JP6699059B2 - Wireless device, roadside communication device, updating method, and computer program - Google Patents

Description

  The present invention relates to a wireless device, a roadside communication device, an updating method, and a computer program.

In recent years, an intelligent transportation system (ITS) based on road-vehicle communication and vehicle-vehicle communication has been studied. Road-to-vehicle communication is communication between a roadside communication device and an in-vehicle communication device (mobile communication device), and inter-vehicle communication is communication between an in-vehicle communication device (mobile communication device).
Standards and guidelines have been established for communication methods and security for such intelligent transportation systems (see, for example, Non-Patent Documents 1 and 2).

JP, 2016-105770, A

General Association of Radio Industries and Businesses, "700MHz band intelligent transportation system ARIB-STD-T109 1.2 version", [online], December 10, 2013, [June 27, 2016 search], internet < http://www. arib. or. jp/tyosakenkyu/kikaku_tushin/tsushin_kikaku_number. html> ITS Information and Communication Systems Promotion Conference, "Security Guidelines for Driver Assistance Communication Systems, ITSFORUM RC-009 1.2 Edition", [online], November 25, 2013, [June 27, 2016 Search], Internet< http://www. itsforum. gr. jp/Public/J7Database/index. html>

As a security measure for each communication in the above system, a method (electronic signature method) to which an electronic signature by a public key algorithm is applied is being studied.
In the digital signature method, a key pair (security processing data) of a private key and a public key is stored in a communication device, and the communication device uses this key pair to add a public key certificate and a digital signature to transmission data. .. The communication device that receives this can authenticate the data with the public key certificate and the electronic signature, and can prevent spoofing and data tampering.

A plurality of the above key pairs are prepared as in Patent Document 1, for example, and an expiry date that can be used may be set for each of the plurality of key pairs.
The validity period is different for each of the multiple key pairs, and the roadside communication device switches the key pair to be used based on the validity period, and performs wireless communication using different key pairs for multiple generations. Can be configured.

The roadside communication device needs to know the current date and time in order to switch the key pair based on the expiration date of each of the plurality of key pairs.
Here, the roadside communication device used in the above system includes a roadside communication device (on-line roadside communication device) connected to a central device that manages the roadside communication device through a wired communication line, and a wired device for the central device. It may include a roadside communication device (standalone roadside communication device) that is not connected by a communication line.

The online roadside communication device corrects the internal time and measures the current date and time based on time information such as a time adjustment command transmitted from the central device through the wired communication line periodically or in response to a request.
On the other hand, the stand-alone roadside communication device acquires time information from the central unit through roadside communication with the online roadside communication device, corrects the internal time, and measures the current date and time.

By the way, the roadside communication device is configured to expand identification information for identifying the current-generation key pair currently in use in the volatile storage unit and specify the key pair to be used based on this identification information. be able to.
Further, the roadside communication device can store the identification information of the current generation in the nonvolatile storage unit.
In this case, the roadside communication device reads the identification information of the current generation stored in the nonvolatile storage unit and restores the identification information of the current generation in the volatile storage unit, even if the power is turned off for some reason. Configured to be able to.

FIG. 11 is a diagram showing the relationship between the timing when the roadside communication device is powered off and then restarted, and the expiration date of the key pair.
As shown in FIG. 11A, when the power-off timing and the subsequent restart timing are both within the valid period of the current-generation key pair, the roadside communication device restarts the nonvolatile storage unit. It is possible to read the identification information of the current generation stored in, and restore the identification information of the current generation in the volatile storage unit.

  On the other hand, as shown in FIG. 11B, when the expiration date of the current-generation key pair is located between the power-off timing and the subsequent restart timing, the roadside communication device is non-volatile. Even if the identification information of the current generation stored in the storage unit is read and the identification information of the current generation is restored in the volatile storage unit, the expiration date of the key pair of the current generation has already expired. Therefore, as it is, the roadside communication device cannot perform wireless communication with the other communication device using the key pair. Note that FIG. 11B shows a case where the roadside communication device is turned off for some reason before voluntarily switching the key pair.

Further, the roadside communication device loses the current date and time, which has been clocked until then, unless the clock is maintained by a battery or the like.
In this respect, if it is an online roadside communication device, even if it is not possible to perform wireless communication using a key pair with other communication devices, the clocking of the current date and time is started based on the time information from the central device. It is possible to switch the key pair according to the expiration date. If the key pair is appropriately switched, the online roadside communication device can perform wireless communication with another communication device using the key pair.

However, when the stand-alone roadside communication device is in a situation as shown in FIG. 11(b), wireless communication using the key pair cannot be performed with the other communication device, and therefore, with the other roadside communication device. Roadside communication cannot be performed between them, and time information from the central device cannot be acquired.
For this reason, the stand-alone roadside communication device cannot switch the key pair according to the expiration date, and must be out of the state where wireless communication using the key pair cannot be performed with other communication devices. Becomes difficult.

  The present invention has been made in view of such circumstances, and an object of the present invention is to provide a technique capable of preventing a state in which wireless communication with another device cannot be performed.

  A wireless device according to one embodiment is a wireless device that acquires time information from another wireless device and performs wireless communication with the other wireless device using a plurality of security processing data corresponding to a plurality of generations. The first identification information indicating the current generation security processing data used for the wireless communication among the plurality of security processing data and the second identification information indicating the next generation security processing data are stored. A volatile storage unit, a non-volatile storage unit that stores storage information indicating any of the plurality of security processing data, and a volatile storage unit that is stored in the non-volatile storage unit when the volatile storage unit is reset. A restoration unit that restores the stored information as the new first identification information in the volatile storage unit, and the next-generation security processing data from the current-generation security processing data specified based on the time information. An updating unit that updates the first identification information with the second identification information based on a timing of switching to data, and the updating unit stores the second identification information in the nonvolatile storage based on the timing. A storage unit, and then reset the volatile storage unit to cause the restoration unit to restore the storage information of the nonvolatile storage unit to the volatile storage unit as the new first identification information, A first processing unit that updates the first identification information with the second identification information, and security processing data other than the next-generation security processing data after the first processing unit updates the first identification information. The second processing unit stores identification information indicating security processing data that can be used in the next and subsequent generations as the storage information in the nonvolatile storage unit.

  In addition, a roadside communication device that is an embodiment includes the wireless device.

  In addition, the update method according to the embodiment is a wireless method that acquires time information from another wireless device and wirelessly communicates with the other wireless device using a plurality of security processing data corresponding to a plurality of generations. First identification information indicating the current generation security processing data used for the wireless communication among the plurality of security processing data, and second identification information indicating the next generation security processing data, And a non-volatile storage section for storing storage information indicating any one of the plurality of security processing data, and a method for updating the first identification information executed in a wireless device. Then, when the volatile storage unit is reset, a restoration step of restoring the storage information stored in the nonvolatile storage unit to the volatile storage unit as the new first identification information, and the time information. The second identification information is stored in the non-volatile storage unit based on the timing of switching from the current-generation security processing data to the next-generation security processing data, which is specified based on the volatile property. By resetting the storage unit, the storage information of the nonvolatile storage unit is restored to the volatile storage unit as the new first identification information by the restoration step, and the first identification information is set to the second identification information. After the updating step, the identification information indicating the security processing data other than the next-generation security processing data and usable after the next generation is stored information after the updating step. And a storage step of storing in the nonvolatile storage section.

  A computer program according to an embodiment is a wireless device that acquires time information from another wireless device and performs wireless communication with the other wireless device using a plurality of security processing data corresponding to a plurality of generations. The first identification information indicating the current generation security processing data used for the wireless communication among the plurality of security processing data and the second identification information indicating the next generation security processing data are stored. A computer having a wireless device including a volatile storage unit for storing the security information and a non-volatile storage unit for storing storage information indicating any one of the plurality of pieces of security processing data, and updating the first identification information. Is a computer program for, when the volatile storage unit is reset by the computer, the storage information stored in the nonvolatile storage unit is restored in the volatile storage unit as the new first identification information. Based on the restoration step and the timing of switching from the current-generation security processing data to the next-generation security processing data specified based on the time information, the second identification information is stored in the nonvolatile storage unit. And then resetting the volatile storage unit to restore the stored information in the nonvolatile storage unit as the new first identification information in the volatile storage unit by the restoring step, 1 update information for updating the identification information with the second identification information, and after the updating step, security processing data other than the security processing data for the next generation, which is usable for the security processing after the next generation. And a storage step of storing identification information indicating data in the nonvolatile storage unit as the storage information.

  According to the present invention, it is possible to prevent a situation in which wireless communication with another device cannot be performed.

It is a schematic perspective view which shows the whole structure of the intelligent transportation system (ITS) which concerns on embodiment. It is a figure which shows an example of the aspect of the communication connection of each roadside communication apparatus in this system. It is a block diagram which shows the structure of the roadside communication apparatus which concerns on this embodiment. It is a block diagram which shows the structure of a wireless module. (A) is a figure which shows the aspect of the transmission data which a wireless module transmits, the figure which shows an example of the data for electronic signatures memorize|stored in the memory|storage part, and the figure which shows an example of an expiration date list. It is the figure which showed typically the information which the memory|storage part memorize|stores. It is a flow chart which shows an example of the update processing which a communication control part performs. 9 is a flowchart illustrating an example of processing of a restoration unit at the time of restart other than update processing. It is the figure which showed an example of the aspect of the process at the time of starting for the first time after installing a stand-alone roadside communication machine over time. It is the figure which showed an example of the aspect of the process at the time of a restart other than the update process by a stand-alone roadside communication apparatus and the update process over time. FIG. 6 is a diagram showing the relationship between the timing when the roadside communication device is powered off and then restarted, and the expiration date of the key pair.

[Description of Embodiments]
First, the contents of the embodiment will be listed and described.
(1) A wireless device according to an embodiment acquires time information from another wireless device and performs wireless communication with the other wireless device using a plurality of security processing data corresponding to a plurality of generations. A wireless device, first identification information indicating the current generation security processing data used for the wireless communication among the plurality of security processing data, and second identification information indicating the next generation security processing data. , A non-volatile storage unit for storing storage information indicating any one of the plurality of security processing data, and the non-volatile storage unit when the volatile storage unit is reset. A restoration unit that restores the stored stored information as the new first identification information in the volatile storage unit, and the next generation of the next generation security data specified based on the time information. An updating unit that updates the first identification information with the second identification information based on a timing of switching to security processing data, and the updating unit updates the second identification information based on the timing. By storing the information in the non-volatile storage unit and then resetting the volatile storage unit, the restoration unit restores the storage information of the non-volatile storage unit to the volatile storage unit as the new first identification information. And a first processing unit that updates the first identification information with the second identification information, and a security process other than the next-generation security processing data after the first processing unit updates the first identification information. Second data processing unit for storing identification information indicating security processing data usable for the next and subsequent generations as the storage information in the nonvolatile storage unit.

According to the wireless device having the above configuration, after updating the first identification information with the second identification information, the identification information indicating the security processing data that can be used in the next and subsequent generations is stored in the nonvolatile storage unit as storage information. Therefore, if the wireless device is powered off for some reason and the volatile storage unit is reset after that, the restoration unit adds the identification information indicating the security processing data that can be used in the next and subsequent generations to the new first information. The identification information is restored in the volatile storage unit.
Therefore, even if the generation of power advances between the timing of turning off the power of the wireless device and the timing of restarting it thereafter, even if the expiration date of the security processing data used before the power was turned off, The roadside communication device can perform wireless communication with another wireless device by using the security processing data that can be used in the next generation or later. As a result, it is possible to prevent a situation in which the wireless communication with another wireless device cannot be performed due to the expiration date of the security processing data.

(2) In the wireless device, security processing data other than the next-generation security processing data that can be used in the next and subsequent generations is the most future generation of the plurality of generations. The corresponding security processing data is preferable.

(3) In the wireless device, the non-volatile storage unit may store identification information indicating security processing data corresponding to the most future generation of the plurality of generations as initial storage information.
In this case, when the wireless device is activated for the first time, the identification information indicating the security processing data that can be used in the next generation or later is restored in the volatile storage unit as the new first identification information. Therefore, it is possible to prevent the security processing data to be used from expiring regardless of the time of the first activation.

(4) Further, a roadside communication device according to one embodiment includes the wireless device described in (1) to (3) above.

(5) The update method according to one embodiment obtains time information from another wireless device and performs wireless communication with the other wireless device using a plurality of security processing data corresponding to a plurality of generations. A wireless device, first identification information indicating the current generation security processing data used for the wireless communication among the plurality of security processing data, and second identification information indicating the next generation security processing data. And a non-volatile storage section that stores storage information indicating any of the plurality of security processing data, and a method for updating the first identification information, which is executed in a wireless device. Then, when the volatile storage unit is reset, a restoration step of restoring the storage information stored in the nonvolatile storage unit to the volatile storage unit as the new first identification information, and the time information. The second identification information is stored in the non-volatile storage unit based on the timing of switching from the current-generation security processing data to the next-generation security processing data specified based on the The volatile memory unit by resetting the volatile memory unit to restore the memory information of the non-volatile memory unit to the volatile memory unit as the new first identification information by the restoring step, and to restore the first identification information to the second identification information. An updating step of updating with information, and after the updating step, storing the security processing data other than the security processing data of the next generation, the identification information indicating the security processing data usable in the next generation and thereafter. A storage step of storing the information in the nonvolatile storage section.

(6) Further, the computer program according to an embodiment acquires time information from another wireless device and wirelessly communicates with the other wireless device using a plurality of security processing data corresponding to a plurality of generations. A first identification information indicating the current generation security processing data used for the wireless communication among the plurality of security processing data, and the second identification indicating the next generation security processing data. Information and a volatile storage unit for storing the information, and a non-volatile storage unit for storing the storage information indicating any one of the plurality of pieces of security processing data. A computer program for executing update processing, wherein when the volatile storage unit is reset by a computer, the volatile information is stored in the nonvolatile storage unit as the new first identification information. The second identification information on the basis of a restoration step of restoring to the security storage unit and a timing of switching from the current generation security processing data to the next generation security processing data specified based on the time information. By storing in the non-volatile storage unit and then resetting the volatile storage unit, the stored information in the non-volatile storage unit is stored in the volatile storage unit as the new first identification information in the restoring step. An updating step of restoring and updating the first identification information with the second identification information; and, after the updating step, security processing data other than the next-generation security processing data, which is used in the next and subsequent generations. And a storage step of storing identification information indicating possible security processing data in the nonvolatile storage unit as the storage information.

[Details of Embodiment]
Hereinafter, preferred embodiments will be described with reference to the drawings.
It should be noted that at least a part of the embodiments described below may be arbitrarily combined.
[Communication system configuration]
FIG. 1 is a schematic perspective view showing the overall configuration of an intelligent transportation system (ITS) according to the embodiment. In the present embodiment, as an example of the road structure, it is assumed that a cross grid structure in which a plurality of north-south and east-west roads intersect each other.
As shown in FIG. 1, the intelligent transportation system according to the present embodiment includes a traffic signal 1, a roadside communication device 2, an in-vehicle communication device (mobile communication device) 3, a central unit 4, a vehicle 5 equipped with an in-vehicle communication device 3, Also, a roadside sensor 6 including a vehicle detector and a surveillance camera is included.
Note that points not particularly described in the present embodiment are based on Non-Patent Document 1.

The traffic signal device 1 and the roadside communication device 2 are installed at each of a plurality of intersections J1 to J9, and are connected to the router 8 via a wired communication line 7 such as a telephone line. This router 8 is connected to the central unit 4 in the traffic control center.
The central device 4 constitutes a LAN (Local Area Network) with the traffic signal 1 and the roadside communication device 2 in the area under its control. The central unit 4 may be installed on the road instead of the traffic control center.

  The roadside sensors 6 are installed at various places on the road in the area under the control of the road, for the purpose of counting the number of vehicles flowing into or out of each intersection. The roadside sensor 6 is composed of a vehicle detector that ultrasonically senses the vehicle 5 passing directly underneath, or a surveillance camera that takes time-series images of traffic conditions on the road. Sensing information and image data are transmitted through the wired communication line 7. Via the central device 4. In addition, in FIG. 1, only one signal light device is depicted at each intersection for simplification of the illustration, but at each actual intersection, at least four signal lights are provided for ascending and descending roads intersecting each other. The vessel is installed.

In the intelligent transportation system, a plurality of roadside communication devices 2 that are installed at each of a plurality of intersections and that constitute a wireless communication system perform wireless communication (roadside-vehicle communication) with an onboard communication device 3 of a vehicle traveling around the intersection. ) Is possible.
Further, each roadside communication device 2 is also capable of wireless communication (roadside road communication) with another roadside communication device 2 located within a predetermined range where a transmission wave of its own reaches.
In addition, the vehicle-mounted communication device 3 that also configures the wireless communication system performs wireless communication (vehicle-to-vehicle communication) with the roadside communication device 2 by a carrier sense method and wireless communication (vehicle communication) with another vehicle-mounted communication device 3. Inter-vehicle communication) is possible.

The roadside communication is communication performed between the roadside communication devices 2 and is performed by one roadside communication device 2 transmitting a communication packet to another roadside communication device 2.
The road-to-vehicle communication is communication performed between the roadside communication device 2 and the in-vehicle communication device 3, and the roadside communication device 2 broadcast-transmits a communication packet (road-vehicle communication information) to the in-vehicle communication device 3. Is done by doing.
The vehicle-to-vehicle communication is communication performed between the vehicle-mounted communication devices 3 and is performed by transmitting a communication packet (vehicle-to-vehicle communication information) by the carrier sense method.
The inter-vehicle communication is communication performed between the on-vehicle communication device 3 and the road-side communication device 2, and the on-vehicle communication device 3 transmits a communication packet (inter-vehicle road) to the road-side communication device 2 by a carrier sense method. Communication information) is transmitted.

The traffic signal 1 and the roadside communication device 2 (on-line roadside communication device 2a) connected to the central device 4 by the wired communication line 7 are one of all the roadside communication devices 2 included in the area controlled by the central device 4. There is also a roadside communicator 2 (standalone roadside communicator 2b) which is a part and is not connected to the central unit 4 by the wired communication line 7.
In FIG. 1, the roadside communication devices 2 installed at the intersections J4 to J6 are online roadside communication devices 2a, and the roadside communication devices 2 installed at other intersections are standalone roadside communication devices 2b.

  The stand-alone roadside communication device 2b performs wireless communication with another online roadside communication device 2a and another stand-alone roadside communication device 2b to exchange traffic information, signal information, device management information, and other information necessary for the system. To do.

FIG. 2 is a diagram showing an example of a mode of communication connection of each roadside communication device 2 in the present system. As shown in the figure, each online roadside communication device 2a is connected to the central device 4 via a wired communication line 7 and lower devices such as a router and a communication processing device. Therefore, the online roadside communication device 2 a acquires various information given from the central device 4 through the wired communication line 7.
The stand-alone roadside communication device 2b is communicatively connected to the online roadside communication device 2a by roadside communication. Therefore, the stand-alone roadside communication device 2b acquires various information given from the central device 4 through roadside road communication with the online roadside communication device 2a.

FIG. 3 is a block diagram showing the configuration of the roadside communication device 2 according to the present embodiment.
As shown in FIG. 3, the online roadside communication device 2a relates to a wireless module 21 to which an antenna 20 is connected, a wired communication unit 22 for communicating with the central device 4 via the wired communication line 7, and a communication control. And a communication processing device 23 that performs processing.

The communication processing device 23 has a function of controlling the wireless module 21 and the wired communication unit 22 to perform processing related to wireless communication and wired communication.
The communication processing device 23 has a function of processing transmission/reception data transmitted/received by communication such as road-to-vehicle (road) communication and road-to-road communication. The communication processing device 23 also has a function of processing transmission/reception data transmitted/received by wire communication with the central device 4.

  The wireless module 21 is a wireless device for performing wireless transmission/reception in road-vehicle (road) communication and road-road communication. The wireless module 21 wirelessly transmits, as a transmission signal, transmission data relating to road-to-vehicle communication, road-to-road communication, and the like provided from the communication processing device 23. In addition, the wireless module 21 receives a received signal by road-vehicle (road) communication and road-side communication, and gives the received received signal to the communication processing device 23 as received data.

As shown in FIG. 3, the stand-alone roadside communication device 2b includes a wireless module 24 and a communication processing device 23, but does not include a wired communication unit for performing wired communication with the central device 4.
The communication processing device 23 of the stand-alone roadside communication device 2b and the communication processing device 23 of the online roadside communication device 2a have the same function.
The wireless module 24 of the stand-alone roadside communication device 2b has substantially the same function as the wireless module 21 of the online roadside communication device 2a.

FIG. 4 is a block diagram showing the configuration of the wireless module 24.
The wireless module 24 includes a transmitting/receiving unit 30 to which the antenna 20 is connected, a processing unit 31, and a storage unit 32.
The transmission/reception unit 30 has a function of performing modulation/demodulation or amplification of a transmission/reception signal transmitted/received by the antenna 20.

The processing unit 31 constitutes a computer together with the storage unit 32, and the functions of the processing unit 31 are realized by the computer program stored in the storage unit 32 being executed by the processing unit 31.
The processing unit 31 functionally includes a communication control unit 33 and a timer 34.
The communication control unit 33 performs necessary processing on the transmission data provided from the communication processing device 23, and provides the transmission data to which the necessary processing has been performed to the transmission/reception unit 30. Further, the communication control unit 33 performs necessary processing on the reception signal received by the transmission/reception unit 30, acquires reception data from the reception signal, and gives the reception data to the communication processing device 23.

The communication control unit 33 also has a function of executing security processing as necessary processing when transmitting and receiving data.
The communication control unit 33 performs security processing based on the electronic signature method when performing road-to-vehicle communication and road-to-road communication.
Further, the communication control unit 33 includes a first updating unit 35, a second updating unit 36, and a restoring unit 37 as functional units for executing the updating process of the information used for the security process.
The security processing performed by the communication control unit 33 will be described later.

  Further, the communication control unit 33 has a function of causing the timer 34 to measure the current date and time required for executing various processes. The communication control unit 33 sets the date and time measured by the timer 34 to be the current date and time (current date and time) based on the time information given from the central device 4, and causes the timer 34 to measure the current date and time.

The timer 34 outputs an indefinite value when the wireless module 24 is reset or the power is turned off while the current date and time are being clocked, and the accurate current date and time cannot be clocked. To do. The indefinite value is a value represented by a value other than the value for indicating the date and time, and is a value that cannot be recognized as the date and time by the other party who receives it.
When the timer 34 outputs an indefinite value due to power-off or the like, when the communication control unit 33 acquires the time information, the communication control unit 33 sets the timer 34 to measure the current date and time based on the time information.

The time information from the central device 4 may be given periodically, or may be given from the roadside communication device 2 side to the central device 4 and given in response to the request.
The time information from the central unit 4 is given to the communication control unit 33 through the road-to-road communication with the online roadside communication device 2a, and may also be given to the communication control unit 33 from the communication processing device 23.

Here, the online roadside communication device 2a can acquire time information through either roadside communication by the wireless module 21 or wire communication by the wire communication unit 22.
On the other hand, the standalone roadside communication device 2b acquires the time information only through the roadside communication with the online roadside communication device 2a by the wireless module 24.

The communication processing device 23 has a function of measuring the current date and time based on the time information from the central device 4 provided through either roadside communication or wired communication.
Therefore, for example, when the wireless module 21 (or the wireless module 24) is reset and the timer 34 is also reset, the communication control unit 33 acquires information indicating the current date and time from the communication processing device 23, and then from the communication processing device 23. It is possible to cause the timer 34 to measure the current date and time based on the information of.

  The storage unit 32 stores information used for security processing executed by the communication control unit 33, in addition to the computer programs described above.

[About security processing]
The wireless module 24 of the present embodiment performs security processing based on the electronic signature method as described above when performing road-to-vehicle communication and road-to-road communication.

FIG. 5A is a diagram showing a form of transmission data transmitted by the wireless module 24.
When performing the road-vehicle communication and the road-road communication, the wireless module 24 adds the public key certificate 41 and the electronic signature 42 to the transmission data and transmits the transmission data.

The wireless device (wireless module 24) on the receiving side, which receives the transmission data to which the public key certificate 41 and the electronic signature 42 are added, verifies the electronic signature 42 with respect to the transmission data and verifies the public key certificate 41. By performing the above, it is possible to confirm that the transmission source of the received transmission data is not spoofed and that the data has not been tampered with.
Therefore, if the public key certificate 41 and the electronic signature 42 are not added to the received transmission data, the receiving side wireless device (the wireless modules 21 and 24) discards the transmission data without giving it to the communication processing device 23. To do.

  Further, the public key certificate 41 has an expiration date set, and the public key certificate 41 using the electronic signature data whose expiration date has expired and the transmission data to which the electronic signature 42 is added are received and received. The wireless device on the side (wireless modules 21 and 24) discards the received transmission data without giving it to the communication processing device 23.

Therefore, the communication control unit 33 cannot give the transmission data to the receiving-side wireless device (the wireless modules 21 and 24) without performing the security process, and can perform the road-vehicle communication or the road-road communication. Can not.
Therefore, when transmitting the transmission data, the communication control unit 33 adds the valid (non-expired) public key certificate 41 and the electronic signature 42 to the transmission data as the security process, and transmits the transmission data. ..

The storage unit 32 of the wireless module 24 stores electronic signature data (key pair) which is security processing data used for security processing by the communication control unit 33.
FIG. 5B is a diagram showing an example of digital signature data stored in the storage unit 32.
As shown in FIG. 5B, a plurality of pieces of electronic signature data are stored in the storage unit 32 as the key pair table 40.

  Each of the plurality of digital signature data is composed of a pair of a roadside public key certificate (public key certificate of the roadside communication device 2) 41 and a secret key 43.

The private key 43 is used to generate the electronic signature 42 added to the transmission data by the communication control unit 33.
As shown in FIG. 5B, the roadside public key certificate 41 includes a public key 41a of the roadside communication device 2 and expiration date information 41b of the public key 41a. That is, the digital signature data forms a key pair including the public key 41a and the secret key 43 used in pair with each other.
The roadside public key certificate 41 is a certificate that the management organization certifies that the owner of the public key 41a is the roadside communication device 2. The management organization is a third party organization (certificate authority; Certificate Authority: CA) other than the ITS service provider.
The expiration date information 41b is information indicating the expiration date of each public key 41a (each electronic signature data).

In the key pair table 40, each of the plurality of pieces of digital signature data is associated with a key ID 44 that is identification information for identifying each piece of digital signature data (each key pair).
The key ID 44 indicates the generation of each electronic signature data. The expiration dates of multiple digital signature data are set to be different from each other.By dividing a certain period into multiple generations and setting the expiration date, the digital signature data to be used for each generation is set. ing.
The electronic signature data of a previous generation has a plurality of sets of digital signature data (the larger the number of key IDs 44), the earlier the expiration date of the public key 41a indicated by the expiration date information 41b is set.

  In the key pair table 40 of the present embodiment, n key IDs 44 (“i”) from “1” to “n” are registered, and n key IDs 44 for n digital signatures are registered. The data is registered. Therefore, in the key pair table 40, digital signature data for n generations from the first generation to the nth generation is registered.

  The communication control unit 33 selects and uses one of the digital signature data. The communication control unit 33 specifies the key ID 44 indicating the digital signature data of the generation corresponding to the current date and time, and reads the digital signature data corresponding to the specified key ID 44 from the key pair table 40.

The storage unit 32 of the wireless module 24 stores an expiration date list in which the key ID 44 and the expiration date of the electronic signature data are registered in association with each other.
FIG. 5C is a diagram showing an example of the expiration date list.
In the expiration date list 45, the key ID 44 and the expiration date indicated by the expiration date information 41b of the electronic signature data corresponding to the key ID 44 are registered.

The communication control unit 33 refers to the expiration date list in order to specify the electronic signature data of the generation according to the current date and time.
The communication control unit 33 identifies, from the expiration date list 45, the key ID 44 that is the expiration date of the closest date and time among the expiration dates that have not passed the current date and time measured by the timer 34, and the electronic ID indicated by this key ID 44 is specified. The signature data is used as the current generation (current generation) digital signature data.
Accordingly, the communication control unit 33 uses the valid (non-expired) electronic signature data and adds the valid public key certificate 41 and the electronic signature 42 to the transmission data. To send.

  The communication control unit 33 stores the key ID 44 (current generation key ID 44) indicating the identified current generation electronic signature data in the storage unit 32, and then refers to the key pair table 40 to set the current generation key ID 44. The corresponding electronic signature data is read from the key pair table 40.

FIG. 6 is a diagram schematically showing the information stored in the storage unit 32.
As shown in FIG. 6, the storage unit 32 has a volatile storage unit 50 and a non-volatile storage unit 51.
In the volatile storage unit 50, a use key ID area 52 for the communication control unit 33 to write a key ID 44 corresponding to the electronic signature data to be currently used, and a next-generation electronic signature that is the next generation of the current generation. Next-generation key ID area 53, which is an area for writing a key ID 44 (next-generation key ID 44) indicating the usage data, is provided. The volatile storage unit 50 can store the current-generation key ID 44 and the next-generation key ID 44 by providing the used key ID area 52 and the next-generation key ID area 53.
The volatile storage unit 50 loses the information stored in each area when reset by powering off or resetting the wireless module 24 or the roadside communication device 2.

  The communication control unit 33 writes the key ID 44 corresponding to the electronic signature data to be used at present in the used key ID area 52. Further, the communication control unit 33 identifies the next-generation key ID 44 and writes the identified next-generation key ID 44 in the next-generation key ID area 53.

  The non-volatile storage unit 51 stores the above-described key pair table 40, and is an area for storing a key ID used after the wireless module 24 is reset or restarted. A certain activation key ID area 54 is provided.

  When executing the security processing, the communication control unit 33 refers to the key ID 44 written in the used key ID area 52, and stores the electronic signature data corresponding to the key ID 44 written in the used key ID area 52 in a nonvolatile manner. It is read from the key pair table 40 of the storage unit 51 and used for security processing. As a result, the electronic signature data corresponding to the key ID 44 of the current generation is used for security processing.

  Here, the electronic signature data has an expiration date as described above. Therefore, when the current generation key ID 44 is written in the used key ID area 52, the communication control unit 33 maintains the content of the used key ID area 52 until just before the current date and time reaches the expiration date.

For example, when the expiration date of the digital signature data of the current generation is several days and the data of the digital signature of the current generation needs to be switched to the digital signature data of the next generation, the communication control unit 33 needs to switch the key ID 44. Is updated (update processing).
The update processing is performed by rewriting the stored content of the used key ID area 52 from the currently written key ID 44 of the current generation to the key ID 44 of the next generation.

FIG. 7 is a flowchart showing an example of the update process executed by the communication control unit 33.
First, the communication control unit 33 refers to the current date and time measured by the timer 34 and the expiration date list 45, and switches the electronic signature data valid in the current generation to the electronic signature data valid in the next generation. The first updating unit 35 is caused to determine whether it is timing (step S1).
When the current date and time measured by the timer 34 is several days before the expiration date of the electronic signature data valid in the current generation (for example, 5 days before), the first updating unit 35 determines that it is the switching timing.
When it is not determined to be the switching timing, the first updating unit 35 returns to step S1 again and determines whether it is the switching timing. Therefore, the first updating unit 35 continuously determines the switching timing until the switching timing is determined.

When it is determined in step S1 that it is the switching timing, the first updating unit 35 proceeds to step S2, and stores the next-generation key ID 44 written in the next-generation key ID area 53 of the volatile storage unit 50 in the nonvolatile storage. It is written as stored information in the activation key ID area 54 of the unit 51 (step S2).
Here, the key ID 44 of the current generation is represented by “i”, and the key ID 44 of the next generation is represented by “i+1”. Further, the current generation key ID 44 (ID=i) is written in the used key ID area 52, and the next generation key ID 44 (ID=i+1) is written in the next generation key ID area 53 at the step S1. It is assumed that it has been written by the communication control unit 33.

Next, the first updating unit 35 proceeds to step S3, resets the wireless module 24, and restarts (step S3).
At this time, in the present embodiment, the reset of the wireless module 24 also resets the volatile storage unit 50 of the storage unit 32, and the current-generation key ID 44 and the next-generation key ID 44 stored in the volatile storage unit 50 are Lost.

  Although the timer 34 is also reset by resetting the wireless module 24, as described above, the communication control unit 33 acquires information indicating the current date and time from the communication processing device 23 and causes the timer 34 to clock the current date and time. be able to. Thereby, even after the reset of the wireless module 24, the timer 34 can measure the current date and time.

  When the wireless module 24 is reset and restarted in step S3 and the volatile storage unit 50 is also reset, the restoration unit 37 of the communication control unit 33 proceeds to step S4 and stores the stored information in the nonvolatile storage unit 51. The next-generation key ID 44 is written in the used key ID area 52 of the volatile storage unit 50 (step S4).

The communication control unit 33 reads the electronic signature data corresponding to the key ID 44 written in the used key ID area 52 from the key pair table 40 and uses it for security processing. Therefore, the key ID 44 written in the used key ID area 52 is the current generation key ID 44.
As described above, the restoration unit 37 writes the next-generation key ID 44 (ID=i+1) in the used key ID area 52 of the volatile storage unit 50, thereby creating the new-generation key ID 44 (ID=i+1). The key ID 44 of the generation is restored in the volatile storage unit 50.

That is, when the volatile storage unit 50 is reset, the restoration unit 37 restores the storage information stored in the nonvolatile storage unit 51 to the volatile storage unit 50 as a new current-generation key ID 44 (first identification information). It has a function to do.
The first updating unit 35 also stores the next-generation key ID 44 (second identification information) written in the next-generation key ID area 53 of the volatile storage unit 50 in the nonvolatile storage unit 51 based on the switching timing. By storing and then resetting the volatile storage unit 50, the restoring unit 37 restores the storage information of the nonvolatile storage unit 51 to the volatile storage unit 50 as a new current-generation key ID 44, and the current-generation key is stored. It has a function of updating the ID 44 with the next-generation key ID 44.

After step S4, the second updating unit 36 of the communication control unit 33 proceeds to step S5, and writes the key ID 44 (ID=n) of the nth generation in the activation key ID area 54 of the nonvolatile storage unit 51 (step S4). S5).
The electronic signature data corresponding to the nth generation key ID 44 (ID=n) is the electronic signature corresponding to the most future generation of the n generations of electronic signature data registered in the key pair table 40. It is data for use. Therefore, the expiration date is set to the future of the electronic signature data registered in the key pair table 40.

  In this way, the second updating unit 36 stores the key ID 44 indicating the electronic signature data that can be used in the next and subsequent generations after the first updating unit 35 updates the current-generation key ID 44 with the next-generation key ID 44. It has a function of storing the information in the nonvolatile storage unit 51.

  After step S5, the restoration unit 37 proceeds to step S6, identifies the next-generation key ID 44 (ID=(i+1)+1), and stores the identified next-generation key ID 44 in the volatile storage unit 50 in the next generation. The key ID area 53 is written (step S6), and the process ends.

  As described above, the first updating unit 35 and the second updating unit 36 configure an updating unit that updates the key ID 44 of the current generation with the key ID 44 of the next generation based on the switching timing.

  As described above, the restoration unit 37 of the communication control unit 33 stores the storage information of the non-volatile storage unit 51 in the use key ID area of the volatile storage unit 50 according to the reset of the volatile storage unit 50 in the update process. By writing the key ID 44 stored in 52 into the volatile storage unit 50 as a new current-generation key ID 44 stored in the volatile storage unit 50 (in FIG. 7, Step S4).

  Therefore, the restoration unit 37 makes the stored information in the non-volatile storage unit 51 volatile even when the roadside communication device 2 or the wireless module 24 is reset and restarted except the update process and the volatile storage unit 50 is reset. A process of writing the key ID 44 in the used key ID area 52 of the storage unit 50 is performed.

FIG. 8 is a flowchart showing an example of processing of the restoration unit 37 at the time of restart other than the update processing.
First, when a restart other than the update process occurs (step S13), the volatile storage unit 50 has been reset, and therefore the restoration unit 37 uses the storage information of the nonvolatile storage unit 51 as the usage key of the volatile storage unit 50. The data is written in the ID area 52 (step S14).
At this time, in the activation key ID area 54 of the non-volatile storage unit 51, the key ID 44 (ID=n) of the nth generation is written in step S5 in FIG.
Therefore, in step S14, the restoration unit 37 writes the nth generation key ID 44 (ID=n) in the used key ID area 52 of the volatile storage unit 50 (step S14).

  Accordingly, the communication control unit 33 executes the security process using the electronic signature data corresponding to the nth generation key ID 44.

Next, the restoration unit 37 determines whether or not the timer 34 has started counting the current time (step S15).
If the restoration unit 37 determines that the clocking of the current time has not started, the restoring unit 37 returns to step S15 and repeats the determination of whether or not the clocking of the current time has started.

  On the other hand, if it is determined that the counting of the current time has started, the restoration unit 37 proceeds to step S16 and specifies the key ID 44 (next-generation key ID 44) of the next generation of the current generation corresponding to the current time. The identified next-generation key ID 44 is written in the next-generation key ID area 53 of the volatile storage unit 50 (step S16), and the process is ended.

  In this way, even at the time of reset and restart other than the update process, the restoration unit 37 performs the process of writing the stored information of the non-volatile storage unit 51 to the key ID 44 in the used key ID area 52 of the volatile storage unit 50. Even if the roadside communication device 2b is powered off for some reason and loses the key ID 44 of the current generation stored in the volatile storage unit 50, the key ID 44 stored as stored information in the non-volatile storage unit 51 is deleted. , Is written in the used key ID area 52 as a new current generation key ID 44.

The wireless module 21 of the online roadside communication device 2a is also configured to perform the same processing as the wireless module 24 of the standalone roadside communication device 2b.
However, the wireless module 21 of the online roadside communication device 2a can acquire the time information from the central device 4 by wired communication even if the power of the roadside communication device 2a is turned off for some reason. The information indicating the current date and time can be obtained through.
Therefore, even if the roadside communication device 2b is powered off for some reason and the timer 34 is reset, the wireless module 21 of the online roadside communication device 2a can recognize the current date and time.

Here, when the generation advances between the timing of turning off the power of the online roadside communication device 2a and the timing of restarting the online roadside communication device 2a, the electronic signature data used before the power is turned off expires. If the key ID 44 written in the activation key ID area 54 of the non-volatile storage unit 51 is the key ID written in step S2 of the immediately preceding update process, the electronic signature data has expired. Consider the case of the key ID 44 corresponding to.
In this case, the wireless module 21 of the online roadside communication device 2a performs the roadside communication using the electronic signature data with another roadside communication device 2 even if the restoration process is performed in response to the restart. Can't do it. This is because the electronic signature data of the key ID 44 restored in the used key ID area 52 has expired.
However, since the wireless module 21 of the online roadside communication device 2a can clock the current date and time as described above, the current generation can be recognized and the update process can be executed.

If the update process can be executed, the wireless module 21 of the online roadside communication device 2a can perform the security process using the valid electronic signature data, and can perform the wireless communication with another communication device. ..
Therefore, in the wireless module 21 of the online roadside communication device 2a, for example, the key ID 44 written in the use key ID area 52 of the volatile storage unit 50 in step S14 is the key corresponding to the expired electronic signature data. Even if the ID is ID44, the update process can be executed thereafter, so that wireless communication can be performed with another communication device.

Therefore, in the wireless module 21 of the online roadside communication device 2a, in step S14, it is necessary that the key ID 44 written in the used key ID area 52 of the volatile storage unit 50 is the nth generation key ID 44 (ID=n). Low.
Therefore, in the update process executed by the wireless module 21 of the online roadside communication device 2a, the second update unit 36 that executes the process shown in step S5 in FIG. 7 can be omitted.

  On the other hand, with respect to the wireless module 24 of the stand-alone roadside communication device 2b, the generation progresses between the power-off timing and the subsequent restart, and the expiration date of the electronic signature data used before the power-off is expired. If the key ID 44 written in the activation key ID area 54 of the non-volatile storage unit 51 is the key ID 44 corresponding to the expired electronic signature data, the wireless module of the standalone roadside communication device 2b. Even if the restoration process is performed, 24 cannot perform the roadside communication using the electronic signature data with another roadside communication device 2, and can acquire the time information from the central device 4. become unable.

  Therefore, the stand-alone roadside communication device 2b cannot execute the update process and cannot perform the security process using the valid digital signature data, and thus performs the wireless communication with another communication device. It may be difficult to get out of the impossible state.

In this regard, in the wireless module 24 of the standalone roadside communication device 2b of the present embodiment, the next-generation key ID 44 stored in the non-volatile storage unit 51 is restored in the volatile storage unit 50 as a new current-generation key ID 44. After updating the current generation key ID 44 (step S4 in FIG. 7), the nth generation key ID 44 (ID=n) is written in the activation key ID area 54 of the non-volatile storage unit 51.
Therefore, if the wireless module 24 of the stand-alone roadside communication device 2b is powered off for some reason and the volatile storage unit 50 is reset thereafter, the restoration unit 37 causes the restoration unit 37 to generate the nth generation key ID 44 (ID=n). Is restored in the volatile storage unit 50 as the new current-generation key ID 44 (step S14 in FIG. 8). The n-th generation key ID 44 is the key ID 44 of the electronic signature data whose expiration date is set to the most future among the plurality of electronic signature data.

Therefore, even if the expiration date of the electronic signature data used before the power-off of the stand-alone roadside communication device 2b has expired, the use key ID area 52 of the volatile storage unit 50 has the nth generation data stored therein due to the restoration process. The key ID 44 is restored. For this reason, the communication control unit 33 can perform the security process using the electronic signature data whose expiration date is set to the most future among the plurality of electronic signature data, and can perform the security process with other roadside communication devices 2. Communication can take place between them.
As a result, it is possible to prevent the state in which the wireless communication with another wireless device cannot be performed due to the expiration date of the electronic signature data.

[Specific examples of processing]
FIG. 9 is a diagram showing an example of a mode of processing when the stand-alone roadside communication device 2b is first activated after being installed over time.

  In the figure, the horizontal axis indicates the passage of time. In the figure, “expiration date” indicates the expiration date of the electronic signature data of the current generation and the key ID 44 of the current generation. The “use” of the “volatile memory” indicates the key ID 44 written in the used key ID area 52 of the volatile storage unit 50. “Next” of “volatile memory” indicates the key ID 44 written in the next-generation key ID area 53 of the volatile storage unit 50. “Non-volatile memory” indicates the key ID 44 written in the activation key ID area 54 of the non-volatile storage unit 51. “Timer” indicates the operating status of the timer 34.

Further, in the figure, the number in “#number” indicates the key ID 44. For example, “#1” indicates that the key ID 44 is “1”.
In the “expiration date”, the number in “#number” represents the key ID 44 as well as the generation of the electronic signature data valid in that period. For example, “#1” indicates that it is the first generation. In the “volatile memory” and the “nonvolatile memory”, the key ID 44 written in each area is shown.

In the present embodiment, the n-th generation key ID 44 (ID=n) is written as initial storage information in the activation key ID area 54 in the non-volatile storage unit 51 (of the wireless module 24) of the standalone roadside communication device 2b. There is.
For this reason, when the stand-alone roadside communication device 2b is installed and activated for the first time, the restoration unit 37 writes the nth generation key ID 44 (ID=n) in the used key ID area 52 of the volatile storage unit 50.

Further, at the time of initial activation, the communication control unit 33 of the wireless module 24 has not yet acquired the time information from the central unit 4, so the timer 34 does not measure the current date and time and outputs an undefined value. .. Therefore, in FIG. 9, it is represented as “undefined”.
Therefore, the communication control unit 33 of the wireless module 24 cannot grasp the current date and time, and cannot specify the current-generation key ID 44 and the next-generation key ID 44.
For this reason, at the first startup, no information is written in the next-generation key ID area 53 of the volatile storage unit 50, which is indeterminate. Therefore, in FIG. 9, it is represented as “undefined”.

In the present embodiment, since the n-th generation key ID 44 (ID=n) is written as initial storage information in the activation key ID area 54 of the nonvolatile storage unit 51 of the wireless module 24, the activation is performed for the first time. At this time, the restoration unit 37 writes the n-th generation key ID 44 (ID=n) in the used key ID area 52 of the volatile storage unit 50.
For this reason, since the wireless module 24 performs the security processing using the digital signature data corresponding to the nth generation key ID 44 (ID=n), the digital signature data to be used regardless of the time of the first activation. Can be prevented from becoming the expiration date.
Therefore, even if the current date and time cannot be grasped by the timer 34, the wireless module 24 performs security processing using valid digital signature data and performs road-road communication with another roadside communication device 2. You can

Since the wireless module 24 can perform the roadside communication with another roadside communication device 2, the time information from the central device 4 can be acquired through the roadside communication.
As illustrated in FIG. 9, when the wireless module 24 acquires the time information from the central device 4, the wireless module 24 causes the timer 34 to start counting the current date and time.
Further, by this, the wireless module 24 can specify the key ID 44 of the current generation. Therefore, when the time information is acquired, the wireless module 24 identifies the current-generation key ID 44 and writes the current-generation key ID 44 in the next-generation key ID area 53 of the volatile storage unit 50.
In FIG. 9, since the valid electronic signature data is the first generation when the time information is acquired, the wireless module 24 uses the first generation key ID44 (ID=1) as the current generation key ID44 for the next generation. Write in the key ID area 53.

  At the timing (update timing) when a predetermined period has elapsed since the first generation (current generation) key ID 44 (ID=1) was written in the next generation key ID area 53 of the volatile storage unit 50, the wireless module 24 A process for writing the first-generation key ID 44 (ID=1) in the used key ID area 52 of the volatile storage unit 50 is executed.

  That is, first, at the update timing, the wireless module 24 sets the first-generation key ID 44 (ID=1) written in the next-generation key ID area 53 of the volatile storage unit 50 to the activation key of the nonvolatile storage unit 51. Write in the ID area 54.

After that, the wireless module 24 resets and restarts the wireless module 24 itself.
The volatile storage unit 50 is reset by the restart. Therefore, the wireless module 24 writes the storage information (the first-generation key ID 44 (ID=1)) in the non-volatile storage unit 51 into the used key ID area 52 in the volatile storage unit 50. Furthermore, the wireless module 24 writes the second-generation key ID 44 (ID=2) as the next-generation key ID 44 in the next-generation key ID area 53.

In addition, the wireless module 24 writes the n-th generation key ID 44 (ID=n) in the activation key ID area 54 of the nonvolatile storage unit 51.
According to the above procedure, the wireless module 24 is activated for the first time, and then enters the state in which it is possible to perform the security process using the key ID 44 (ID=1) of the current generation and perform the wireless communication.

FIG. 10 is a diagram showing an example of the mode of the update process by the stand-alone roadside communication device 2b and the process other than the update process at the time of restarting over time.
Note that FIG. 10 shows a continuation of the aspect shown in FIG. 9, and the generations and the contents stored in the storage unit continue from FIG. 9.

The wireless module 24 of the standalone roadside communication device 2b starts the update process from the first generation to the second generation at the switching timing in FIG.
Note that, as described above, the wireless module 24 determines that it is the switching timing when it is several days (for example, 5 days) before the expiration date of the electronic signature data valid in the first generation (current generation).

Further, the date and time of start of use is set for the electronic signature data valid in the second generation (next generation). The use start date and time of the second-generation digital signature data is set, for example, several days (for example, five days) before the expiration date of the first-generation (current generation) digital signature data. In this way, the current generation electronic signature data and the next generation electronic signature data may overlap in the period during which they can be effectively used.
The wireless module 24 can set the switching timing from the use start date and time of the second generation digital signature data to the expiration date of the first generation (current generation) digital signature data.

  The use start date and time set for the electronic signature data indicates the date and time when the use should be started, and does not indicate the start date when the use becomes possible. Therefore, for example, the current date and time does not mean that the second-generation digital signature data cannot be used because the second-generation digital signature data has not reached the use start date and time.

At the switching timing, the wireless module 24 stores the first-generation key ID 44 (ID=1) (first identification information) and the second-generation key ID 44 (ID=2) (second) in the volatile storage unit 50. Identification information) is stored.
The wireless module 24 writes the second-generation key ID 44 (ID=2) written in the next-generation key ID area 53 of the volatile storage unit 50 as storage information in the activation key ID area 54 of the nonvolatile storage unit 51. (Step S2 in FIG. 7).

Next, the wireless module 24 resets and restarts its own wireless module 24.
When the wireless module 24 is reset and restarted and the volatile storage unit 50 is also reset, the wireless module 24 volatiles the second generation key ID 44 (ID=2), which is the storage information of the nonvolatile storage unit 51. The data is written in the used key ID area 52 of the storage unit 50 (step S4 in FIG. 7).

Further, the wireless module 24 writes the nth generation key ID 44 (ID=n) in the activation key ID area 54 of the non-volatile storage unit 51 (step S5 in FIG. 7).
Then, the wireless module 24 identifies the next-generation key ID 44 (third-generation key ID 44 (ID=3)), and identifies the third-generation key ID 44 (ID=3) that is the identified next-generation key ID 44. The next-generation key ID area 53 of the volatile storage unit 50 is written (step S6 in FIG. 7), and the update process ends.

As described above, the wireless module 24 writes the second-generation key ID 44 (ID=2) in the used key ID area 52 of the volatile storage unit 50, and the n-th generation in the activation key ID area 54 of the nonvolatile storage unit 51. The key ID 44 (ID=n) of is written.
In addition, in the update process, the wireless module 24 obtains the information regarding the current date and time from the communication processing device 23, so that the timer 34 can continuously count the current date and time.

In FIG. 10, power-off indicates that the stand-alone roadside communication device 2b is turned off for some reason and restarted.
When the power is turned off, the volatile storage unit 50 of the wireless module 24 is reset, and the used key ID area 52 and the next generation key ID area 53 become undefined. Therefore, the stored information in the non-volatile storage unit 51 is written in the used key ID area 52 in the volatile storage unit 50 (step S14 in FIG. 8).

  After that, when the time information is acquired and the next generation key ID 44 is specified to be the third generation key ID 44 (ID=3), the specified key ID 44 is assigned to the next generation key ID area 53 of the volatile storage unit 50. (Step S16 in FIG. 8), and the process ends.

  In this case, since the n-th generation key ID 44 (ID=n) is written in the activation key ID area 54 of the non-volatile storage unit 51 in the update processing executed at the switching timing, the standalone roadside communication device 2b is powered off. When restarted, the nth generation key ID 44 (ID=n) can be restored as the current generation key ID 44 in the used key ID area 52 of the volatile storage unit 50.

Therefore, even if, in FIG. 10, the wireless module 24 advances from the second generation to the third generation between the power-off and the restart, the wireless module 24 stores in the use key ID area 52 of the volatile storage unit 50. Since the nth generation key ID 44 (ID=n) is written, the security processing can be performed using the electronic signature data whose expiration date is set to the most future among the plurality of electronic signature data. It is possible to communicate with the roadside communication device 2.
As a result, it is possible to prevent a situation in which the wireless communication with another wireless device cannot be performed due to the expiration date of the electronic signature data.

[Other]
In each of the above-described embodiments, a case where the second updating unit 36 writes the nth generation key ID 44 (ID=n) in the activation key ID area 54 of the non-volatile storage unit 51 in step S5 in FIG. As shown, the information to be written in the activation key ID area 54 as the storage information of the non-volatile storage unit 51 is the key ID 44 other than the next-generation key ID 44 (ID=i+1) and is for the digital signature that can be used in the next generation or later. Any key ID 44 indicating data may be used. For example, a key ID 44 of a generation several generations later than the next-generation key ID 44 (ID=i+1) may be used, or a key ID 44 for which an expiration date is not set or Alternatively, the key ID 44 or the like for which restrictions such as the expiration date have been released for use in an emergency may be used.

The embodiments disclosed this time are to be considered as illustrative in all points and not restrictive.
The scope of the present invention is shown not by the above meaning but by the scope of the claims, and is intended to include the meaning equivalent to the scope of the claims and all modifications within the scope.

1 traffic signal 2 roadside communication device 2a online roadside communication device 2b standalone roadside communication device 3 vehicle-mounted communication device 4 central device 5 vehicle 6 roadside sensor 7 wired communication line 8 router 20 antenna 21 wireless module 22 wired communication unit 23 communication processing device 24 wireless Module 30 Transmitting/receiving unit 31 Processing unit 32 Storage unit 33 Communication control unit 34 Timer 35 First updating unit 36 Second updating unit 37 Restoring unit 40 Key pair table 41 Public key certificate 41a Public key 41b Expiration date information 42 Electronic signature 43 Secret Key 44 key ID
45 expiration date list 50 volatile storage unit 51 non-volatile storage unit 52 used key ID area 53 next generation key ID area 54 activation key ID area J1 to J9 intersections

Claims (6)

A wireless device that acquires time information from another wireless device and performs wireless communication with the other wireless device using a plurality of security processing data corresponding to a plurality of generations,
Volatility for storing, among the plurality of security processing data, first identification information indicating the current generation security processing data used for the wireless communication and second identification information indicating the next generation security processing data. Storage part,
A non-volatile storage unit for storing storage information indicating any of the plurality of security processing data;
When the volatile storage unit is reset, a restoration unit that restores the storage information stored in the nonvolatile storage unit to the volatile storage unit as the new first identification information,
An updating unit that updates the first identification information with the second identification information based on the timing of switching from the current-generation security processing data to the next-generation security processing data, which is specified based on the time information. And
The update unit is
Based on the timing, the second identification information is stored in the non-volatile storage unit, and then the volatile storage unit is reset, so that the restoration unit renews the storage information in the non-volatile storage unit. A first processing unit that restores the volatile storage unit as the first identification information and updates the first identification information with the second identification information;
After the first processing unit updates the first identification information, identification information indicating security processing data other than the next-generation security processing data, which is usable for the next and subsequent generations, is displayed. A second processing unit that stores the storage information in the nonvolatile storage unit.   Security processing data other than the next-generation security processing data that can be used in the next and subsequent generations is security processing data corresponding to the most future generation of the plurality of generations. The wireless device according to claim 1.   The wireless device according to claim 1 or 2, wherein the nonvolatile storage unit stores identification information indicating security processing data corresponding to a future generation among the plurality of generations as initial storage information.   A roadside communication device comprising the wireless device according to any one of claims 1 to 3. A wireless device that acquires time information from another wireless device and wirelessly communicates with the other wireless device using a plurality of security processing data corresponding to a plurality of generations. A volatile storage unit that stores first identification information indicating the current generation security processing data used for the wireless communication and second identification information indicating the next generation security processing data among the data; And a non-volatile storage unit that stores storage information indicating any of the security processing data, and a method for updating the first identification information, the method including:
When the volatile storage unit is reset, a restoring step of restoring the storage information stored in the nonvolatile storage unit to the volatile storage unit as the new first identification information,
The second identification information is stored in the nonvolatile storage unit based on the timing of switching from the current-generation security processing data to the next-generation security processing data, which is specified based on the time information, and thereafter. Resetting the volatile storage unit to restore the storage information of the non-volatile storage unit to the volatile storage unit as the new first identification information in the restoring step, and to restore the first identification information to the first identification information. An updating step of updating with the second identification information,
After the updating step, identification information indicating security processing data other than the next-generation security processing data that is usable in the next and subsequent generations is stored in the nonvolatile storage unit as the storage information. And a storing step of storing the updating method. A wireless device that acquires time information from another wireless device and wirelessly communicates with the other wireless device using a plurality of security processing data corresponding to a plurality of generations. A volatile storage unit that stores first identification information indicating the current generation security processing data used for the wireless communication and second identification information indicating the next generation security processing data among the data; And a non-volatile storage unit that stores stored information indicating any one of the security processing data, and a computer program for causing a computer provided in a wireless device to execute the update processing of the first identification information,
On the computer,
When the volatile storage unit is reset, a restoring step of restoring the storage information stored in the nonvolatile storage unit to the volatile storage unit as the new first identification information,
The second identification information is stored in the nonvolatile storage unit based on the timing of switching from the current-generation security processing data to the next-generation security processing data, which is specified based on the time information, and thereafter. Resetting the volatile storage unit to restore the storage information of the non-volatile storage unit to the volatile storage unit as the new first identification information in the restoring step, and to restore the first identification information to the first identification information. An updating step of updating with the second identification information,
After the updating step, identification information indicating security processing data other than the next-generation security processing data that is usable in the next and subsequent generations is stored in the nonvolatile storage unit as the storage information. A storage step for storing; and a computer program for executing the storage step.

Images