JP6977635B2 - Vehicle key distribution system and general purpose scanning tool - Google Patents

Description

The present invention relates to a scan tool, which is a device used for diagnosing a vehicle.

Electronic control of vehicles (automobiles) has progressed, and ECUs (Electronic Control Units), which are microcomputers used for electronic control, are now installed in vehicles. The number of ECUs mounted on the vehicle is not one, and more than 100 ECUs are mounted on vehicles that require advanced electronic control, such as hybrid vehicles.

The ECU mounted on the vehicle is configured to be accessible from outside the vehicle. In the field related to V2X (Vehicle to Everything), other vehicles and infrastructure equipment (traffic signals, road signs) installed on the road are assumed as devices for accessing the ECU of the vehicle from outside the vehicle. The scan tool is famous as a device for accessing the mounted ECU from outside the vehicle.

The scan tool is an electronic device that communicates with the ECU via a diagnostic port provided in the vehicle and reads vehicle information (for example, a failure code) from the ECU. Some scan tools are dedicated scan tools that are compatible only with vehicles of a specific vehicle manufacturer, but at present, general-purpose scan tools that are compatible with multiple vehicle manufacturers are becoming widespread.

Unauthorized access to the ECU using the diagnostic port provided in the vehicle poses a threat to the ECU (impersonation of another ECU, unauthorized rewriting, etc.), and therefore is described in the invention disclosed in Patent Document 1. As described above, the ECU has an authentication function (access authentication and message authentication) using a vehicle key which is an encryption key.

As described above, various inventions including the above-mentioned Patent Document 1 have been disclosed as a technique for preventing unauthorized access to the ECU, but almost no security measures have been taken for the scan tool for accessing the ECU. is the current situation.

In particular, in the case of a general-purpose scan tool, multiple vehicle keys must be distributed to the general-purpose scan tool, and a scheme that can securely distribute multiple vehicle keys that differ for each vehicle manufacturer to the general-purpose scan tool is required.

Japanese Unexamined Patent Publication No. 2013-98719

Therefore, the present invention provides a system capable of securely distributing a plurality of vehicle keys different for each vehicle manufacturer to a general-purpose scan tool, and a general-purpose scan tool required for this system.

The vehicle key distribution system according to the first invention that solves the above-mentioned problems is a vehicle for accessing a management server that stores a vehicle manufacturer certificate for each of a plurality of vehicle manufacturers and an ECU mounted on the vehicle of the vehicle manufacturer. It is a system equipped with a vehicle manufacturer server that stores the key and a general-purpose scan tool that implements a secure element.
The management server according to the first invention uses the management server certificate stored in the management server, the general-purpose scan tool certificate received from the general-purpose scan tool, and the signature data for the general-purpose scan tool certificate. A means for establishing a secure communication session in which mutual authentication is performed with the general-purpose scan tool and the communication content is encrypted with the session key with the general-purpose scan tool.
The vehicle maker server according to the first invention uses the vehicle maker certificate stored in the general-purpose scan tool, the general-purpose scan tool certificate received from the general-purpose scan tool, and the signature data for the general-purpose scan tool certificate. Then, mutual authentication is provided with the general-purpose scan tool, and a means for establishing the communication session with the general-purpose scan tool is provided.
The secure element according to the first invention stores a private key paired with a public key written in the general-purpose scan tool certificate, and uses this private key to generate signature data for the general-purpose scan tool certificate. It has a function to do.
The general-purpose scan tool according to the first invention uses the signature data for the management server certificate received from the management server, the general-purpose scan tool certificate, and the general-purpose scan tool certificate generated in the secure element. Then, the vehicle maker certificate is obtained from the management server communication means that mutually authenticates with the management server and establishes the communication session with the management server, and the management server that establishes the secure communication session. The means for registering the vehicle maker certificate in the secure element, the vehicle maker certificate read from the secure element, the general-purpose scan tool certificate, and the general-purpose scan tool certificate generated in the secure element. The communication means for the vehicle maker server that mutually authenticates with the vehicle maker server and establishes the secure communication session with the vehicle maker server, and the secure communication session is established. A means for acquiring the vehicle key from the vehicle maker server and registering the vehicle key in the secure element is provided.
According to the vehicle key distribution system according to the first invention, the general-purpose scan tool acquires a plurality of the vehicle maker certificates from the management server, accesses the plurality of the vehicle maker servers, and obtains the plurality of the vehicle keys. By acquiring the key, the vehicle key related to a plurality of vehicle manufacturers can be distributed to the general-purpose scan tool.
Further, in the vehicle key distribution system according to the first invention, in order to enhance security, communication contents are used between the general-purpose scan tool and the management server, and between the general-purpose scan tool and the vehicle maker server by a session key. By establishing the secure communication session that encrypts the communication contents, it is possible to prevent eavesdropping and falsification of the communication contents.
Further, in the vehicle key distribution system according to the first invention, in order to enhance security, the general-purpose scan tool and the management server, and the general-purpose scan tool and the vehicle maker server perform mutual authentication, respectively, to communicate with each other. Is made it possible to confirm whether or not the product is genuine.
Further, in the vehicle key distribution system according to the first invention, in order to enhance security, the signature data for the general-purpose scan tool certificate is generated inside the secure element, so that the signature data for the general-purpose scan tool certificate is generated. It prevents the private key used to generate the data from leaking to the outside.

Further, in the second invention, in the first invention, in the vehicle maker server communication means provided in the general-purpose scan tool, the session key used in the secure communication session is discarded every time the secure communication session is established. As described above, it is characterized in that the secure communication session is established with the vehicle maker server. Since the vehicle key is important data for accessing the ECU mounted on the vehicle, it is preferable not to reuse the session key used in the past.

Further, the third invention is characterized in that, in the first invention or the second invention, the secure element mounted on the general-purpose scan tool is a SIM. By making the secure element detachable from the general-purpose scan tool, the general-purpose scan tool suitable for the diagnosis content of the vehicle can be used according to the diagnosis content of the vehicle.

The fourth invention that solves the above-mentioned problems is a general-purpose scanning tool that implements a secure element.
The secure element according to the fourth invention stores a private key paired with a public key written in a general-purpose scan tool certificate, and uses this private key to generate signature data for the general-purpose scan tool certificate. Equipped with commands.
The general-purpose scan tool according to the fourth invention is generated by a management server certificate received from a management server that stores vehicle maker certificates for each of a plurality of vehicle manufacturers, a general-purpose scan tool certificate, and the secure element. Communication for the management server that establishes a secure communication session that mutually authenticates with the general-purpose scan tool using the signature data for the general-purpose scan tool certificate and encrypts the communication content with the management server using the session key. Means, means for acquiring the vehicle maker certificate from the management server that has established the secure communication session, and registering the vehicle maker certificate in the secure element, and the vehicle maker certificate read from the secure element. The vehicle key for accessing the ECU mounted on the vehicle of the vehicle manufacturer is stored by using the document and the signature data for the general-purpose scan tool certificate and the general-purpose scan tool certificate generated in the secure element. The vehicle maker server communication means that mutually authenticates with the vehicle maker server corresponding to the vehicle maker certificate and establishes the secure communication session with the vehicle maker server, and the vehicle that establishes the secure communication session. A means for acquiring a vehicle key, which is an encryption key for accessing an ECU mounted on a vehicle sold by a vehicle maker corresponding to the vehicle maker server, from the maker server and registering the vehicle key in the secure element is provided.
The fourth invention is an invention relating to a general-purpose scan tool required for the vehicle key distribution system described in the first invention.

Further, in the fifth invention, in the fourth invention, the vehicle maker server communication means included in the general-purpose scan tool is thrown away every time the session key used in the secure communication session is established. As described above, it is characterized in that the secure communication session is established with the vehicle maker server. The fifth invention is an invention relating to a general-purpose scan tool required for the vehicle key distribution system described in the second invention.

Further, the sixth invention is characterized in that, in the fifth or sixth invention, the secure element mounted on the general-purpose scan tool is a SIM. The sixth invention is an invention relating to a general-purpose scan tool required for the vehicle key distribution system described in the third invention.

According to the above-mentioned invention, it is possible to provide a system capable of securely distributing a plurality of vehicle keys different for each vehicle manufacturer to a general-purpose scan tool, and a general-purpose scan tool required for this system.

The figure explaining the structure of the vehicle key distribution system which concerns on this embodiment. The figure explaining the vehicle maker server. The figure explaining the management server. Block diagram of a general-purpose scan tool. The figure explaining the process executed by the vehicle key distribution system. The figure explaining the procedure of TLS (Transport Layer Security). The figure explaining the operation of the self-diagnosis means provided in the general-purpose scan tool.

From here, suitable embodiments of the present invention will be described. It should be noted that the following description does not constrain the technical scope of the present invention, but is described to assist the understanding of the present invention.

FIG. 1 is a diagram illustrating a configuration of a vehicle key distribution system 1 according to the present embodiment. The vehicle key distribution system 1 illustrated in FIG. 1 is a device used for diagnosing a vehicle 6 and has a SIM 3 (Subscriber Identity Module) mounted as a secure element on a general-purpose scan tool 2 compatible with a plurality of vehicle manufacturers. This system was devised so that the vehicle key 61, which is an encryption key required for diagnosis, can be distributed to the general-purpose scan tool 2 and securely registered in the SIM 3 of the general-purpose scan tool 2.

In the present embodiment, the secure element mounted on the general-purpose scan tool 2 is SIM3, but the form of the secure element mounted on the general-purpose scan tool 2 is not limited to SIM3. In addition to SIM3, the secure element includes eSIM (Embedded SIM), which is a built-in SIM3, TPM (Trusted Platform Module), which is a microchip designed to provide security-related cryptographic calculation functions, and There are also HSM (Hardware Security Module), which is a device designed to provide cryptographic calculation functions related to security, and SHE (Secure Hardware Extension), which has a simpler configuration than HSM, but it is implemented in general-purpose scan tool 2. As the form of the secure element, SIM 3 which can be easily removed from the general-purpose scan tool 2 is suitable.

As illustrated in FIG. 1, the vehicle key distribution system 1 according to the embodiment is a general-purpose scan tool 2 having SIM3 mounted as a secure element, and a vehicle 6 sold by the company as a server connected to the network 7. The vehicle maker server 5 that stores the vehicle key 61 that is the encryption key required to access the ECU 60 mounted on the vehicle, and the vehicle maker certificate that is the public key certificate that describes the server public key of the vehicle maker server 5. A management server 4 that stores 55 for each vehicle manufacturer is provided.

The vehicle 6 illustrated in FIG. 1 has a diagnostic port 62 (OBD port (On-Board Diagnostics)) to which the general-purpose scan tool 2 is connected. When diagnosing the vehicle 6, the general-purpose scan tool 2 accesses the ECU 60 mounted on the vehicle 6 as a connection with the diagnostic port 62 of the vehicle 6 and reads the failure code stored in the ECU 60. In FIG. 1, the number of ECUs 60 mounted on the vehicle 6 is one, but in reality, a plurality of ECUs 60 are mounted on one vehicle 6.

Although not shown in FIG. 1, the ECU 60 mounted on the vehicle 6 has an SHE as a secure element, and access to the ECU 60 mounted on the vehicle 6 is secured by a vehicle key 61 stored in the SHE of the ECU 60. Is protected.

FIG. 2 is a diagram illustrating a vehicle maker server 5. The vehicle maker server 5 is a device realized by using a general-purpose server, and the hardware included in the vehicle maker server 5 is the same as that of the general-purpose server. Not explained here.

The vehicle key 61 required for accessing the ECU 60 mounted on the vehicle 6 is stored in the vehicle maker server 5 corresponding to the vehicle maker selling the vehicle 6 on which the ECU 60 is mounted. The vehicle maker server 5 has an HSM 53 as a secure element, and the HSM 53 possessed by the vehicle maker server 5 is a server secret of the vehicle maker server 5 that is paired with the server public key of the vehicle maker server 5 written in the vehicle maker certificate 55. The key 54 and the vehicle key 61 for accessing the ECU 60 mounted on the vehicle 6 sold by the vehicle manufacturer are stored.

There are two types of encryption methods, a common key encryption method and a public key encryption method, and the vehicle key 61 may be any method of encryption key. When the vehicle key 61 is an encryption key of a common key encryption method, the vehicle key 61 stored in the SHE of the ECU 60 and the vehicle key 61 stored in the vehicle maker server 5 are the same. When the vehicle key 61 is an encryption key of a public key cryptosystem, the secret key of the vehicle key 61 is stored in the SHE of the ECU 60, and the public key of the vehicle key 61 is stored in the vehicle maker server 5.

The vehicle maker server 5 includes a network interface 50 as a communication interface for network communication. Further, as a function realized by the computer program, the vehicle maker server 5 establishes a secure communication session between the general-purpose scan tool 2 and the general-purpose scan tool 2 in which the communication content is encrypted by the session key. The secure communication means 51 is provided. Further, the vehicle maker server 5 has a vehicle key 61 stored in the vehicle maker server 5 for the general-purpose scan tool 2 that has established a secure communication session with the vehicle maker server 5 as a function realized by a computer program. A vehicle key distribution means 52 that executes a distribution process is provided.

FIG. 3 is a diagram illustrating the management server 4. The management server 4 is a device realized by using a general-purpose server, and the hardware included in the management server 4 is the same as that of the general-purpose server. Therefore, the details of the hardware included in the management server 4 will be described here. do not do.

The management server 4 has an HSM 43 as a secure element, and the HSM 43 possessed by the management server 4 stores the vehicle manufacturer certificate 55 described above for each vehicle manufacturer. Further, the management server 4 has a management server certificate 45, which is a public key certificate in which the server public key of the management server 4 is written, as an encryption key used for establishing a secure communication session with the management server 4, and a management server. Stores the server private key 44 of 4.

Further, the management server 4 includes a network interface 40 as a communication interface for network communication. Further, the management server 4 is provided with a secure communication means 41 that performs a process of mutually authenticating with the general-purpose scan tool 2 and establishing a secure communication session with the general-purpose scan tool 2 as a function realized by a computer program. Further, the management server 4 distributes the vehicle manufacturer certificate 55 stored in the management server 4 to the general-purpose scan tool 2 that has established a secure communication session with the management server 4 as a function realized by the computer program. The vehicle maker certificate distribution means 42 for performing the processing is provided.

FIG. 4 is a block diagram of the general-purpose scan tool 2. The general-purpose scan tool 2 is a computer device provided with a display and an operating device. The general-purpose scan tool 2 has a network interface 20 which is an interface for network communication, a secure element interface 21 which is an interface for communicating with a secure element, and a diagnostic interface which is a communication interface for connecting to a diagnostic port 62. A port interface 22 is provided.

The network interface 20 included in the general-purpose scan tool 2 may be either a wireless system or a wired system. The secure element interface 21 included in the general-purpose scan tool 2 corresponds to the secure element mounted on the general-purpose scan tool 2. In this embodiment, since SIM3 is mounted on the general-purpose scan tool 2 as a secure element, the secure element interface 21 corresponds to ISO7816. The diagnostic port interface 22 included in the general-purpose scan tool 2 corresponds to the diagnostic port 62.

As a function realized by the computer program, the general-purpose scan tool 2 establishes a secure communication session with the management server communication means 23 that mutually authenticates with the management server 4 and establishes a secure communication session with the management server 4. A secure communication session is established between the vehicle maker certificate registration means 25, which acquires the vehicle maker certificate 55 from the established management server 4 and registers it in the SIM 3, and the vehicle maker server 5 by mutual authentication. It includes a communication means 24 for a vehicle maker server to be established, and a vehicle key registration means 26 for acquiring a vehicle key 61 from a management server 4 for establishing a secure communication session and registering the vehicle key 61 in the SIM 3. The management server communication means 23 and the vehicle manufacturer certificate registration means 25 are the same in that they establish a secure communication session, but the contents of the process for establishing a secure communication session are different.

Further, as a function realized by a computer program, the general-purpose scan tool 2 provides a vehicle body diagnostic means 27 that communicates with the ECU 60 mounted on the vehicle 6 and reads the failure code stored in the ECU 60 as a connection with the diagnostic port 62. Be prepared. Further, the general-purpose scan tool 2 includes a self-diagnosis means 28 for performing a self-diagnosis of the general-purpose scan tool 2 as a function realized by a computer program.

The SIM 3 mounted on the general-purpose scan tool 2 will be described. In FIG. 4, as the hardware of the SIM 3 mounted on the general-purpose scan tool 2, the I / O port 30 as an interface for connecting to the device on which the SIM 3 is mounted and the NVM 31 which is an electrically rewritable non-volatile memory. (Non-volatile Memory) is illustrated. As a matter of course, the SIM 3 includes a CPU (Central Processing Unit), a RAM (Random Access Memory) that is the main memory, and a ROM (Read Only Memory) that is an electrically non-rewritable non-volatile memory. Equipped with hardware not shown.

In the NVM 31 possessed by SIM3, a directory 35 corresponding to the vehicle manufacturer (hereinafter referred to as "manufacturer directory") is generated for each vehicle manufacturer, and an encryption key related to the vehicle manufacturer (here, here) is directly under the manufacturer directory 35. , The vehicle manufacturer certificate 55 and the vehicle key 61) are stored.

Further, the NVM 31 possessed by the SIM 3 is a general-purpose key certificate in which the public key of the general-purpose scan tool 2 is written as an encryption key used when establishing a secure communication session with the server connected to the network 7. The scan tool certificate 32 and the private key 33 of the general-purpose scan tool 2 are stored.

Further, the NVM 31 possessed by the SIM 3 stores a hash value 34 for self-diagnosis as data referred to by the self-diagnosis means 28 of the general-purpose scan tool 2. The hash value 34 for self-diagnosis is a hash value calculated from the program code of the computer program implemented in the general-purpose scan tool 2. The hash value 34 for self-diagnosis includes a hash value calculated from the program code related to the boot process, a hash value calculated from the program code related to the operating system, and a program code related to the application program (for example, the communication means 23 for the management server). It is possible to include the calculated hash value and the like.

The SIM 3 has a plurality of commands 36 used by the general-purpose scan tool 2 to establish a secure communication session as commands realized by software. This command includes a command to generate signature data for the general-purpose scan tool certificate 32 by using the private key 33 of the general-purpose scan tool 2.

From here, the processing executed by the vehicle key distribution system 1 according to the present embodiment will be described. FIG. 5 is a diagram illustrating a process executed by the vehicle key distribution system 1, and FIG. 6 is a diagram illustrating a procedure of TLS (Transport Layer Security).

In the vehicle key distribution system 1 according to the present embodiment, a secure communication session is established between the management server 4 and the general-purpose scan tool 2, and a secure communication session is further established between the vehicle maker server 5 and the general-purpose scan tool 2. Established. There are various secure protocols for establishing a secure communication session, but in this embodiment, TLS is used for establishing a secure communication session. Therefore, before explaining the procedure of FIG. 5, the TLS procedure will be described with reference to FIG. In the present embodiment, the client 8a in the description of FIG. 6 corresponds to the general-purpose scan tool 2, and the server 8b in the description of FIG. 6 corresponds to the management server 4 and the vehicle maker server 5.

In the procedure illustrated in FIG. 6, first, Client Hello, which is a message for transmitting a random number used for calculating the session key, a cryptographic operation method, and the like, is transmitted from the client 8a to the server 8b (S20).

When ClientHello is sent from client 8a, ServerHello (S21) is a message that sends random numbers and cryptographic calculation methods used to calculate the session key, ServerCertificate (S22) is a message that sends a server certificate, and client certificate. CertificateRequest (S23), which is a message requesting transmission, and ServerHelloDone (S24), which is a message indicating the end of a series of transmissions from the server 8b, are transmitted from the server 8b to the client 8a.

When ServerHelloDone is transmitted from the server 8b, the client 8a authenticates the client 8a as a communication partner by verifying the server certificate transmitted from the server 8b by the Server Certificate. When verifying the server certificate, client 8a verifies the signature data attached to the server certificate by using the certificate authority corresponding to the server certificate.

When the verification of the server certificate is successful, the client 8a is a message to send the client certificate, ClientCertificate (S25), which is the seed information of the session key, and is a message to send the random number information encrypted with the server public key. ClientKeyExchange (S26), CertificateVerify (S27), which is a message to send signature data for a client certificate, ChangeCipherSpec (S28), which is a message to indicate the end of transmission in plain text, and a message to indicate the end of a series of transmissions from client 8a. A certain Finished (S29) is transmitted to the server 8b.

When these messages are transmitted, the server 8b authenticates the client 8a to be the communication partner by verifying the client certificate transmitted by the Client Certificate. When verifying the client certificate, the server 8b verifies the signature data contained in the client certificate by using the certificate authority corresponding to the client certificate, and further uses the public key written in the client certificate. Then, the signature data sent by Certificate Verify is verified. If the verification of the client certificate is successful, the server 8b sends ChangeCipherSpec (S30), which is a message indicating the end of the transmission in plain text, and Finished (S31), which is a message indicating the end of the series of transmissions from the server 8b, to the client 8a. Send.

After the server 8b sends Finished (S31), which is a message indicating the end of a series of transmissions from the server 8b, to the client 8a, the communication content exchanged between the client 8a and the server 8b is encrypted by the session key. Will be done.

In the TLS specifications, some of the messages shown in the procedure of FIG. 6 such as ServerCertificate (S22), which is a message for sending a server certificate, and CertificateRequest (S23), which is a message requesting the transmission of a client certificate, are It can be omitted.

The procedure illustrated in FIG. 5 will be described. In the procedure shown in FIG. 5, a secure communication session is established between the management server 4 and the general-purpose scan tool 2, and the general-purpose scan tool 2 obtains the vehicle manufacturer certificate 55 from the management server P1 and the vehicle manufacturer. A secure communication session is established between the server 5 and the general-purpose scan tool 2, and the general-purpose scan tool 2 includes a step P2 of acquiring the vehicle key 61 from the vehicle manufacturer server 5.

First, the process P1 in which the general-purpose scan tool 2 acquires the vehicle manufacturer certificate 55 from the management server 4 will be described. At the beginning of step P1, the communication means 23 for the management server of the general-purpose scan tool 2 and the secure communication means 41 of the management server 4 are activated, and secure communication is performed between the general-purpose scan tool 2 and the management server 4 using TLS. The process of establishing a session is executed (S1).

In the process (S1) of establishing a secure communication session between the general-purpose scan tool 2 and the management server 4, mutual authentication is executed between the general-purpose scan tool 2 and the management server 4. The general-purpose scan tool 2 authenticates the management server 4 as a communication partner by using the management server certificate 45 transmitted by the management server 4. Since the general-purpose scan tool 2 does not store the management server certificate 45, the secure communication means 41 of the management server 4 sends the management server certificate 45 to the general-purpose scan tool 2 by the Server Certificate of TLS, and the general-purpose scan tool 2 The management server communication means 23 of the above verifies the management server certificate 45 by using a certificate authority. Further, since it is dangerous to send the vehicle manufacturer certificate 55 to the general-purpose scan tool 2 whose identity is unknown, the secure communication means 41 of the management server 4 has the general-purpose scan tool certificate 32 and the general-purpose scan tool certificate 32. The signature data is used to authenticate the general-purpose scan tool 2 that is the communication partner. The management server communication means 23 of the general-purpose scan tool 2 transmits the general-purpose scan tool certificate 32 to the management server 4 by ClientCertificate, and transmits the signature data for the general-purpose scan tool certificate 32 to the management server 4 by CertificateVerify. The command 36 implemented in SIM 3 is used to generate the signature data for the general-purpose scan tool certificate 32, and the private key of the general-purpose scan tool 2 is not leaked to the outside of SIM 3. The secure communication means 41 of the management server 4 verifies the general-purpose scan tool certificate 32 using a certificate authority, and the communication partner to whom the general-purpose scan tool certificate 32 is sent is a secret corresponding to the general-purpose scan tool certificate 32. In order to confirm that the key is possessed, the signature data is verified using the public key written in the general-purpose scan tool certificate 32.

The session key used in the secure communication session is generated based on the random number information transmitted from the general-purpose scan tool 2 to the management server 4 by ClientKeyExchange. When the random number information encrypted with the server public key by ClientKeyExchange is transmitted from the general-purpose scan tool 2, the secure communication means 41 of the management server 4 uses the server private key 44 of the management server 4 to encrypt the random number information. Decrypt and generate a session key from the decoded random number information. The management server communication means 23 of the general-purpose scan tool 2 generates a session key from the random number information transmitted to the management server 4.

In the TLS procedure, the session key is basically a disposable key, but in the TLS specifications, by including the SessionID in ClientHello (S20) and ServerHello (S22), the secure key generated so far can be reused. ， You can proceed to the Client Certificate. When the general-purpose scan tool 2 acquires a plurality of vehicle manufacturer certificates 55 each time, if a secure communication session is established, the processing time becomes long. Therefore, the Session ID is included in ClientHello and ServerHello, and the session key is generated. It is advisable to proceed to ChangeCipherSpec (S28) without doing so.

When a secure communication session is established between the general-purpose scan tool 2 and the management server 4, the vehicle maker certificate registration means 25 of the general-purpose scan tool 2 becomes the vehicle maker certificate 55 stored in the SIM 3 of the general-purpose scan tool 2. A delivery request for the vehicle manufacturer certificate 55, which is a message including the identifier of the corresponding vehicle manufacturer, is transmitted to the management server 4 (S2). When the management server 4 receives the distribution request of the vehicle maker certificate 55 from the general-purpose scan tool 2, the vehicle maker certificate distribution means 42 of the management server 4 receives the vehicle maker certificate indicated by the distribution request of the vehicle maker certificate 55. 55 is delivered to the general-purpose scan tool 2 (S3).

When the vehicle maker certificate 55 is distributed from the management server 4, the vehicle maker certificate registration means 25 of the general-purpose scan tool 2 uses the command implemented in the SIM 3 and the vehicle maker certificate distributed from the management server 4. 55 is stored in SIM3 (S4), and step P1 is completed. The maker directory 35 for storing the vehicle maker certificate 55 is directly under the maker directory 35 corresponding to the vehicle maker of the vehicle maker certificate 55.

After the vehicle maker certificate 55 distributed from the management server 4 is stored in the SIM 3 of the general-purpose scan tool 2, the step P2 in which the general-purpose scan tool 2 acquires the vehicle key 61 from the vehicle maker server 5 is executed.

In the process P2 in which the general-purpose scan tool 2 acquires the vehicle key 61 from the vehicle maker server 5, first, the vehicle maker server communication means 24 of the general-purpose scan tool 2 and the secure communication means 51 of the vehicle maker server 5 are activated to operate the TLS. Using this, the process (S10) of establishing a secure communication session between the general-purpose scan tool 2 and the vehicle maker server 5 is executed.

In the process of establishing a secure communication session between the general-purpose scan tool 2 and the vehicle maker server 5 (S10), mutual authentication is executed between the general-purpose scan tool 2 and the vehicle maker server 5. The procedure for mutual authentication between the vehicle maker server 5 is different from the procedure for mutual authentication between the general-purpose scan tool 2 and the management server 4. The general-purpose scan tool 2 authenticates the vehicle maker server 5 as a communication partner by using the vehicle maker certificate 55. At this point, the general-purpose scan tool 2 acquires the vehicle maker certificate 55 from the management server 4. Therefore, the secure communication means 51 of the vehicle maker server 5 does not transmit the vehicle maker certificate 55 to the general-purpose scan tool 2 in the processing related to TLS, and the communication means 24 for the vehicle maker server of the general-purpose scan tool 2 does not transmit. , The vehicle maker certificate 55 corresponding to the vehicle maker server 5 as the communication partner is read from the SIM 3, and the vehicle maker certificate 55 read from the SIM 3 is authenticated by using the certificate authority. Since it is dangerous to send the vehicle key 61 to the general-purpose scan tool 2 whose identity is unknown, the secure communication means 51 of the vehicle maker server 5 inputs the signature data for the general-purpose scan tool certificate 32 and the general-purpose scan tool certificate 32. Use it to authenticate the general-purpose scan tool 2 that is the communication partner. The vehicle maker server communication means 24 of the general-purpose scan tool 2 transmits the general-purpose scan tool certificate 32 to the vehicle maker server 5 by ClientCertificate (S25), and the signature data for the general-purpose scan tool certificate 32 is transmitted to the vehicle by CertificateVerify (S27). Send to the maker server 5. The command 36 implemented in SIM 3 is used to generate the signature data for the general-purpose scan tool certificate 32, and the private key of the general-purpose scan tool 2 is not leaked to the outside of SIM 3. The secure communication means 51 of the vehicle maker server 5 verifies the general-purpose scan tool certificate 32 using a certificate authority, and the communication partner to which the general-purpose scan tool certificate 32 is sent corresponds to the general-purpose scan tool certificate 32. In order to confirm whether or not the private key is possessed, the signature data is verified using the public key written in the general-purpose scan tool certificate 32.

The session key used in the secure communication session is generated based on the random number information transmitted from the general-purpose scan tool 2 to the vehicle manufacturer server 5 by ClientKeyExchange. The secure communication means 51 of the vehicle maker server 5 uses the server secret key 54 of the vehicle maker server 5 to encrypt the random number information encrypted by the server public key by ClientKeyExchange when the general-purpose scan tool 2 sends the random number information. The information is decrypted and the session key is generated from the decoded random number information. The vehicle maker server communication means 24 of the general-purpose scan tool 2 generates a session key from the random number information transmitted to the vehicle maker server 5.

Since the vehicle key 61 is an encryption key that can access the ECU 60 of the vehicle, it is desirable that the session key used in the secure communication session between the general-purpose scan tool 2 and the vehicle maker server 5 is disposable. Therefore, when establishing a secure communication session between the general-purpose scan tool 2 and the vehicle manufacturer server 5, it is important that the Session ID is not included in the ClientHello (S20) and the ServerHello (S21).

When a secure communication session is established between the general-purpose scan tool 2 and the vehicle maker server 5, the vehicle key registration means 26 of the general-purpose scan tool 2 requests a vehicle key 61 to be stored in the SIM 3 of the general-purpose scan tool 2. The distribution request of the vehicle key 61 is transmitted to the vehicle maker server 5 (S11). When the vehicle key distribution means 52 of the vehicle maker server 5 receives the distribution request of the vehicle key 61 from the general-purpose scan tool 2, the vehicle key 61 stored in the vehicle maker server 5 is distributed to the general-purpose scan tool 2 (S12). ..

When the vehicle key 61 is distributed from the vehicle maker server 5, the vehicle key registration means 26 of the general-purpose scan tool 2 stores the vehicle key 61 distributed from the vehicle maker server 5 in the SIM 3 (S23), and the process P2 is performed. finish. The maker directory 35 for storing the vehicle key 61 is directly under the maker directory 35 corresponding to the maker of the vehicle maker server 5.

Finally, the self-diagnosis means 28 included in the general-purpose scan tool 2 will be described. FIG. 7 is a diagram illustrating the operation of the self-diagnosis means 28 included in the general-purpose scan tool 2.

The self-diagnosis means 28 included in the general-purpose scan tool 2 is a computer program that is started when the general-purpose scan tool 2 is started. First, the self-diagnosis means 28 has a hash value from the program code of the computer program implemented in the general-purpose scan tool 2. Is calculated (S40) and collated with the self-diagnosis hash value stored in SIM3 (S41). The self-diagnosis means 28 branches the process according to the hash value collation result (S42). If the hash value matching is successful, the process of booting the operating system of the general-purpose scan tool 2 is executed (S420), and the procedure of FIG. 7 ends. If the hash value collation fails, the process of booting the operating system of the general-purpose scan tool 2 is stopped (S421), and the procedure of FIG. 7 ends.

1 Vehicle key distribution system 2 General-purpose scan tool 23 Communication means for management server 24 Communication means for vehicle maker server 25 Vehicle maker certificate registration means 26 Vehicle key registration means 28 Self-diagnosis means 3 SIM
32 General-purpose scan tool certificate 34 Self-diagnosis hash value 35 Maker directory 4 Management server 41 Secure communication means 42 Vehicle maker certificate distribution means 45 Management server certificate 5 Vehicle maker server 51 Secure communication means 52 Vehicle key distribution means 55 Vehicle maker Certificate 6 Vehicle 60 ECU
61 Vehicle key

Claims (6)

A management server that stores the vehicle manufacturer certificate for each of multiple vehicle manufacturers, a vehicle manufacturer server that stores the vehicle key for accessing the ECU mounted on the vehicle manufacturer's vehicle, and a secure element are implemented. It is a system equipped with a general-purpose scanning tool that is available.
The management server uses the management server certificate stored in the management server, the general-purpose scan tool certificate received from the general-purpose scan tool, and the signature data for the general-purpose scan tool certificate, and the general-purpose scan tool. A means for establishing a secure communication session in which communication contents are encrypted by a session key with the general-purpose scan tool by mutual authentication with the above-mentioned general-purpose scan tool is provided.
The vehicle maker server uses the vehicle maker certificate stored in the general-purpose scan tool, the general-purpose scan tool certificate received from the general-purpose scan tool, and the signature data for the general-purpose scan tool certificate. A means for mutual authentication with the scan tool and establishment of the communication session with the general-purpose scan tool is provided.
The secure element has a function of storing a private key paired with the public key written in the general-purpose scan tool certificate and using this private key to generate signature data for the general-purpose scan tool certificate.
The general-purpose scan tool uses the management server certificate received from the management server, the general-purpose scan tool certificate, and the signature data for the general-purpose scan tool certificate generated in the secure element, and the management server. The vehicle maker certificate is obtained from the management server communication means that establishes the communication session with the management server and the management server that establishes the secure communication session, and the vehicle maker. The means for registering the certificate in the secure element, the vehicle manufacturer certificate read from the secure element, the general-purpose scan tool certificate, and the signature data for the general-purpose scan tool certificate generated in the secure element are used. Then, from the vehicle maker server communication means that mutually authenticates with the vehicle maker server and establishes the secure communication session with the vehicle maker server, and from the vehicle maker server that establishes the secure communication session. It is equipped with a means to acquire a vehicle key and register it in the secure element.
A vehicle key distribution system characterized by being The vehicle maker server communication means provided in the general-purpose scan tool communicates securely with the vehicle maker server so that the session key used in the secure communication session is discarded every time a secure communication session is established. The vehicle key distribution system according to claim 1, wherein a session is established. The vehicle key distribution system according to claim 1 or 2, wherein the secure element to be mounted on the general-purpose scan tool is a SIM. A general-purpose scan tool that implements secure elements.
The secure element stores a private key paired with the public key written in the general-purpose scan tool certificate, and includes a command to generate signature data for the general-purpose scan tool certificate using this private key.
The general-purpose scan tool includes a management server certificate received from a management server that stores a vehicle manufacturer certificate for each of a plurality of vehicle manufacturers, a general-purpose scan tool certificate, and the general-purpose scan tool certificate generated in the secure element. The management server communication means that establishes a secure communication session that mutually authenticates with the general-purpose scan tool using the signature data for the document and encrypts the communication content with the management server using the session key, and the secure. A means for acquiring the vehicle maker certificate from the management server that has established a communication session and registering the vehicle maker certificate in the secure element, the vehicle maker certificate read from the secure element, and the general purpose. Using the scan tool certificate and the signature data for the general-purpose scan tool certificate generated in the secure element, the vehicle key for accessing the ECU mounted on the vehicle of the vehicle manufacturer is stored, and the vehicle manufacturer certificate is stored. From the vehicle maker server communication means that mutually authenticates with the vehicle maker server corresponding to the above and establishes the secure communication session with the vehicle maker server, and from the vehicle maker server that establishes the secure communication session. It is equipped with a means for acquiring a vehicle key, which is an encryption key for accessing an ECU mounted on a vehicle sold by a vehicle manufacturer corresponding to a vehicle manufacturer server, and registering it in the secure element.
A general-purpose scanning tool that features The vehicle maker server communication means provided in the general-purpose scan tool communicates securely with the vehicle maker server so that the session key used in the secure communication session is thrown away every time a secure communication session is established. The general-purpose scanning tool according to claim 4, wherein a session is established. The general-purpose scan tool according to claim 4 or 5, wherein the secure element to be mounted on the general-purpose scan tool is a SIM.

Images