JP7729122B2 - Electronic device, software update method, and program - Google Patents

Description

The present invention relates to technical fields such as methods for providing various services, such as payment, to vehicle users via short-range wireless communication.

Conventionally, various services such as payment can be provided to vehicle users via short-range wireless communication between an ECU (Electronic Control Unit) or SE (Secure Element) installed in a vehicle and a server installed outside the vehicle. For example, Patent Document 1 discloses a system in which, when a VID (Vehicle Interface Device) installed in a vehicle receives a request for payment account information from a dealer access device, it determines whether the user's mobile communications device is inside the vehicle, and if it determines that the mobile communications device is inside the vehicle, it transmits payment account information read from a payment card inserted into the VID to the dealer access device.

Japanese Patent Application Laid-Open No. 2020-53066

The various services mentioned above are realized by software such as applications installed in an ECU (Electronic Control Unit) or SE, but when such software needs to be updated, it is necessary to update the software installed in the ECU or SE by sending a patch (patch data) from a server to the ECU or SE, for example, using a mobile communications network. However, if a mobile communications network is not available, it is not possible to update the software efficiently.

The present invention was made in consideration of the above points and aims to provide an electronic device, software update method, and program that can more efficiently update software installed in an electronic device in a vehicle.

In order to solve the above problem, the invention described in claim 1 is an electronic device capable of communicating with an external device installed outside a mobile body via a relay device mounted on the mobile body, comprising: a storage means for storing a unique identification number of the electronic device and a version number of software installed on the electronic device; an authentication means for performing an authentication process with the external device via the relay device; an acquisition means for acquiring patch data identified by the unique identification number and version number stored in the storage means from the external device via the relay device after the authentication process is completed; and an update means for updating the software based on the patch data acquired by the acquisition means, wherein the acquisition means acquires a list registering combinations of specific unique identification numbers and specific version numbers from the external device via the relay device, and acquires the patch data from the external device via the relay device if the combination of the unique identification number and the version number stored in the storage means is registered in the list . The invention described in claim 2 is an electronic device capable of communicating with an external device installed outside a mobile body via a relay device mounted on the mobile body, the electronic device comprising: a storage means for storing a unique identification number of the electronic device and a version number of software installed in the electronic device; an authentication means for performing an authentication process with the external device via the relay device; an acquisition means for acquiring patch data identified by the unique identification number and version number stored in the storage means from the external device via the relay device after the authentication process is completed; and an update means for updating the software based on the patch data acquired by the acquisition means, wherein the electronic device is composed of a secure element and an ECU (Electronic Control Unit) mounted on the mobile body, the secure element including the authentication means and the acquisition means, the acquisition means acquiring the patch data encrypted using a session key generated in the authentication process and common to the external device, and decrypting the patch data using the session key, the ECU including the storage means and the update means, and the update means updating the software based on the decrypted patch data.

The invention described in claim 3 is characterized in that, in the electronic device described in claim 1 or 2 , the acquisition means acquires the patch data from the external device via the relay device by transmitting the unique identification number and the version number stored in the memory means to the external device via the relay device.

The invention described in claim 4 is a terminal device capable of communicating with an electronic device installed in a mobile body or an electronic device carried by a passenger of the mobile body via a relay device mounted on the mobile body, wherein the electronic device stores a unique identification number of the electronic device and a version number of software installed on the electronic device, and the terminal device is characterized in that it comprises: an authentication means for performing an authentication process with the electronic device via the relay device; an acquisition means for acquiring the unique identification number and the version number from the electronic device via the relay device after the authentication process is completed; and a transmission means for transmitting patch data for updating the software installed on the electronic device, the patch data corresponding to the unique identification number and the version number acquired by the acquisition means via the relay device.

The invention described in claim 5 is a software update method executed by an electronic device capable of communicating with an external device installed outside a mobile body via a relay device mounted on the mobile body, comprising the steps of: storing a unique identification number of the electronic device and a version number of software installed in the electronic device in a storage means; performing an authentication process with the external device via the relay device; after the authentication process is completed, acquiring patch data identified by the unique identification number and version number stored in the storage means from the external device via the relay device; and updating the software based on the acquired patch data, wherein the acquiring step acquires a list registering combinations of specific unique identification numbers and specific version numbers from the external device via the relay device, and if the combination of the unique identification number and the version number stored in the storage means is registered in the list, the patch data is acquired from the external device via the relay device . The invention described in claim 6 is a software update method executed by an electronic device capable of communicating with an external device installed outside a mobile body via a relay device mounted on the mobile body, the electronic device being composed of a secure element and an ECU (Electronic Control Unit), the method including: a step by the ECU storing a unique identification number of the electronic device and a version number of software installed in the electronic device in a storage means; a step by the secure element performing an authentication process with the external device via the relay device; an acquisition step by the secure element acquiring patch data identified by the unique identification number and the version number stored in the storage means from the external device via the relay device after the authentication process is completed; and an update step by the ECU updating the software based on the acquired patch data, wherein in the acquisition step, the patch data encrypted with a session key generated in the authentication process and common to the external device is acquired, and the patch data is decrypted using the session key; and in the update step, the software is updated based on the decrypted patch data.

The invention described in claim 7 is a program that causes a computer included in an electronic device capable of communicating with an external device installed outside a mobile body via a relay device mounted on the mobile body to function as: a storage means for storing a unique identification number of the electronic device and a version number of software installed on the electronic device; an authentication means for performing an authentication process with the external device via the relay device; an acquisition means for acquiring patch data identified by the unique identification number and version number stored in the storage means from the external device via the relay device after the authentication process is completed; and an update means for updating the software based on the patch data acquired by the acquisition means , wherein the acquisition means acquires a list registering combinations of specific unique identification numbers and specific version numbers from the external device via the relay device, and acquires the patch data from the external device via the relay device if the combination of the unique identification number and the version number stored in the storage means is registered in the list . The invention described in claim 8 is a program that causes a computer included in an electronic device capable of communicating with an external device installed outside a mobile body via a relay device mounted on the mobile body, the electronic device being composed of a secure element and an ECU (Electronic Control Unit) mounted on the mobile body, to function as: a storage means that stores a unique identification number of the electronic device and a version number of software installed on the electronic device; an authentication means that performs an authentication process with the external device via the relay device; an acquisition means that, after the authentication process is completed, acquires patch data identified by the unique identification number and version number stored in the storage means from the external device via the relay device; and an update means that updates the software based on the patch data acquired by the acquisition means, wherein the acquisition means acquires the patch data encrypted using a session key generated in the authentication process and common to the external device, and decrypts the patch data using the session key; and the update means updates the software based on the decrypted patch data.

The present invention enables more efficient updates of software installed on electronic devices in vehicles.

1 is a diagram illustrating an example of a schematic configuration of a payment processing system S according to an embodiment of the present invention. FIG. 2 is a diagram illustrating an example of a schematic configuration of a payment terminal 2. FIG. 2 is a diagram illustrating an example of a schematic configuration of an ECU 4. FIG. 2 is a diagram illustrating an example of a schematic configuration of an eSE 5. 1 is a conceptual diagram showing the positional relationship between a reader/writer 22 embedded in the ground of a pay-by-the-hour parking lot and a vehicle C. FIG. FIG. 10 is a sequence diagram showing an example of a transaction carried out before a secure session is started in the payment processing system S. FIG. 10 is a sequence diagram showing an example of a transaction carried out after a secure session is started in the payment processing system S. FIG. 10 is a sequence diagram showing an example of a transaction carried out after a secure session is started in the payment processing system S.

Embodiments of the present invention will be described in detail below with reference to the drawings. The embodiments described below are embodiments in which the present invention is applied to a payment processing system in which payment processing is carried out between a payment terminal installed outside a vehicle and an ECU (Electronic Control Unit) installed in the vehicle. The payment terminal is an example of an external device, and the ECU is an example of an electronic device. The vehicle is an example of a mobile object, such as a two-wheeled vehicle, a four-wheeled vehicle, or a bicycle.

[1. General configuration of payment processing system S]
First, the schematic configuration of a payment processing system S according to this embodiment will be described with reference to Fig. 1 and other figures. Fig. 1 is a diagram showing an example of the schematic configuration of the payment processing system S according to this embodiment. As shown in Fig. 1, the payment processing system S includes a management server 1, a payment terminal 2, a repeater 3 (an example of a repeater device), an ECU (Electronic Control Unit) 4, and an eSE (Embedded Secure Element) 5. The management server 1 and the payment terminal 2 (an example of a terminal device) are each connected to a network NW formed, for example, by the Internet, and the management server 1 and the payment terminal 2 are capable of communicating via the network NW.

The management server 1 is a server for managing software that can be provided to specific devices (e.g., specific ECUs or eSEs). Examples of software include operating systems, firmware, and applications required for using various services such as payment services. Each piece of software is assigned a unique identifier and a version number that indicates the version of that software. Here, the version number is updated whenever the software is updated, for example, to fix software defects or change functionality. To update software installed in the ECU 4 or eSE 5, a patch (patch data) generated by the management server 1 is applied.

A patch is generated for each software identifier and version number. For example, one patch "001" (identifier) is generated for software "Sxxx" (identifier) with "Ver1" (version number). The patch may be a program or configuration data. Each patch is assigned an identifier and associated with a list of devices to which the patch is applied. The list of devices to which the patch is applied registers the unique identification number of the specific device to which the patch is applied (e.g., a specific ECU or eSE) and the identifier and version number of the specific software to which the patch is applied, in association with each other. The patch and the list of devices to which the patch is applied are provided to the payment terminal 2 via the network NW. The unique identification number of the specific device may also be a number identifying the model of vehicle C.

Payment terminal 2 is installed in locations such as stores with drive-through facilities, parking lots, and gas stations, and is a terminal that performs payment processing between the payment terminal 2 and ECU 4 for payments when a user purchases a product or receives a service. Such locations are located outside vehicle C and are vehicle visit locations that vehicle C can visit while traveling. Payment methods used in payment processing include, but are not limited to, electronic money payment and credit card payment. Note that if the payment method is credit card payment, payment terminal 2 may access a server that manages credit card information via network NW to perform a credit inquiry.

Figure 2 is a diagram showing an example of the general configuration of the payment terminal 2. As shown in Figure 2, the payment terminal 2 includes a memory unit 21, a reader/writer 22, and a processing unit 23 composed of a CPU (Central Processing Unit) and other components. The memory unit 21 stores software such as an operating system (OS) and applications. The applications include an authentication processing program and a payment processing program. The memory unit 21 also stores authentication data used in the authentication process to establish a secure channel with the eSE 5. This authentication data is, for example, a key set including a secure channel encryption key, a secure channel MAC (Message Authentication Code) key, and a data encryption key. The memory unit 21 also stores patches provided by the management server 1 and a list of devices to which the patches should be applied, in association with each other.

The reader/writer 22 is equipped with an antenna and is capable of conducting short-range wireless communication with the repeater 3 within the short-range wireless communication range. The protocol for short-range wireless communication between the reader/writer 22 and the repeater 3 may be, for example, the UWB protocol. In this case, the reader/writer 22 periodically checks (locates) whether the repeater 3 with which it is communicating is present within a predetermined distance range, and conducts short-range wireless communication with a repeater 3 that is confirmed to be present within that distance range. The reader/writer 22 may be embedded in the ground, for example, outside the housing of the payment terminal 2, through which the vehicle C passes.

The processing unit 23 is an example of the authentication means, acquisition means, and transmission means of the present invention. The processing unit 23 executes authentication processing to establish a secure session with the eSE 5 via the repeater 3 in accordance with an authentication processing program. This authentication processing may involve mutual authentication using, for example, GVAS (General Vehicle Authentication System). When the authentication processing with the eSE 5 is completed and a secure session with the eSE 5 is established, the processing unit 23 encrypts a patch identified by the unique identification number and version number of the ECU 4 connected to the authenticated eSE 5 using a session key (i.e., a session key shared with the eSE 5) generated by the authentication processing, and provides the encrypted patch to the eSE 5. After a secure session is established between the eSE 5 and the payment terminal 2, the processing unit 23 executes payment processing in accordance with the payment processing program.

The repeater 3, ECU 4, and eSE 5 are installed, for example, in the center console of vehicle C. Within vehicle C, the repeater 3 and ECU 4 are electrically connected, and the ECU 4 and eSE 5 are also electrically connected. The repeater 3 and eSE 5 may also be electrically connected. The repeater 3 is equipped with an antenna and is capable of short-range wireless communication with the reader/writer 22. Furthermore, the repeater 3 performs short-range wireless communication with the electronic device of a passenger (user) of vehicle C within the short-range wireless communication range. The electronic device of the passenger of vehicle C is, for example, a contactless IC card or smartphone carried by the passenger. The protocol for short-range wireless communication between the passenger's electronic device of vehicle C and the repeater 3 may be, for example, an NFC protocol (e.g., a protocol specified in ISO 14443). The contactless IC card may be configured to include a secure element, such as a UICC (Universal Integrated Circuit Card) with high tamper resistance.

3 is a diagram showing an example of the schematic configuration of the ECU 4. As shown in FIG. 3, the ECU 4 is configured to include an interface (I/F) unit 41, an interface (I/F) unit 42, a storage unit 43, and a control unit 44. The interface unit 41 serves as an interface with the repeater 3. The interface unit 42 serves as an interface with the eSE 5. Examples of interfaces include SPI (Serial Peripheral Interface), ^I2C (Inter-Integrated Circuit), and ISO7816 interfaces. The ECU 4 and the eSE 5 constitute an electronic device of the present invention.

The memory unit 43 stores software such as an operating system and applications. Applications include payment processing programs to which patches can be applied. The memory unit 43 also stores payment data. The payment data includes information required for payment depending on the payment method. For example, if the payment method is credit card payment, the payment data includes data required for credit card payment, such as the credit card number, the cardholder's name, and expiration date. If the payment method is electronic money payment, the payment data includes data such as the electronic money number and electronic value required for electronic money payment. The memory unit 43 (an example of a storage means) also stores the unique identification number of the ECU 4 and the version number of software, such as the payment processing program, installed in the ECU 4.

The control unit 44 is configured with a CPU, RAM, ROM, etc. The control unit 44 is an example of the acquisition means and update means of the present invention. When a secure session is established between the eSE 5 and the payment terminal 2 and a patch is provided from the payment terminal 2 via the repeater 3 and the eSE 5, the control unit 44 acquires the patch and updates software such as the payment processing program for the patch. After a secure session is established between the eSE 5 and the payment terminal 2, the control unit 44 executes payment processing in accordance with the payment processing program. The control unit 44 may also be used to control the engine start of the vehicle C and the door locking/unlocking. If the console of the vehicle C is equipped with a multimedia terminal such as a display, the multimedia terminal is electrically connected to the control unit 44 via an interface unit (not shown) and controlled by the control unit 44.

The eSE 5 is installed, for example, inside the center console of the vehicle C, and is a secure element such as an eUICC (embedded Universal Integrated Circuit Card) with high tamper resistance. Figure 4 is a diagram showing an example of the general configuration of the eSE 5. As shown in Figure 4, the eSE 5 is composed of an interface (I/F) unit 51, RAM (Random Access Memory) 52, NVM (Nonvolatile Memory) 53, and CPU 54. The interface unit 51 serves as an interface with the ECU 4 and is electrically connected to the ECU 4. The NVM 53 stores software such as an operating system and applications. The applications include an authentication processing program to which patches can be applied.

NVM 53 stores authentication data (e.g., a key set including a secure channel encryption key, a secure channel MAC key, and a data encryption key) used in the authentication process to establish a secure channel with payment terminal 2. CPU 54 is an example of the authentication means and acquisition means of the present invention. In accordance with the authentication process program, CPU 54 executes authentication processing to establish a secure session with payment terminal 2 via repeater 3. When the authentication process with payment terminal 2 is completed and a secure session with payment terminal 2 is established, and a patch encrypted with a common session key is provided with payment terminal 2, CPU 54 acquires the patch (i.e., acquires it from payment terminal 2 via repeater 3), decrypts the patch with the session key, and provides it to ECU 4.

In addition, when a secure session is established between the eSE 5 and the payment terminal 2 and a patch for the authentication processing program is provided from the payment terminal 2 via the repeater 3, the CPU 54 may acquire the patch and, as an update means, update the authentication processing program based on the patch. In this case, the NVM 53 (an example of a storage means) stores the unique identification number of the eSE 5 and the version number of the authentication processing program installed in the eSE 5.

2. Operation of payment processing system S
Next, the operation of the payment processing system S will be described with reference to Figures 5 to 8. Figure 5 is a conceptual diagram showing the positional relationship between a reader/writer 22 embedded in the ground of a pay-by-the-hour parking lot and a vehicle C. Figure 6 is a sequence diagram showing an example of a transaction carried out in the payment processing system S before the start of a secure session. Figures 7 and 8 are sequence diagrams showing an example of a transaction carried out in the payment processing system S after the start of a secure session.

5A, the reader/writer 22 of the payment terminal 2 actively transmits radio waves D and periodically checks whether a communication partner exists within a preset distance range H, as shown in FIG. 5A. In the example of FIG. 5A, the vehicle C equipped with the repeater 3 is not within the distance range H, so the presence of the repeater 3 within the distance range H is not confirmed (detected) (standby state). On the other hand, in the example of FIG. 5B, the vehicle C equipped with the repeater 3 enters the distance range H, confirming that the repeater 3 exists within the distance range H (communication begins). Note that the example of FIG. 5B illustrates a case in which the vehicle C is parked. However, even when the vehicle C passes a predetermined position, such as in an Electronic Toll Collection System (ETC), the ECU 4 may confirm that it exists within the distance range H, and as a result, communication may begin. Alternatively, the repeater 3 equipped in the vehicle C may actively transmit radio waves and periodically check whether a communication partner (i.e., the payment terminal 2) exists within the preset distance range.

In FIG. 6, when the processing unit 23 of the payment terminal 2 confirms that the repeater 3 is within distance range H (step S1), it starts short-range wireless communication with the repeater 3 (step S2) and sends a SELECT command to the repeater 3 via the reader/writer 22 to select an application (authentication processing program) for performing authentication processing (step S3). This SELECT command includes the identifier (AID) of the application to be selected.

Next, when the repeater 3 receives the SELECT command from the payment terminal 2, it transmits the SELECT command to the ECU 4 (step S4). Note that if the repeater 3 and the eSE 5 are electrically connected, the repeater 3 may transmit the command directly to the eSE 5 without going through the ECU 4, or may receive a response directly from the ECU 4. Next, when the control unit 44 of the ECU 4 receives the SELECT command from the repeater 3 via the interface unit 41, it transmits the SELECT command to the eSE 5 via the interface unit 42 (step S5).

Next, when the CPU 54 of the eSE 5 receives a SELECT command from the ECU 4 (or the repeater 3) via the interface unit 51, it selects an application (authentication processing program) in accordance with the SELECT command (i.e., by interpreting the command) (step S6). Next, the CPU 54 of the eSE 5 transmits a response to the SELECT command to the ECU 4 (or the repeater 3) via the interface unit 51 (step S7). This response includes, for example, SW "9000" and FCI (File Control Information) in TLV format.

Next, when the control unit 44 of the ECU 4 receives a response from the eSE 5 via the interface unit 42, it transmits the response to the repeater 3 via the interface unit 41 (step S8). Next, when the repeater 3 receives a response from the ECU 4 (or eSE 5), it transmits the response to the payment terminal 2 (step S9).

Next, when the processing unit 23 of the payment terminal 2 receives a response from the repeater 3 via the reader/writer 22, it starts mutual authentication processing with the eSE 5 (step S10). Note that while the example in Figure 6 shows mutual authentication processing, one-sided authentication processing may also be used. When mutual authentication processing starts, the processing unit 23 of the payment terminal 2 sends an INITALIZE UPDATE command to the repeater 3 via the reader/writer 22 (step S11). Here, the INITALIZE UPDATE command is a command for notifying the eSE 5 of the start of mutual authentication processing to establish a secure channel between the payment terminal 2 and the eSE 5. The INITALIZE UPDATE command includes a random number and a Key Version Number. The Key Version Number is data used to identify the authentication data that is the basis of the cryptographic calculation.

Next, when the relay device 3 receives the INITALIZE UPDATE command from the payment terminal 2, it transmits the INITALIZE UPDATE command to the ECU 4 (or eSE 5) (step S12). Next, when the control unit 44 of the ECU 4 receives the INITALIZE UPDATE command from the relay device 3 via the interface unit 41, it transmits the INITALIZE UPDATE command to the eSE 5 via the interface unit 42 (step S13).

Next, when the CPU 54 of the eSE 5 receives an INITALIZE UPDATE command from the ECU 4 (or the repeater 3) via the interface unit 51, it generates a random number, a session key, and ciphertext A (Card Cryptogram) in response to the INITALIZE UPDATE command (step S14). Here, the session key is an encryption key used in the secure channel, and is generated, for example, based on the random number included in the INITALIZE UPDATE command, the random number generated in step S14, and authentication data stored in the NVM 24. Next, the CPU 54 of the eSE 5 transmits a response including the random number and ciphertext A (Card Cryptogram) generated in step S14 to the ECU 4 (or the repeater 3) via the interface unit 51 (step S15).

Next, when the control unit 44 of the ECU 4 receives a response from the eSE 5 via the interface unit 42, it transmits the response to the repeater 3 via the interface unit 41 (step S16). Next, when the repeater 3 receives a response from the ECU 4 (or eSE 5), it transmits the response to the payment terminal 2 (step S17).

Next, when the processing unit 23 of the payment terminal 2 receives a response from the repeater 3 via the reader/writer 22, it generates a session key and ciphertext A (Card Cryptogram) in the same manner as eSE5 according to the authentication processing program (step S18). Next, the processing unit 23 of the payment terminal 2 verifies the legitimacy of eSE5 by comparing ciphertext A (Card Cryptogram) included in the response received from the repeater 3 with the ciphertext A (Card Cryptogram) generated in step S18 (step S19). Next, if the processing unit 23 of the payment terminal 2 successfully verifies the legitimacy of eSE5 (i.e., authentication is successful), it generates ciphertext B (Host Cryptogram) (step S20). Next, the processing unit 23 of the payment terminal 2 transmits an EXTERNAL AUTHENTICATE command including ciphertext B (Host Cryptogram) generated in step S20 to the repeater 3 via the reader/writer 22 (step S21). If validity verification fails (i.e., authentication fails), error handling will be performed.

Next, when the relay device 3 receives the EXTERNAL AUTHENTICATE command from the payment terminal 2, it transmits the EXTERNAL AUTHENTICATE command to the ECU 4 (or eSE 5) (step S22). Next, when the control unit 44 of the ECU 4 receives the EXTERNAL AUTHENTICATE command from the relay device 3 via the interface unit 41, it transmits the EXTERNAL AUTHENTICATE command to the eSE 5 via the interface unit 42 (step S23).

Next, when the CPU 54 of the eSE 5 receives the EXTERNAL AUTHENTICATE command from the ECU 4 (or repeater 3) via the interface unit 51, it generates ciphertext B (Host Cryptogram) in response to the EXTERNAL AUTHENTICATE command in accordance with the authentication processing program using the same method as the payment terminal 2 (step S24). Next, the CPU 54 of the eSE 5 verifies the legitimacy of the payment terminal 2 by comparing the ciphertext B (Host Cryptogram) included in the EXTERNAL AUTHENTICATE command with the ciphertext B (Host Cryptogram) generated in step S24 (step S25). Next, if the CPU 54 of the eSE 5 successfully verifies the legitimacy of the payment terminal 2 (i.e., authentication is successful), it transmits a response indicating successful authentication to the ECU 4 (or repeater 3) via the interface unit 51 (step S26). Note that if the legitimacy verification fails (i.e., authentication fails), error processing is performed.

Next, when the control unit 44 of the ECU 4 receives a response from the eSE 5 via the interface unit 42, it transmits the response to the repeater 3 via the interface unit 41 (step S27). Next, when the repeater 3 receives a response from the ECU 4 (or eSE 5), it transmits the response to the payment terminal 2 (step S28). Next, when the processing unit 23 of the payment terminal 2 receives a response from the repeater 3 via the reader/writer 22, it terminates the mutual authentication process with the eSE 5 (step S29). This establishes a secure channel between the payment terminal 2 and the eSE 5.

Next, in FIG. 7, when a secure session is initiated (step S31), the processing unit 23 of the payment terminal 2 encrypts a SELECT command, which selects an application (payment processing program) for performing payment processing, with the session key, and transmits the encrypted SELECT command (hereinafter referred to as the "encrypted SELECT command") to the repeater 3 via the reader/writer 22 (step S32). This SELECT command includes the identifier (AID) of the application to be selected.

Next, when the repeater 3 receives the encrypted SELECT command from the payment terminal 2, it transmits the encrypted SELECT command to the ECU 4 (or eSE 5) (step S33). Next, when the control unit 44 of the ECU 4 receives the encrypted SELECT command from the repeater 3 via the interface unit 41, it transmits the encrypted SELECT command to the eSE 5 via the interface unit 42 (step S34).

Next, when the CPU 54 of the eSE 5 receives an encrypted SELECT command from the ECU 4 (or the repeater 3) via the interface unit 51, it decrypts the encrypted SELECT command using the session key and transmits the decrypted SELECT command to the ECU 4 via the interface unit 51 (step S35). Next, when the control unit 44 of the ECU 4 receives the SELECT command from the eSE 5, it selects an application (payment processing program) in accordance with the SELECT command (step S36). Next, the control unit 44 of the ECU 4 transmits a response to the SELECT command to the eSE 5 via the interface unit 42 (step S37).

Next, when the CPU 54 of the eSE 5 receives a response from the ECU 4 via the interface unit 51, it encrypts the response with the session key and transmits the encrypted response (hereinafter referred to as the "encrypted response") to the ECU 4 (or the repeater 3) via the interface unit 51 (step S38). Next, when the control unit 44 of the ECU 4 receives the encrypted response from the eSE 5 via the interface unit 42, it transmits the encrypted response to the repeater 3 via the interface unit 41 (step S39). Next, when the repeater 3 receives the encrypted response from the ECU 4 (or the eSE 5), it transmits the encrypted response to the payment terminal 2 (step S40).

Next, when the processing unit 23 of the payment terminal 2 receives the encrypted response from the repeater 3 via the reader/writer 22, it decrypts the encrypted response. Next, the processing unit 23 of the payment terminal 2 encrypts a GET DATA command indicating a request to obtain the unique identification number and version number with the session key, and transmits the encrypted GET DATA command (hereinafter referred to as the "encrypted GET DATA command") to the repeater 3 via the reader/writer 22 (step S41). Here, the unique identification number in the request is the unique identification number of the ECU 4, and the version number in the request is the version number of a selected application (payment processing program) from among the applications installed on the ECU 4.

Next, when the repeater 3 receives the encrypted GET DATA command from the payment terminal 2, it transmits the encrypted GET DATA command to the ECU 4 (or eSE 5) (step S42). Next, when the control unit 44 of the ECU 4 receives the encrypted GET DATA command from the repeater 3 via the interface unit 41, it transmits the encrypted GET DATA command to the eSE 5 via the interface unit 42 (step S43).

Next, when the CPU 54 of the eSE 5 receives an encrypted GET DATA command from the ECU 4 (or the repeater 3) via the interface unit 51, it decrypts the encrypted GET DATA command using the session key and transmits the decrypted GET DATA command to the ECU 4 via the interface unit 51 (step S44). Next, when the control unit 44 of the ECU 4 receives the GET DATA command from the eSE 5, it reads the unique identification number of the ECU 4 and the version number of the selected application (payment processing program) from the memory unit 43 in response to the GET DATA command (step S45). Next, the control unit 44 of the ECU 4 transmits a response including the unique identification number and version number read in step S45 to the eSE 5 via the interface unit 42 (step S46).

Next, when the CPU 54 of the eSE 5 receives a response from the ECU 4 via the interface unit 51, it encrypts the response with the session key and transmits the encrypted response to the ECU 4 (or the repeater 3) via the interface unit 51 (step S47). Next, when the control unit 44 of the ECU 4 receives the encrypted response from the eSE 5 via the interface unit 42, it transmits the encrypted response to the repeater 3 via the interface unit 41 (step S48). Next, when the repeater 3 receives the encrypted response from the ECU 4 (or the eSE 5), it transmits the encrypted response to the payment terminal 2 (step S49).

Next, when the processing unit 23 of the payment terminal 2 receives the encrypted response from the repeater 3 via the reader/writer 22, it decrypts the encrypted response and obtains the unique identification number and version number from the decrypted response (step S50). In this way, the processing unit 23 obtains the unique identification number and version number from the ECU 4 via the repeater 3 or the like. Next, as shown in FIG. 8 , the processing unit 23 of the payment terminal 2 determines whether a patch application target device list exists (i.e., whether it is stored in the memory unit 21) in which the combination of the unique identification number and version number obtained in step S50 is associated with the identifier of the application currently selected by the ECU 4 (step S51). If it is determined that such a patch application target device list exists (step S51: YES), the patch application target device list is identified, and processing proceeds to step S52. If it is determined that such a patch application target device list does not exist (step S51: NO), processing proceeds to step S63.

If only one application to which a patch may be applied is installed on the ECU 4, the processing unit 23 of the payment terminal 2 simply determines whether there is a list of devices to which the patch may be applied that registers the combination of the unique identification number and version number obtained in step S50 (there is no need to refer to the application identifier).

In step S52, the processing unit 23 of the payment terminal 2 identifies from the memory unit 21 a patch associated with the list of devices to be patched identified in step S51. Next, the processing unit 23 of the payment terminal 2 encrypts the UPDATE command (UPDATE PROGRAM command) containing the patch identified in step S52 with the session key, and transmits the encrypted UPDATE command (hereinafter referred to as the "encrypted UPDATE command") to the repeater 3 via the reader/writer 22 (step S53).

Next, when the repeater 3 receives the encrypted UPDATE command from the payment terminal 2, it transmits the encrypted UPDATE command to the ECU 4 (or eSE 5) (step S54). Next, when the control unit 44 of the ECU 4 receives the encrypted UPDATE command from the repeater 3 via the interface unit 41, it transmits the encrypted UPDATE command to the eSE 5 via the interface unit 42 (step S55).

Next, when the CPU 54 of the eSE 5 receives an encrypted UPDATE command from the ECU 4 (or the repeater 3) via the interface unit 51, it decrypts the encrypted UPDATE command using the session key and transmits the decrypted UPDATE command to the ECU 4 via the interface unit 51 (step S56). Next, when the control unit 44 of the ECU 4 receives the UPDATE command from the eSE 5, it acquires the patch included in the UPDATE command (step S57) and updates the selected application (payment processing program) based on the acquired patch (step S58). If the patch update is successful, the control unit 44 of the ECU 4 transmits a response indicating successful completion to the eSE 5 via the interface unit 41 (step S59). Note that if the patch update is not successful, the control unit 44 of the ECU 4 performs rollback processing.

Next, when the CPU 54 of the eSE 5 receives a response from the ECU 4 via the interface unit 51, it encrypts the response with the session key and transmits the encrypted response to the ECU 4 (or the repeater 3) via the interface unit 51 (step S60). Next, when the control unit 44 of the ECU 4 receives the encrypted response from the eSE 5 via the interface unit 42, it transmits the encrypted response to the repeater 3 via the interface unit 41 (step S61). Next, when the repeater 3 receives the encrypted response from the ECU 4 (or the eSE 5), it transmits the encrypted response to the payment terminal 2 (step S62).

Next, when the processing unit 23 of the payment terminal 2 receives the encrypted response from the repeater 3 via the reader/writer 22, it decrypts the encrypted response and proceeds to step S63. In step S63, the processing unit 23 of the payment terminal 2 encrypts a GET DATA command indicating a request to obtain payment data with the session key, and transmits the encrypted GET DATA command to the repeater 3 via the reader/writer 22.

Next, when the repeater 3 receives the encrypted GET DATA command from the payment terminal 2, it transmits the encrypted GET DATA command to the ECU 4 (or eSE 5) (step S64). Next, when the control unit 44 of the ECU 4 receives the encrypted GET DATA command from the repeater 3 via the interface unit 41, it transmits the encrypted GET DATA command to the eSE 5 via the interface unit 42 (step S65).

Next, when the CPU 54 of the eSE 5 receives an encrypted GET DATA command from the ECU 4 (or the repeater 3) via the interface unit 51, it decrypts the encrypted GET DATA command using the session key and transmits the decrypted GET DATA command to the ECU 4 via the interface unit 51 (step S66). Next, when the control unit 44 of the ECU 4 receives the GET DATA command from the eSE 5, it reads payment data from the memory unit 43 using the selected application (payment processing program) in response to the GET DATA command (step S67). Next, the control unit 44 of the ECU 4 transmits a response including the payment data read in step S67 to the eSE 5 via the interface unit 42 (step S68).

Next, when the CPU 54 of the eSE 5 receives a response from the ECU 4 via the interface unit 51, it encrypts the response with the session key and transmits the encrypted response to the ECU 4 (or the repeater 3) via the interface unit 51 (step S69). Next, when the control unit 44 of the ECU 4 receives the encrypted response from the eSE 5 via the interface unit 42, it transmits the encrypted response to the repeater 3 via the interface unit 41 (step S70). Next, when the repeater 3 receives the encrypted response from the ECU 4 (or the eSE 5), it transmits the encrypted response to the payment terminal 2 (step S71).

Next, when the processing unit 23 of the payment terminal 2 receives the encrypted response from the repeater 3 via the reader/writer 22, it decrypts the encrypted response and executes payment for the fee based on the payment data included in the decrypted response (step S72). For example, the processing unit 23 of the payment terminal 2 executes processing to charge (e.g., debit) the parking fee to the user using the payment method specified by the payment data.

In the above example, the payment terminal 2 is configured to determine whether there is a patch application target device list that registers the combination of the ECU 4's unique identification number and the version number of the application currently selected by the ECU 4. Alternatively, the ECU 4 may obtain a patch application target device list that includes the identifier of the application currently selected by the ECU 4 from the payment terminal 2 via a repeater 3 or the like, and determine whether the combination of the unique identification number and version number stored in the memory unit 43 is registered in the patch application target device list. In this case, it is determined whether the specific unique identification number registered in the patch application target device list matches the specific identification number stored in the memory unit 43, and whether the specific version number registered in the patch application target device list matches the version number stored in the memory unit 43 (the version number of the selected application).

Then, if the combination of the unique identification number and version number stored in the memory unit 43 is registered in the list of devices to be patched, the ECU 4 acquires the patch associated with the list of devices to be patched from the payment terminal 2 via the repeater 3 or the like. The list of devices to be patched may be transmitted from the payment terminal 2 as part of a predetermined command such as a Verify command. Furthermore, if it is determined that the combination of the unique identification number and version number stored in the memory unit 43 is registered in the list of devices to be patched, a response indicating normal completion is transmitted to the payment terminal 2 via the repeater 3 or the like. As a result, an UPDATE command including the patch associated with the list of devices to be patched transmitted to the ECU 4 is transmitted from the payment terminal 2.

In the above example, the payment processing program installed in the ECU 4 was used as an example of the application to which the patch is applied, but it could also be an authentication processing program installed in the eSE 5. In this case, before starting the mutual authentication process with the eSE 5 in step S10, the payment terminal 2 sends a GET DATA command to the repeater 3 requesting to obtain the unique identification number of the eSE 5 and the version number of the authentication processing program installed in the eSE 5. As a result, if there is a patch target device list that associates the combination of the unique identification number and version number included in the response received from the eSE 5 via the repeater 3 or the like with the identifier of the authentication processing program currently selected in the eSE 5, the payment terminal 2 provides the associated patch to the eSE 5 via the repeater 3 or the like to update the authentication processing program.

As described above, according to the above embodiment, an electronic device such as an ECU 4 pre-stores its own unique identification number and the version number of the selected software. After the authentication process between the payment terminal 2 and the electronic device is completed, a patch identified by the unique identification number and version number is obtained from the payment terminal 2 via the repeater 3, and the software is updated based on the obtained patch. This allows software installed on an electronic device in a vehicle C to be updated more efficiently. This embodiment is particularly effective when the vehicle C is not equipped with a device capable of connecting to a mobile communications network that has a base station for wireless communication, or when the vehicle C is equipped with a device capable of connecting to the mobile communications network but is located in an area where radio waves from the base station cannot reach.

In the above embodiment, the electronic device of the present invention was described using the ECU 4 as an example, but it may also be an electronic device of a passenger in vehicle C. In this case, the electronic device stores a unique identification number specific to the electronic device and the version number of the software installed on the electronic device. The electronic device then performs the authentication process as described above by communicating with the payment terminal 2 via the repeater 3. After the authentication process is complete, the electronic device obtains a patch identified by the stored unique identification number and version number from the payment terminal 2 via the repeater 3, and updates the software based on the obtained patch.

1 Management server 2 Payment terminal 3 Relay 4 ECU
5 eSE
21 Memory unit 22 Reader/writer 23 Processing unit 21 Antenna 41 Interface unit 42 Interface unit 43 Memory unit 44 Control unit 51 Interface unit 52 RAM
53 NVM
54 CPU
S Payment processing system

Claims (8)

An electronic device capable of communicating with an external device installed outside a mobile body via a relay device mounted on the mobile body,
a storage means for storing a unique identification number of the electronic device and a version number of the software installed on the electronic device;
an authentication unit that executes an authentication process between the relay device and the external device;
an acquisition unit that acquires patch data identified by the unique identification number and version number stored in the storage unit from the external device via the relay device after the authentication process is completed;
an update unit that updates the software based on the patch data acquired by the acquisition unit;
Equipped with
The electronic device is characterized in that the acquisition means acquires a list registering combinations of specific unique identification numbers and specific version numbers from the external device via the relay device, and acquires the patch data from the external device via the relay device if the combination of the unique identification number and the version number stored in the storage means is registered in the list . An electronic device capable of communicating with an external device installed outside a mobile body via a relay device mounted on the mobile body,
a storage means for storing a unique identification number of the electronic device and a version number of the software installed on the electronic device;
an authentication unit that executes an authentication process between the relay device and the external device;
an acquisition unit that acquires patch data identified by the unique identification number and version number stored in the storage unit from the external device via the relay device after the authentication process is completed;
an update unit that updates the software based on the patch data acquired by the acquisition unit;
Equipped with
the electronic device is configured by a secure element and an ECU (Electronic Control Unit) mounted on the mobile object,
the secure element includes the authentication means and the acquisition means, and the acquisition means acquires the patch data encrypted with a session key that is generated in the authentication process and is common to the external device, and decrypts the patch data with the session key;
The electronic device is characterized in that the ECU includes the storage means and the update means, and the update means updates the software based on the decrypted patch data. The electronic device according to claim 1 or 2, characterized in that the acquisition means acquires the patch data from the external device via the relay device by transmitting the unique identification number and the version number stored in the storage means to the external device via the relay device. A terminal device capable of communicating with an electronic device installed in a mobile body or an electronic device carried by a passenger of the mobile body via a relay device mounted on the mobile body,
the electronic device stores a unique identification number of the electronic device and a version number of software installed on the electronic device;
The terminal device
an authentication unit that performs an authentication process between the electronic device and the relay device;
an acquisition unit that acquires the unique identification number and the version number from the electronic device via the relay device after the authentication process is completed;
a transmitting means for transmitting patch data for updating the software installed in the electronic device, the patch data corresponding to the unique identification number and the version number acquired by the acquiring means, via the relay device;
A terminal device comprising: 1. A software update method executed by an electronic device capable of communicating with an external device installed outside a mobile object via a relay device mounted on the mobile object, comprising:
storing in a storage means a unique identification number of the electronic device and a version number of the software installed on the electronic device;
performing an authentication process between the relay device and the external device via the relay device;
an acquisition step of acquiring patch data identified by the unique identification number and version number stored in the storage means from the external device via the relay device after the authentication process is completed;
updating the software based on the acquired patch data;
Including,
A software update method characterized in that in the acquisition step, a list registering combinations of specific unique identification numbers and specific version numbers is acquired from the external device via the relay device, and if the combination of the unique identification number and the version number stored in the storage means is registered in the list, the patch data is acquired from the external device via the relay device . 1. A software update method executed by an electronic device capable of communicating with an external device installed outside a mobile body via a relay device mounted on the mobile body, the electronic device including a secure element mounted on the mobile body and an ECU (Electronic Control Unit),
a step in which the ECU stores in a storage means the unique identification number of the electronic device and the version number of the software installed in the electronic device;
a step of performing an authentication process between the secure element and the external device via the relay device;
an acquisition step in which the secure element acquires patch data identified by the unique identification number and version number stored in the storage means from the external device via the relay device after the authentication process is completed;
an updating step in which the ECU updates the software based on the acquired patch data;
Including,
In the acquiring step, the patch data encrypted with a session key generated in the authentication process and shared with the external device is acquired, and the patch data is decrypted with the session key;
In the updating step, the software is updated based on the decrypted patch data. A computer included in an electronic device capable of communicating with an external device installed outside a mobile body via a relay device mounted on the mobile body,
a storage means for storing a unique identification number of the electronic device and a version number of the software installed on the electronic device;
an authentication unit that executes an authentication process between the relay device and the external device;
an acquisition unit that acquires patch data identified by the unique identification number and version number stored in the storage unit from the external device via the relay device after the authentication process is completed;
a program that functions as an update unit that updates the software based on the patch data acquired by the acquisition unit,
The program is characterized in that the acquisition means acquires a list registering combinations of specific unique identification numbers and specific version numbers from the external device via the relay device, and acquires the patch data from the external device via the relay device if the combination of the unique identification number and the version number stored in the storage means is registered in the list . An electronic device capable of communicating with an external device installed outside a mobile body via a relay device mounted on the mobile body, the electronic device being configured with a secure element mounted on the mobile body and an ECU (Electronic Control Unit),
a storage means for storing a unique identification number of the electronic device and a version number of the software installed on the electronic device;
an authentication unit that executes an authentication process between the relay device and the external device;
an acquisition unit that acquires patch data identified by the unique identification number and version number stored in the storage unit from the external device via the relay device after the authentication process is completed;
a program that functions as an update unit that updates the software based on the patch data acquired by the acquisition unit,
the acquisition means acquires the patch data encrypted with a session key that is generated in the authentication process and is common to the external device, and decrypts the patch data with the session key;
The update means updates the software based on the decrypted patch data.