from the second encryption function Enc2 in which the key used for encryption and the counter value are variables, as shown in Expression (24). The key used for encryption is calculated by using the key derivation function KDF having the application key and the third fixed value as variables, as shown in Expression (25).

  Here, CNT_app represents a counter value, k_app represents an application key, and Const_3 represents a third fixed value.

  The MAC unit (MAC value) uses a key for calculating the MAC value and a second MAC generation function GenMAC2 having a variable obtained by combining the ID unit and the ciphertext unit, as shown in Expression (26). Calculated. The key for calculating the MAC value is calculated using the application key and the key derivation function KDF having the fourth fixed value as variables, as shown in Expression (27).

  Here, Const_4 represents a fourth fixed value.

  The above is the description of the formats of the write message, the preverification message, and the verification message.

  Next, the process of the key writing step will be described.

  FIG. 8 is a flowchart illustrating the outline of the key writing process of the first embodiment.

  In the key writing step, the system first shifts to the key generation / key distribution phase (step S801). In the phase, the following processing is executed.

  The administrator of the center key management server 100 or the like registers the device ID of the device 130 that issues the application key in the center key management server 100. The center key management server 100 generates as many writing messages and preverification messages as the number of registered device IDs. That is, one set of write message and preverification message is generated for one device ID. The center key management server 100 sends a write message and a preverification message to the factory key management server 110.

  Next, the system shifts to the key writing phase (step S802). In the phase, the following processing is executed.

  The factory key management server 110 transmits the received writing message to the production line terminal 120. The production line terminal 120 transmits the received writing message to the target device 130 in order to write the application key in the device 130. After executing the application key writing process, the device 130 transmits a verification message to the factory key management server 110 via the manufacturing line terminal 120. The factory key management server 110 verifies the success or failure of the application key writing process by comparing the ciphertext part of the verification message with the preverification message.

  Next, the system shifts to the center registration phase (step S803). In the phase, the following processing is executed.

  The factory key management server 110 sends a verification message to the center key management server 100. The center key management server 100 verifies the success or failure of the application key writing process using the verification message. Further, the center key management server 100 updates the device key information 250 based on the verification result.

  In the key writing process of this embodiment, the production line operates only in the key writing phase. In the key writing phase, the factory key management server 110 can verify the success or failure of the application key writing process without communicating with the center key management server 100. Further, in the verification of the success or failure of the application key writing process, the application key included in the writing message is encrypted, and only the center key management server 100 and the device 130 can decrypt it. That is, the application key can be written in the device 130 while keeping the application key secret in the factory key management server 110 and the manufacturing line terminal 120.

  9A and 9B are sequence diagrams illustrating the flow of processing in the key writing process of the first embodiment.

  The processes from step S901 to step S904 are processes executed in the key generation / key distribution phase.

  First, the center key management server 100 receives an application key issuance request for N devices 130 (step S901). The issue request is input by, for example, the administrator operating the input device 206. The issue request includes the device ID of the target device 130.

  The center key management server 100 executes a message generation process (step S902). In the message generation process, a writing message and a preverification message for each device 130 are generated. The details of the message generation process will be described with reference to FIG.

  The center key management server 100 transmits the device ID of each device 130, the writing message, and the preverification message to the factory key management server 110 (step S903).

  Upon receiving the message from the center key management server 100, the factory key management server 110 updates the second key management message information 350 (step S904).

  Specifically, the control module 310 adds a record to the second key management message information 350, and the received device ID is added to the device ID 701, the writing message 702, and the preverification message 703 of the added record. , Write message, and preverification message are set. If there is already a record corresponding to the received device ID, the control module 310 sets the received device ID and write message in the device ID 701, the writing message 702, and the preverification message 703 of the record. And overwrite the preverification message.

  The processing from step S911 to step S923 is processing executed in the key writing phase.

  The production line terminal 120 transmits a message request to the factory key management server 110 at a predetermined timing (step S911). The message request includes the device ID of the device 130 that writes the application key.

  When the factory key management server 110 receives the message request, the factory key management server 110 acquires the writing message of the target device 130 from the second key management message information 350, and writes the message to the device 130 via the manufacturing line terminal 120. Message is transmitted (step S912). Specifically, the following processing is executed.

  The control module 310 refers to the second key management message information 350 and searches for a record in which the device ID 701 matches the device ID included in the message request. The control module 310 transmits the writing message set in the writing message 702 of the retrieved record to the manufacturing line terminal 120 together with the device ID.

  When the manufacturing line terminal 120 receives the writing message, the manufacturing line terminal 120 transmits the writing message to the device 130 corresponding to the device ID received together with the writing message. The above is the description of the process of step S912.

  When the device 130 receives the writing message from the factory key management server 110 via the manufacturing line terminal 120, the device 130 executes the application key writing process (step S913). In the application key writing process, the writing message is verified and the application key is written. Details of the application key writing process will be described with reference to FIG.

  When the writing process of the application key fails, that is, when the application key is not written in the device 130, the device 130 transmits an error notification to the factory key management server 110 via the manufacturing line terminal 120 (step). S914).

  When the production line terminal 120 receives the error notification, the production line terminal 120 shifts to the defective process (step S915) and updates the second key management message information 350 (step S916).

  Specifically, the control module 310 refers to the second key management message information 350, and searches for a record in which the device ID 701 matches the device ID of the device 130 that has transmitted the error notification. The control module 310 sets “write message error” in the verification result 705 of the retrieved record.

  When the application key writing process is successful, that is, when the application key is written in the device 130, the device 130 executes the verification message generation process (step S917). Further, the device 130 transmits a verification message to the factory key management server 110 via the production line terminal 120 (step S918). Details of the verification message generation process will be described with reference to FIG.

  Upon receiving the verification message, the factory key management server 110 executes the verification process of the application key writing process (step S919). Details of the verification process of the application key writing process will be described with reference to FIG.

  When the verification result is failure, the factory key management server 110 transmits the verification result notifying the failure to the manufacturing line terminal 120 (step S920). When the manufacturing line terminal 120 receives the verification result, the manufacturing line terminal 120 shifts the device 130 for which the application key writing process has failed to the defective process (step S921).

  When the verification result is successful, the factory key management server 110 transmits the verification result notifying the success to the manufacturing line terminal 120 (step S922). When the manufacturing line terminal 120 receives the verification result, the manufacturing line terminal 120 shifts the device 130 to the next step (step S923).

  The processing from step S924 to step S926 is processing executed in the center registration phase.

  The factory key management server 110 transmits all the received verification messages to the center key management server 100 (step S924).

  Specifically, the factory key management server 110 transmits to the center key management server 100, from the second key management message information 350, the device ID 701 of the record whose verification result 705 is “success” and the verification message 704. At this time, the factory key management server 110 may transmit to the center key management server 100 the device ID 701 and the like of the record whose verification result 705 is “write message error” or “failure”. The notification of the record may be sent at another timing.

  When the center key management server 100 receives the verification message, the center key management server 100 updates the first key management message information 260 (step S925).

  Specifically, the control module 210 refers to the first key management message information 260 and searches for a record in which the device ID 701 matches the device ID received together with the verification message. The control module 210 sets the received verification message in the verification message 704 of the retrieved entry.

  When the control module 210 receives the notification of the record whose verification result 705 is “write message error” or “failure”, the control module 210 adds “write message error” or “failure” to the verification result 705 of the corresponding record. Is set.

  The center key management server 100 executes the verification process of the application key writing process (step S926). Details of the verification process of the application key writing process will be described with reference to FIG.

  FIG. 10 is a flowchart illustrating an example of a message generation process executed by the center key management server 100 according to the first embodiment.

  The control module 210 selects the target device ID from the device IDs included in the application key issuance request (step S1001).

  Next, the control module 210 refers to the device key information 250 and searches for a record in which the device ID 601 matches the target device ID (step S1002).

  The control module 210 generates the application key of the device 130 corresponding to the target device ID (step S1003).

  Specifically, the control module 210 calls the key generation module 211 and gives an instruction to generate an application key. The key generation module 211 generates an application key.

  Next, the control module 210 updates the record retrieved from the device key information 250 (step S1004).

  Specifically, the control module 210 sets the generated application key in the application key 603 of the retrieved record, and adds “1” to the value of the application key counter 604 of the record.

  Next, the control module 210 generates a writing message (step S1005). Specifically, the following processing is executed.

  The control module 210 calculates the ID part of the writing message by combining the additional ID and the value of the device ID 601 of the retrieved record, as shown in Expression (15).

  The control module 210 calls the key derivation module 216 to instruct generation of a key used for encryption. The key derivation module 216 calculates the key used for encryption according to the equation (18) in which the first fixed value and the value of the authentication key 602 of the retrieved record are substituted. The control module 210 calls the first encryption module 212 and gives an instruction to generate the ciphertext part of the writing message. The first encryption module 212 uses the key used for encryption, and the expression (17) in which the value obtained by combining the application key 603 and the application key counter 604 of the retrieved record is substituted, according to Expression (17). Calculate the ciphertext part.

  The control module 210 calls the key derivation module 216 to instruct generation of a key used for encryption. The key derivation module 216 calculates the key used for encryption according to the equation (20) in which the second fixed value and the value of the authentication key 602 of the identified record are substituted. The control module 210 calls the first MAC generation module 213 and instructs generation of the MAC part of the write message. The first MAC generation module 213 calculates the MAC part according to the equation (19) in which the key used for encryption and the value obtained by combining the ID part and the ciphertext part are substituted.

  The control module 210 generates a writing message by combining the ID part, the ciphertext part, and the MAC part as shown in Expression (14). The above is the description of the process of step S1005.

  Next, the control module 210 generates a preverification message (step S1006). Specifically, the following processing is executed.

  The control module 210 calls the key derivation module 216 to instruct generation of a key used for encryption. The key derivation module 216 calculates the key used for encryption according to the equation (25) in which the third fixed value and the value of the application key 603 of the retrieved record are substituted. The control module 210 calls the second encryption module 217 and instructs the generation of the preverification message. The second encryption module 217 calculates the preverification message according to the expression (24) in which the key used for encryption and the value of the application key counter 604 of the retrieved record are substituted.

  Next, the control module 210 updates the first key management message information 260 (step S1007). Specifically, the following processing is executed.

  The control module 210 refers to the first key management message information 260 and searches for a record in which the device ID 701 matches the target device ID.

  If the record does not exist, the control module 210 adds the record to the first key management message information 260 and sets the target device ID in the device ID 701 of the added record. Further, the control module 210 sets the generated writing message and preverification message in the writing message 702 and preverification message 703 of the added record.

  When the record exists, the control module 210 sets the generated writing message and preverification message in the writing message 702 and preverification message 703 of the retrieved record. The above is the description of the process of step S1007.

  Next, the control module 210 updates the device key information 250 (step S1008).

  Specifically, the control module 210 sets “generated” in the status 605 of the record corresponding to the target device ID.

  Next, the control module 210 determines whether or not the processing has been completed for all device IDs included in the application key issuance request (step S1009).

  If the decision result in the step S1009 is NO, the control module 210 returns to the step S1001 and executes the same process.

  When the determination result of step S1009 is YES, the control module 210 ends the message generation process.

  FIG. 11 is a flowchart illustrating an example of an application key writing process executed by the device 130 according to the first embodiment.

  The control module 510 determines whether or not the verification result of the ID part of the writing message is successful (step S1101).

  Specifically, the control module 510 compares the ID part of the writing message with the device ID 550, and determines whether or not the relationship of Expression (15) is satisfied. When the relationship of Expression (15) is satisfied, the control module 510 determines that the verification result of the ID part of the writing message is successful.

  When it is determined that the verification result of the ID part of the writing message is unsuccessful, the control module 510 proceeds to step S1106.

  When it is determined that the verification result of the ID part of the writing message is successful, the control module 510 acquires the application key and the counter value from the writing message (step S1102). Specifically, the following processing is executed.

  The control module 510 calls the key derivation module 516 to instruct the generation of the derived key. The key derivation module 516 calculates the derived key according to the equation (18) in which the authentication key 560 is substituted.

  The control module 510 calls the first decryption module 511 to instruct decryption of the ciphertext part of the writing message. The first decryption module 511 decrypts the ciphertext part according to the equation (6) in which the derivation key and the ciphertext part of the writing message are substituted. As a result, the control module 510 can acquire the application key and the counter value. The above is the description of the process of step S1102.

  Next, the control module 510 determines whether or not the verification result of the counter value is successful (step S1103).

  Specifically, the control module 510 determines whether the counter value acquired from the writing message is larger than the counter value 580 stored in the storage device 503. When the counter value acquired from the writing message is larger than the counter value 580, the control module 510 determines that the verification result of the counter value is successful.

  When the verification result of the counter value is determined to be unsuccessful, the control module 510 proceeds to step S1106.

  When it is determined that the verification result of the counter value is successful, the control module 510 determines whether the verification result of the MAC part of the writing message is successful (step S1104). Specifically, the following processing is executed.

  The control module 510 calls the key derivation module 516 to instruct generation of a key for calculating the MAC value. The key derivation module 516 calculates a key for calculating the MAC value according to the equation (20) in which the authentication key 560 and the second fixed value are substituted.

  The control module 510 calls the first MAC verification module 512 and instructs the verification of the MAC part of the write message. The first MAC verification module 512 writes the message for writing according to the equation (8) and the equation (9) in which the key for calculating the MAC value, the MAC generation target data, and the MAC part of the message for writing are substituted. Verify the MAC part of the. The above is the description of the process of step S1104.

  When the verification result of the MAC part of the writing message is determined to be unsuccessful, the control module 510 proceeds to step S1106.

  When it is determined that the verification result of the MAC part of the writing message is successful, the control module 510 stores the application key and the counter value acquired from the writing message in the storage device 503 (step S1105). After that, the control module 510 ends the application key writing process.

  Specifically, the control module 510 calls the writing module 513 and gives an instruction to write the application key and the counter value in the storage device 503. The writing module 513 writes the application key and the counter value in the storage device 503. When the application key 570 and the counter value 580 already exist, the writing module 513 overwrites each value.

  When the determination result of step S1101, step S1103, and step S1104 is NO, the control module 510 transmits an error notification to the production line terminal 120 (step S1106). After that, the control module 510 ends the application key writing process.

  FIG. 12 is a flowchart illustrating an example of the verification message generation process executed by the device 130 according to the first embodiment.

  The control module 510 generates the ID part of the verification message (step S1201).

  Specifically, the control module 510 calculates the ID part of the verification message by combining the additional ID and the device ID 550 as shown in Expression (23).

  The control module 510 generates the ciphertext part of the verification message (step S1202). Specifically, the following processing is executed.

  The control module 510 calls the key derivation module 516 to instruct generation of a key used for encryption. The key derivation module 516 calculates the key used for encryption according to the equation (25) in which the third fixed value and the application key 570 are substituted.

  The control module 210 calls the second encryption module 514 and instructs the generation of the ciphertext part of the writing message. The second encryption module 514 calculates the ciphertext part of the verification message according to the equation (24) in which the key used for encryption and the counter value 580 are substituted.

  The control module 510 generates the MAC part of the verification message (step S1203). Specifically, the following processing is executed.

  The control module 510 calls the key derivation module 516 and instructs generation of a key for calculating the MAC value. The key derivation module 516 calculates a key for calculating the MAC value according to the equation (27) in which the fourth fixed value and the application key 570 are substituted.

  The control module 510 calls the second MAC generation module 515 and gives an instruction to generate the MAC part of the verification message. The second MAC generation module 515 calculates the MAC part according to the equation (26) in which the key for calculating the MAC value and the value obtained by combining the ID part and the ciphertext part are substituted.

  The control module 510 generates a verification message (step S1204).

  Specifically, the control module 510 generates a verification message by combining the ID part, the ciphertext part, and the MAC part as shown in Expression (21).

  FIG. 13 is a flowchart illustrating an example of the verification process of the application key writing process executed by the factory key management server 110 according to the first embodiment.

  When the verification message is received, the control module 310 refers to the second key management message information 350 and searches for a record corresponding to the device 130 that has transmitted the verification message (step S1301). At this time, the control module 310 sets the received verification message in the verification message 704 of the retrieved record.

  The control module 310 determines whether the verification result of the verification message is successful (step S1302). Specifically, the following processing is executed.

  The control module 310 calls the message verification module 311 to instruct verification of the verification message.

  The message verification module 311 acquires the ciphertext part of the verification message. The message verification module 311 also acquires the pre-verification message set in the pre-verification message 703 of the specified record. The message verification module 311 determines whether the ciphertext part of the verification message and the preverification message match. When the ciphertext part of the verification message and the pre-verification message match, the message verification module 311 outputs success as the verification result of the verification message. The above is the description of the processing in step S1302.

  When it is determined that the verification result of the verification message is successful, the control module 310 updates the record (step S1303) and transmits the verification result notifying the success (step S1304). After that, the control module 310 ends the verification process of the application key writing process.

  Specifically, the control module 310 sets “success” in the verification result 705 of the retrieved record.

  When it is determined that the verification result of the verification message is failure, the control module 310 updates the record (step S1305), and also transmits the verification result notifying the failure (step S1306). After that, the control module 310 ends the verification process of the application key writing process.

  Specifically, the control module 310 sets “failure” in the verification result 705 of the record.

  The verification method in step S1302 is an example, and the following verification method is also possible.

  When the difference between the preverification message and the ciphertext part of the verification message is 1 bit, the control module 310 transmits the message resend request to the center key management server 100 again without outputting the verification result. That is, the pre-verification message and the verification message are regenerated.

  In encryption, if the plaintext (key and message) is different even by 1 bit, the difference is reflected in all the bits of the encrypted data. Therefore, it is unlikely that only one bit of the pre-verification message and the verification message may be different due to the difference in plaintext. In this case, it is highly likely that a bit inversion error associated with a transmission error has occurred in any of the messages, and the key writing process is likely to have succeeded. Therefore, when the difference between the preverification message and the ciphertext part of the verification message is 1 bit, the control module 310 transmits a message resend request to the center key management server 100. When the center key management server 100 receives the request, the center key management server 100 executes the processes of steps S902 and S903, and the factory key management server 110 transmits the received writing message to the device 130.

  On the other hand, when the difference between the preverification message and the ciphertext part of the verification message is 2 bits or more, the control module 310 proceeds to step S1305.

  FIG. 14 is a flowchart illustrating an example of the verification process executed by the center key management server 100 according to the first embodiment.

  When receiving the verification message, the control module 210 updates the first key management message information 260 (step S1401).

  Specifically, the control module 210 searches for a record whose device ID 601 matches the device ID received together with the verification message, and stores the received verification message in the verification message 704 of the record.

  Next, the control module 210 selects the target device 130 from the devices 130 that have received the verification message (step S1402).

  Specifically, the control module 210 selects a target record from the records in which the verification message is stored in the verification message 704.

  Next, the control module 210 determines whether the verification result of the ID part of the verification message is successful (step S1403).

  Specifically, the control module 210 compares the ID part of the verification message with the device ID 701 of the target record to determine whether or not the relationship of Expression (23) is satisfied. When the relationship of Expression (23) is satisfied, the control module 210 determines that the verification result of the ID part of the verification message is successful.

  When the verification result of the ID part of the verification message is determined to be unsuccessful, the control module 210 proceeds to step S1409.

  When it is determined that the verification result of the ID part of the verification message is successful, the control module 210 acquires the counter value from the verification message (step S1404). Specifically, the following processing is executed.

  The control module 210 refers to the device key information 250, searches for a record whose device ID 601 matches the device ID 701 of the target record, and acquires the application key set in the application key 603 of the searched record.

  The control module 210 calls the key derivation module 216 to instruct generation of a key used for encryption. The key derivation module 216 calculates the key used for encryption according to the equation (25) in which the application key is substituted.

  The control module 210 calls the second decryption module 214 to instruct decryption of the ciphertext part of the verification message. The second decryption module 214 decrypts the ciphertext part of the verification message according to Expression (3) in which the key used for encryption and the ciphertext part of the verification message are substituted, and acquires the counter value from the plaintext. The above is the description of the process of step S1404.

  Next, the control module 210 determines whether the verification result of the counter value is successful (step S1405). Specifically, the following processing is executed.

  The control module 210 refers to the device key information 250, searches for a record whose device ID 601 matches the device ID 701 of the target record, and acquires the value of the application key counter 604 of the searched record.

  The control module 210 determines whether the counter value acquired from the verification message matches the value of the application key counter 604. When the counter value acquired from the verification message matches the value of the application key counter 604, the control module 210 determines that the verification result of the counter value is successful. The above is the description of the process of step S1405.

  When the verification result of the counter value is determined to be unsuccessful, the control module 210 proceeds to step S1409.

  When it is determined that the verification result of the counter value is successful, the control module 210 determines whether the verification result of the MAC unit of the verification message is successful (step S1406). Specifically, the following processing is executed.

  The control module 210 calls the key derivation module 216 to instruct generation of a key for calculating the MAC value. The key derivation module 216 calculates the key for calculating the MAC value according to the equation (27) in which the application key and the second fixed value acquired in step S1405 are substituted.

  The control module 510 calls the second MAC verification module 215 and instructs the verification of the MAC part of the verification message. The second MAC verification module 215 substitutes the key for calculating the MAC value, the MAC generation target data, and the MAC of the verification message into the MAC of the verification message according to the expressions (4) and (13). Verify the department. The above is the description of the process of step S1406.

  When it is determined that the verification result of the MAC part of the verification message is failure, the control module 210 proceeds to step S1409.

  When it is determined that the verification result of the MAC part of the verification message is successful, the control module 210 updates the device key information 250 and the first key management message information 260 (step S1407). After that, the control module 210 proceeds to step S1408.

  Specifically, the control module 210 refers to the device key information 250 and sets “written” in the status 605 of the record corresponding to the target device 130. The control module 210 also refers to the first key management message information 260 and sets “success” in the verification result 705 of the record corresponding to the target device 130.

  When the determination result of step S1403, step S1405, and step S1406 is NO, the control module 210 updates the device key information 250 and the first key management message information 260 (step S1409). After that, the control module 210 proceeds to step S1408.

  Specifically, the control module 210 refers to the device key information 250 and sets “error” in the status 605 of the record corresponding to the target device 130. The control module 210 also refers to the first key management message information 260 and sets “failure” in the verification result 705 of the record corresponding to the target device 130.

  After the processing of step S1407 or step S1409 is completed, the control module 210 determines whether the processing has been completed for all the selectable devices 130 (step S1408).

  Specifically, the control module 210 determines whether or not the verification result is stored in the verification results 705 of all the records in which the verification message is stored in the verification message 704.

  When it is determined that the processing has not been completed for all the selectable devices 130, the control module 210 returns to step S1402 and executes the same processing.

  When it is determined that the processing has been completed for all the selectable devices 130, the control module 210 ends the verification processing of the application key writing processing.

  In the present embodiment, the manufacturing factory of the device 130 has been described as an example, but the application destination of the present embodiment is not limited to this. For example, it may be a car dealer or a shipping port. In this case, a dealer or port key management server is used instead of the factory key management server 110, and an automobile maintenance tool is used instead of the production line terminal 120. The configuration and function of each device are the same as those described in FIGS. 3 and 4, respectively.

  As an example of the device 130 of the present embodiment, a device compatible with Secure Hardware Extension (SHE) can be considered.

  In the case of the SHE-compatible device 130, the writing message corresponds to a combination of the messages M1, M2, and M3 of the SHE's Memory Update Protocol. The ID part of the write message corresponds to M1, the ciphertext part corresponds to M2, and the MAC part corresponds to M3. Furthermore, a combination of M4 and M5 of SHE's Memory Update Protocol corresponds to a verification message. The combination of the ID part and the ciphertext part of the verification message corresponds to M4, and the MAC part corresponds to M5. Also, the preverification message corresponds to M4 * (encrypted text part of M4) of the Memory Update Protocol of SHE. The authentication key may be, for example, SHE's MASTER_ECU_KEY, and the application key may be, for example, SHE's KEY <1>.

  In the related art, the device generates a verification message including an ID part, a ciphertext part, and a MAC part in order to verify the success or failure of the writing process of the application key to the device. The ciphertext part of the verification message is generated by encrypting the counter value using the key generated from the application key as shown in formula (24), and the MAC part is expressed as shown in formula (26). Is generated from another key generated from the application key, the device ID part, and the ciphertext part. Therefore, the ciphertext part and the MAC value cannot be decrypted without knowing the application key and the counter value.

  In the verification process of the success or failure of the key writing process in the conventional key writing process, it is necessary to verify the ciphertext part and the MAC value, but the factory key management server does not know the application key and the counter value. Therefore, it was necessary to make an inquiry to the center key management server.

  In the present embodiment, the center key management server 100, which knows the application key and the counter value, registers the generated ciphertext part in the factory key management server 110 as a preverification message before operating the manufacturing line. The factory key management server 110 can verify the success or failure of the key writing process by comparing the ciphertext part of the verification message generated by the device 130 with the preverification message. This is because if either the application key or the counter value does not match, the ciphertext part of the verification message and the preverification message do not match due to the characteristics of the cryptographic processing.

  Therefore, according to the present embodiment, the factory key management server 110 can verify the success or failure of the application key writing process without inquiring the center key management server 100. This can reduce the manufacturing cost.

  The factory key management server 110 cannot calculate the MAC unit because it cannot acquire the application key and the counter value from the preverification message that is a ciphertext. Further, even if the factory key management server 110 sends a preverification message to disguise as if the key writing process had been performed, the verification of the MAC unit fails. As a result, the center key management server 100 can detect the above-mentioned forgery. Therefore, in this embodiment, there is no security problem associated with the transmission of the preverification message.

  As described above, according to the first embodiment, secure key writing to the device 130 can be realized, and the factory key management server 110 does not write the key to the center key management server 100. You can verify the success or failure of the process.

  The second embodiment is different in how to handle the device ID in the key generation / key distribution phase. Hereinafter, the second embodiment will be described focusing on the differences from the first embodiment.

  The system configuration of the second embodiment is the same as the system configuration of the first embodiment. The configuration of each device of the second embodiment is the same as the configuration of each device of the first embodiment. However, in the second embodiment, the device key information 250 and the data structures of the first key management message information 260 and the second key management message information 350 are partially different.

  FIG. 15 is a diagram illustrating an example of the device key information 250 according to the second embodiment. FIG. 16 is a diagram illustrating an example of the first key management message information 260 according to the second embodiment.

  In the second embodiment, the record of the device key information 250 includes the record number 1501. Further, the record of the first key management message information 260 includes a record number 1601.

  In the second embodiment, the center key management server 100 and the factory key management server 110 do not hold the device ID of the device 130 in advance. Therefore, the initial value “0” is set to the device ID 601 of each record of the device key information 250 and the first key management message information 260.

  In the second embodiment, in the processing from step S901 to step S904 and the processing from step S911 to step S913, the center key management server 100 and the factory key management server 110 use the device key information 250 and the first key management message information. The processing is executed assuming that the device IDs of all the records of 260 are “0”.

  Further, in the second embodiment, the authentication key has a value of all 0 in all the write-target devices 130. The value where the authentication key is all 0 is shared in advance between the center key management server 100 and the device 130.

  In the processing from step S914, the device ID held by each device 130 is used. The factory key management server 110 acquires the device ID from the ID part included in the verification message received in step S918, and sets the device ID in the device ID 701 of the corresponding record of the second key management message information 350. The center key management server 100 acquires the device ID from the ID part included in the verification message received in step S924, sets the device ID in the device ID 601 of the corresponding record of the device key information 250, and sets The device ID is set in the device ID 701 of the corresponding record of the key management message information 260 of FIG.

  In the second embodiment, the processes of step S1101 and step S1403 are omitted.

  According to the second embodiment, the center key management server 100 can execute the key writing process even when the device ID is not known in advance.

  It should be noted that the present invention is not limited to the above-described embodiments, but includes various modifications. In addition, for example, the above-described embodiment is a detailed description of the configuration in order to explain the present invention in an easy-to-understand manner, and is not necessarily limited to one having all the configurations described. Further, a part of the configuration of the embodiment can be added, deleted, or replaced with another configuration.

  Further, each of the above-mentioned configurations, functions, processing units, processing means, etc. may be realized by hardware by designing a part or all of them with, for example, an integrated circuit. The present invention can also be realized by a program code of software that realizes the functions of the embodiments. In this case, a storage medium recording the program code is provided to the computer, and the CPU included in the computer reads the program code stored in the storage medium. In this case, the program code itself read from the storage medium realizes the function of the above-described embodiment, and the program code itself and the storage medium storing the program code constitute the present invention. As a storage medium for supplying such a program code, for example, a flexible disk, a CD-ROM, a DVD-ROM, a hard disk, an SSD (Solid State Drive), an optical disk, a magneto-optical disk, a CD-R, a magnetic tape, A non-volatile memory card, ROM or the like is used.

  The program code that implements the functions described in the present embodiment can be implemented in a wide range of programs or script languages such as assembler, C / C ++, perl, Shell, PHP, and Java (registered trademark).

  Furthermore, by distributing the program code of the software that realizes the functions of the embodiments via a network, the program code is stored in a storage means such as a hard disk or a memory of a computer or a storage medium such as a CD-RW or a CD-R. Alternatively, the CPU included in the computer may read and execute the program code stored in the storage unit or the storage medium.

  In the above-described embodiments, the control lines and information lines are shown to be necessary for explanation, and not all the control lines and information lines on the product are necessarily shown. All configurations may be connected to each other.

100 Center Key Management Server 110 Factory Key Management Server 120 Manufacturing Line Terminal 130 Device 150, 160, 170 Network 201, 301, 401, 501 Processor 202, 302, 402, 502 Memory 203, 303, 403, 503 Storage Device 204, 304 , 404, 504 Network interface 205 I / O interface 206, 306, 406 Input device 207, 307, 407 Output device 210, 310, 410, 510 Control module 211 Key generation module 212 First encryption module 213 First MAC Generation module 214 Second decryption module 215 Second MAC verification module 216, 516 Key derivation module 217, 514 Second encryption module 250 Device key information 260 First key management message information 311 Message verification module 320 Data verification module 350 Second Key Management Message Information 440 Write Message 450 Verification Message 511 First Decryption Module 512 First MAC Verification Module 513 Write Module 515 Second MAC Generation Module

Claims (12)

A system comprising a first computer that manages manufacturing of a device, and a second computer that is connected to the first computer and manages setting information set in the device,
The first computer has a first processor, a first memory connected to the first processor, and a first network interface connected to the first processor;
The second computer has a second processor, a second memory connected to the second processor, and a second network interface connected to the second processor,
The second memory stores key information which is shared by the device and the second computer, and which is used for encryption processing and decryption processing.
The second processor is
Generating a first message including a first ciphertext obtained by encrypting the setting information using the key information, and transmitting the first message to the device via the first computer;
A second message including a second ciphertext obtained by encrypting a part of the data included in the setting information using the key information is generated and transmitted to the first computer,
The first processor is
A third ciphertext obtained by encrypting a part of the information included in the setting information by using the key information from the device that stores the setting information acquired by decrypting the first ciphertext. Received a third message containing
A system for verifying whether or not the writing process of the setting information has succeeded by comparing the second message and the third message. The system of claim 1, wherein
The first processor is
Determining whether or not the second ciphertext and the third ciphertext match,
A system, wherein when the second ciphertext and the third ciphertext match, it is determined that the writing process of the setting information has succeeded. The system of claim 2, wherein
The first processor transmits a resend request for the first message to the second computer when the difference between the second ciphertext and the third ciphertext is only 1 bit. System characterized by. The system of claim 3, wherein
The setting information includes secret information and a counter value indicating the number of times the secret information has been written,
The first ciphertext is generated using a first function having variables of first cipher key information generated from the key information and a value obtained by combining the secret information and the counter value,
The second ciphertext is generated by using a second function having variables of the second cipher key information generated from the key information and the counter value,
The system is characterized in that the third ciphertext is generated using a third function in which the third cipher key information generated from the key information and the counter value are variables. The system according to claim 4, wherein
The third message includes a verification value generated from the key information and the setting information,
The second processor is
Obtaining the counter value by decrypting the third ciphertext using the key information,
It is determined whether or not the counter value used at the time of generating the first ciphertext and the counter value obtained from the third ciphertext match.
When it is determined that the counter value used when generating the first ciphertext and the counter value obtained from the third ciphertext match, the writing process of the setting information succeeds using the verification value. A system characterized by determining whether or not. The system according to claim 5, wherein
The first ciphertext is Secure Hardware Extension M2,
The second ciphertext is the M4 ciphertext part of Secure Hardware Extension.
The system is characterized in that the verification value is M5 of Secure Hardware Extension. A method of writing information in a system including a first computer that manages the manufacture of a device, and a second computer that is connected to the first computer and that manages setting information set in the device,
The first computer has a first processor, a first memory connected to the first processor, and a first network interface connected to the first processor;
The second computer has a second processor, a second memory connected to the second processor, and a second network interface connected to the second processor,
The second memory stores key information that is shared by the device and the second computer and is used for encryption processing and decryption processing,
In the method of writing the information, the second processor generates a first message including a first ciphertext obtained by encrypting the setting information by using the key information, and transmits the first message via the first computer. The first step of transmitting to the device,
The second processor generates a second message including a second ciphertext obtained by encrypting a part of data included in the setting information using the key information, and transmits the second message to the first computer. The second step to do,
The first processor encrypts a part of the information included in the setting information using the key information from the device that stores the setting information acquired by decrypting the first ciphertext. A third step of receiving a third message containing the encrypted third ciphertext,
A fourth step in which the first processor verifies whether or not the writing process of the setting information has succeeded by comparing the second message and the third message. How to write characteristic information. A method for writing information according to claim 7, wherein
The fourth step is
The first processor determining whether or not the second ciphertext and the third ciphertext match;
The first processor determines that the writing process of the setting information has succeeded when the second ciphertext and the third ciphertext match. How to write. A method for writing information according to claim 8, wherein
In the fourth step, when the first processor determines that the difference between the second ciphertext and the third ciphertext is only 1 bit, the second message is transmitted to the second computer. A method of writing information, comprising the step of transmitting a resend request. A method for writing information according to claim 9, wherein
The setting information includes secret information and a counter value indicating the number of times the secret information has been written,
The first ciphertext is generated using a first function having variables of first cipher key information generated from the key information and a value obtained by combining the secret information and the counter value,
The second ciphertext is generated using a second function having variables of the second cipher key information generated from the key information and the counter value,
Writing the information characterized in that the third ciphertext is generated by using a third function having variables of the third cipher key information generated from the key information and the counter value. Method. The method for writing information according to claim 10, wherein
The third message includes a verification value generated from the key information and the setting information,
The information writing method is
The second processor obtains the counter value by decrypting the third ciphertext using the key information;
A step in which the second processor determines whether or not the counter value used when generating the first ciphertext and the counter value acquired from the third ciphertext match;
When it is determined that the counter value used when generating the first ciphertext and the counter value acquired from the third ciphertext match, the second processor uses the verification value to perform the setting. And a step of determining whether or not the information writing process has succeeded. The method for writing information according to claim 11,
The first ciphertext is Secure Hardware Extension M2,
The second ciphertext is the M4 ciphertext part of Secure Hardware Extension.
The information writing method, wherein the verification value is M5 of Secure Hardware Extension.

Images