JP7732289B2 - Electronic device, application addition method, and program - Google Patents

Description

The present invention relates to technical fields such as methods for providing various services, such as payment, to vehicle users via short-range wireless communication.

Conventionally, various services such as payment can be provided to vehicle users via short-range wireless communication between an ECU (Electronic Control Unit) or SE (Secure Element) installed in a vehicle and a server installed outside the vehicle. For example, Patent Document 1 discloses a system in which, when a VID (Vehicle Interface Device) installed in a vehicle receives a request for payment account information from a dealer access device, it determines whether the user's mobile communications device is inside the vehicle, and if it determines that the mobile communications device is inside the vehicle, it transmits payment account information read from a payment card inserted into the VID to the dealer access device.

Japanese Patent Application Laid-Open No. 2020-53066

The various services described above are realized by applications installed in, for example, the ECU or SE, but when installing such applications, it is necessary to install and add the applications to the ECU or SE by transmitting the applications (application files) from a server to the ECU or SE using, for example, a mobile communication network. However, if a mobile communication network is not available, it is not possible to efficiently add applications.
Therefore, the present invention has been made in consideration of the above points and aims to provide an electronic device, an application addition method, and a program that enable applications to be added to an electronic device in a vehicle more efficiently.

In order to solve the above problem, the invention described in claim 1 is an electronic device capable of communicating with an external device installed outside a mobile body via a relay device mounted on the mobile body, comprising: a storage means for storing a unique identification number of the electronic device and a list indicating identifiers of applications installed on the electronic device; an authentication means for performing an authentication process with the external device via the relay device; an acquisition means for acquiring, after the authentication process is completed, from the external device via the relay device, an application identified by the unique identification number stored in the storage means and whose identifier is not included in the list; and an installation means for installing the application acquired by the acquisition means, wherein the acquisition means acquires a specific unique identification number and an identifier of a specific application from the external device via the relay device, and if the specific unique identification number matches the unique identification number stored in the storage means and the identifier of the specific application is not included in the list, thereby acquiring the application from the external device via the relay device . The invention described in claim 2 is an electronic device capable of communicating with an external device installed outside a mobile body via a relay device mounted on the mobile body, the electronic device comprising: a storage means for storing a unique identification number of the electronic device and a list indicating identifiers of applications installed on the electronic device; an authentication means for performing an authentication process with the external device via the relay device; an acquisition means for acquiring, after the authentication process is completed, from the external device via the relay device, an application identified by the unique identification number stored in the storage means and whose identifier is not shown in the list; and an installation means for installing the application acquired by the acquisition means, the electronic device being composed of a secure element and an ECU (Electronic Control Unit) mounted on the mobile body, the secure element including the authentication means and the acquisition means, the acquisition means acquiring the application encrypted using a session key generated in the authentication process and common to the external device, and decrypting the application using the session key, the ECU including the storage means and the installation means, and the installation means installing the decrypted application.

The invention described in claim 3 is characterized in that, in the electronic device described in claim 1 or 2 , the acquisition means acquires the application from the external device via the relay device by transmitting the unique identification number and the list to the external device via the relay device.

The invention described in claim 4 is a terminal device capable of communicating with an electronic device installed in a mobile body or an electronic device carried by a passenger of the mobile body via a relay device mounted on the mobile body, wherein the electronic device stores a unique identification number of the electronic device and a list indicating identifiers of applications installed on the electronic device, and the terminal device is characterized in that it comprises: an authentication means for performing an authentication process with the electronic device via the relay device; an acquisition means for acquiring the unique identification number and the list from the electronic device via the relay device after the authentication process is completed; and a transmission means for transmitting via the relay device an application identified by the unique identification number acquired by the acquisition means and whose identifier is not indicated in the list.

The invention described in claim 5 is an application adding method executed by an electronic device capable of communicating with an external device installed outside a mobile body via a relay device mounted on the mobile body, comprising the steps of: storing in a storage means a list indicating the unique identification number of the electronic device and identifiers of applications installed on the electronic device; performing an authentication process with the external device via the relay device; after the authentication process is completed, acquiring from the external device via the relay device an application identified by the unique identification number stored in the storage means and whose identifier is not included in the list; and installing the acquired application, wherein in the acquiring step, a specific unique identification number and an identifier of the specific application are acquired from the external device via the relay device; and, if the specific unique identification number matches the unique identification number stored in the storage means and the identifier of the specific application is not included in the list, a request for the application is sent to the external device via the relay device, thereby acquiring the application from the external device via the relay device . The invention described in claim 6 is an application adding method executed by an electronic device capable of communicating with an external device installed outside a mobile body via a relay device mounted on the mobile body, the electronic device being composed of a secure element mounted on the mobile body and an ECU (Electronic Control Unit), the method including: a step by the ECU storing in a storage means a list indicating a unique identification number of the electronic device and identifiers of applications installed on the electronic device; a step by the secure element performing an authentication process with the external device via the relay device; an acquisition step by the secure element acquiring from the external device via the relay device, after the authentication process is completed, an application identified by the unique identification number stored in the storage means and whose identifier is not shown in the list; and an installation step by the ECU installing the acquired application, wherein in the acquisition step, the application encrypted with a session key generated in the authentication process and common to the external device is acquired, and the application is decrypted using the session key; and in the installation step, the decrypted application is installed.

The invention described in claim 7 is a program that causes a computer included in an electronic device capable of communicating with an external device installed outside a mobile body via a relay device mounted on the mobile body to function as follows: a storage means that stores a unique identification number of the electronic device and a list indicating identifiers of applications installed on the electronic device; an authentication means that performs an authentication process with the external device via the relay device; an acquisition means that, after the authentication process is completed, acquires from the external device via the relay device an application identified by the unique identification number stored in the storage means and whose identifier is not shown in the list; and an installation means that installs the application acquired by the acquisition means, wherein the acquisition means acquires a specific unique identification number and an identifier of a specific application from the external device via the relay device, and, if the specific unique identification number matches the unique identification number stored in the storage means and the identifier of the specific application is not shown in the list, acquires the application from the external device via the relay device by sending a request for the application to the external device via the relay device . The invention described in claim 8 is a program that causes a computer included in an electronic device capable of communicating with an external device installed outside a mobile body via a relay device mounted on the mobile body, the electronic device being composed of a secure element and an ECU (Electronic Control Unit) mounted on the mobile body, to function as: a storage means that stores a unique identification number of the electronic device and a list indicating identifiers of applications installed on the electronic device; an authentication means that performs an authentication process with the external device via the relay device; an acquisition means that, after the authentication process is completed, acquires from the external device via the relay device an application identified by the unique identification number stored in the storage means and whose identifier is not shown in the list; and an installation means that installs the application acquired by the acquisition means, wherein the acquisition means acquires the application encrypted using a session key generated in the authentication process and common to the external device, and decrypts the application using the session key; and the installation means installs the decrypted application.

The present invention allows applications to be added to electronic devices in a vehicle more efficiently.

1 is a diagram illustrating an example of a schematic configuration of a payment processing system S according to an embodiment of the present invention. FIG. 2 is a diagram illustrating an example of a schematic configuration of a payment terminal 2. FIG. 2 is a diagram illustrating an example of a schematic configuration of an ECU 4. FIG. 2 is a diagram illustrating an example of a schematic configuration of an eSE 5. 1 is a conceptual diagram showing the positional relationship between a reader/writer 22 embedded in the ground of a pay-by-the-hour parking lot and a vehicle C. FIG. FIG. 10 is a sequence diagram showing an example of a transaction carried out before a secure session is started in the payment processing system S. FIG. 10 is a sequence diagram showing an example of a transaction carried out after a secure session is started in the payment processing system S. FIG. 10 is a sequence diagram showing an example of a transaction carried out after a secure session is started in the payment processing system S.

Embodiments of the present invention will be described in detail below with reference to the drawings. The embodiments described below are embodiments in which the present invention is applied to a payment processing system in which payment processing is carried out between a payment terminal installed outside a vehicle and an ECU (Electronic Control Unit) installed in the vehicle. The payment terminal is an example of an external device, and the ECU is an example of an electronic device. The vehicle is an example of a mobile object, such as a two-wheeled vehicle, a four-wheeled vehicle, or a bicycle.

[1. General configuration of payment processing system S]
First, the schematic configuration of a payment processing system S according to this embodiment will be described with reference to Fig. 1 and other figures. Fig. 1 is a diagram showing an example of the schematic configuration of the payment processing system S according to this embodiment. As shown in Fig. 1, the payment processing system S includes a management server 1, a payment terminal 2, a repeater 3 (an example of a repeater device), an ECU (Electronic Control Unit) 4, and an eSE (Embedded Secure Element) 5. The management server 1 and the payment terminal 2 (an example of a terminal device) are each connected to a network NW formed, for example, by the Internet, and the management server 1 and the payment terminal 2 are capable of communicating via the network NW.

The management server 1 is a server for managing specific applications that can be provided to specific devices (e.g., specific ECUs or eSEs). Specific applications are software required to use various services, such as payment services. Specific applications are assigned unique identifiers. Specific applications are provided to the payment terminal 2 via the network NW along with the unique identification number of the specific device (e.g., specific ECUs or eSEs) that can provide the application. The unique identification number of the specific device may also be a number that identifies the model of the vehicle C.

Payment terminal 2 is installed in locations such as stores with drive-through facilities, parking lots, and gas stations, and is a terminal that performs payment processing between the payment terminal 2 and ECU 4 for payments when a user purchases a product or receives a service. Such locations are located outside vehicle C and are vehicle visit locations that vehicle C can visit while traveling. Payment methods used in payment processing include, but are not limited to, electronic money payment and credit card payment. Note that if the payment method is credit card payment, payment terminal 2 may access a server that manages credit card information via network NW to perform a credit inquiry.

FIG. 2 is a diagram illustrating an example of the schematic configuration of the payment terminal 2. As shown in FIG. 2, the payment terminal 2 includes a storage unit 21, a reader/writer 22, and a processing unit 23 including a CPU (Central Processing Unit) and the like. The storage unit 21 stores software such as an operating system (OS) and applications. The applications include an authentication processing program and a payment processing program. The storage unit 21 also stores authentication data used in authentication processing to establish a secure channel with the eSE 5. The authentication data is, for example, a key set including a secure channel encryption key, a secure channel MAC (Message Authentication Code) key, and a data encryption key. The storage unit 21 also stores a specific application provided by the management server 1 and a unique identification number of a specific device in association with each other. This allows a specific application to be identified by the unique identification number of a specific device.

The reader/writer 22 is equipped with an antenna and is capable of conducting short-range wireless communication with the repeater 3 within the short-range wireless communication range. The protocol for short-range wireless communication between the reader/writer 22 and the repeater 3 may be, for example, the UWB protocol. In this case, the reader/writer 22 periodically checks (locates) whether the repeater 3 with which it is communicating is present within a predetermined distance range, and conducts short-range wireless communication with a repeater 3 that is confirmed to be present within that distance range. The reader/writer 22 may be embedded in the ground, for example, outside the housing of the payment terminal 2, through which the vehicle C passes.

The processing unit 23 is an example of the authentication means, acquisition means, and transmission means of the present invention. The processing unit 23 executes authentication processing to establish a secure session with the eSE 5 via the repeater 3 in accordance with an authentication processing program. Mutual authentication using, for example, GVAS (General Vehicle Authentication System) may be performed during this authentication processing. When the authentication processing with the eSE 5 is completed and a secure session with the eSE 5 is established, the processing unit 23 encrypts an application identified by the unique identification number of the ECU 4 connected to the authenticated eSE 5 but not installed on the ECU 4 using a session key generated by the authentication processing (i.e., a session key shared with the eSE 5), and provides the encrypted application to the eSE 5. Such an application is, for example, an application required for using a payment service provided to the ECU 4 connected to the authenticated eSE 5 after the authentication processing is completed. Furthermore, after a secure session between the eSE 5 and the payment terminal 2 is established, the processing unit 23 executes payment processing in accordance with the payment processing program.

The repeater 3, ECU 4, and eSE 5 are installed, for example, in the center console of vehicle C. Within vehicle C, the repeater 3 and ECU 4 are electrically connected, and the ECU 4 and eSE 5 are also electrically connected. The repeater 3 and eSE 5 may also be electrically connected. The repeater 3 is equipped with an antenna and is capable of short-range wireless communication with the reader/writer 22. Furthermore, the repeater 3 performs short-range wireless communication with the electronic device of a passenger (user) of vehicle C within the short-range wireless communication range. The electronic device of the passenger of vehicle C is, for example, a contactless IC card or smartphone carried by the passenger. The protocol for short-range wireless communication between the passenger's electronic device of vehicle C and the repeater 3 may be, for example, an NFC protocol (e.g., a protocol specified in ISO 14443). The contactless IC card may be configured to include a secure element, such as a UICC (Universal Integrated Circuit Card) with high tamper resistance.

Fig. 3 is a diagram showing an example of the schematic configuration of the ECU 4. As shown in Fig. 3, the ECU 4 is configured to include an interface (I/F) unit 41, an interface (I/F) unit 42, a storage unit 43, and a control unit 44. The interface unit 41 serves as an interface with the repeater 3. The interface unit 42 serves as an interface with the eSE 5. Examples of interfaces include SPI (Serial Peripheral Interface), ^I2C (Inter-Integrated Circuit), and ISO7816 interfaces.
The eSE 4 and the eSE 5 constitute the electronic device of the present invention.

The memory unit 43 stores software such as an OS and applications. Applications include payment processing programs required to use payment services. The memory unit 43 also stores payment data. The payment data includes information required for payment depending on the payment method. For example, if the payment method is credit card payment, the payment data includes data required for credit card payment, such as the credit card number, the cardholder's name, and expiration date. If the payment method is electronic money payment, the payment data includes data such as the electronic money number and electronic value required for electronic money payment. The memory unit 43 (an example of a storage means) also stores the unique identification number of the ECU 4 and a list indicating the identifiers of applications installed on the ECU 4 (hereinafter referred to as the "application list").

The control unit 44 is configured with a CPU, RAM, ROM, etc. The control unit 44 is an example of the acquisition means and installation means of the present invention. When a secure session is established between the eSE 5 and the payment terminal 2 and an application (payment processing program) is provided from the payment terminal 2 via the repeater 3 and the eSE 5, the control unit 44 acquires and installs the application. That is, the control unit 44 unpacks the downloaded application file and sets it to a state where it can be operated on the OS. After a secure session is established between the eSE 5 and the payment terminal 2, the control unit 44 executes the payment processing in accordance with the payment processing program. The control unit 44 may also be used to control the engine start and door lock/unlock of the vehicle C. If a multimedia terminal such as a display is provided on the console of the vehicle C, the multimedia terminal is electrically connected to the control unit 44 via an interface unit (not shown) and controlled by the control unit 44.

The eSE 5 is installed, for example, inside the center console of the vehicle C, and is a secure element such as an eUICC (embedded Universal Integrated Circuit Card) with high tamper resistance. Figure 4 is a diagram showing an example of the general configuration of the eSE 5. As shown in Figure 4, the eSE 5 is composed of an interface (I/F) unit 51, RAM (Random Access Memory) 52, NVM (Nonvolatile Memory) 53, and CPU 54. The interface unit 51 serves as an interface with the ECU 4 and is electrically connected to the ECU 4. The NVM 53 stores software such as an OS and applications. The applications include an authentication processing program.

NVM 53 stores authentication data (e.g., a key set including a secure channel encryption key, a secure channel MAC key, and a data encryption key) used in authentication processing to establish a secure channel with payment terminal 2. NVM 53 may also store a unique identification number for ECU 4 and an application list indicating identifiers of applications installed in eSE 5. CPU 54 is an example of the authentication means and acquisition means of the present invention. In accordance with an authentication processing program, CPU 54 executes authentication processing to establish a secure session with payment terminal 2 via repeater 3. When authentication processing with payment terminal 2 is completed and a secure session with payment terminal 2 is established, and an application (payment processing program) encrypted with a common session key is provided to payment terminal 2, CPU 54 acquires the application, decrypts it using the session key, and provides it to ECU 4.

2. Operation of payment processing system S
Next, the operation of the payment processing system S will be described with reference to Figures 5 to 8. Figure 5 is a conceptual diagram showing the positional relationship between a reader/writer 22 embedded in the ground of a pay-by-the-hour parking lot and a vehicle C. Figure 6 is a sequence diagram showing an example of a transaction carried out in the payment processing system S before the start of a secure session. Figures 7 and 8 are sequence diagrams showing an example of a transaction carried out in the payment processing system S after the start of a secure session.

5A, the reader/writer 22 of the payment terminal 2 actively transmits radio waves D and periodically checks whether a communication partner exists within a preset distance range H, as shown in FIG. 5A. In the example of FIG. 5A, the vehicle C equipped with the repeater 3 is not within the distance range H, so the presence of the repeater 3 within the distance range H is not confirmed (detected) (standby state). On the other hand, in the example of FIG. 5B, the vehicle C equipped with the repeater 3 enters the distance range H, confirming that the repeater 3 exists within the distance range H (communication begins). Note that the example of FIG. 5B illustrates a case in which the vehicle C is parked. However, even when the vehicle C passes a predetermined position, such as in an Electronic Toll Collection System (ETC), the ECU 4 may confirm that it exists within the distance range H, and as a result, communication may begin. Alternatively, the repeater 3 equipped in the vehicle C may actively transmit radio waves and periodically check whether a communication partner (i.e., the payment terminal 2) exists within the preset distance range.

In FIG. 6, when the processing unit 23 of the payment terminal 2 confirms that the repeater 3 is within distance range H (step S1), it starts short-range wireless communication with the repeater 3 (step S2) and sends a SELECT command to the repeater 3 via the reader/writer 22 to select an application (authentication processing program) for performing authentication processing (step S3). This SELECT command includes the identifier (AID) of the application to be selected.

Next, when the repeater 3 receives the SELECT command from the payment terminal 2, it transmits the SELECT command to the ECU 4 (step S4). Note that if the repeater 3 and the eSE 5 are electrically connected, the repeater 3 may transmit the command directly to the eSE 5 without going through the ECU 4, or may receive a response directly from the ECU 4. Next, when the control unit 44 of the ECU 4 receives the SELECT command from the repeater 3 via the interface unit 41, it transmits the SELECT command to the eSE 5 via the interface unit 42 (step S5).

Next, when the CPU 54 of the eSE 5 receives a SELECT command from the ECU 4 (or the repeater 3) via the interface unit 51, it selects an application (authentication processing program) in accordance with the SELECT command (i.e., by interpreting the command) (step S6). Next, the CPU 54 of the eSE 5 transmits a response to the SELECT command to the ECU 4 (or the repeater 3) via the interface unit 51 (step S7). This response includes, for example, SW "9000" and FCI (File Control Information) in TLV format.

Next, when the control unit 44 of the ECU 4 receives a response from the eSE 5 via the interface unit 42, it transmits the response to the repeater 3 via the interface unit 41 (step S8). Next, when the repeater 3 receives a response from the ECU 4 (or eSE 5), it transmits the response to the payment terminal 2 (step S9).

Next, upon receiving a response from the repeater 3 via the reader/writer 22, the processing unit 23 of the payment terminal 2 starts mutual authentication processing with the eSE 5 (step S10). Note that although the example of FIG. 6 shows mutual authentication processing, one-sided authentication processing may also be used. When mutual authentication processing starts, the processing unit 23 of the payment terminal 2 sends an INITALIZE UPDATE command to the repeater 3 via the reader/writer 22 (step S11). Here, the INITALIZE UPDATE command is a command for notifying the eSE 5 of the start of mutual authentication processing for establishing a secure channel between the payment terminal 2 and the eSE 5. The INITALIZE UPDATE command includes a random number and a Key Version Number. The Key Version Number is data used to identify authentication data that is the basis of cryptographic calculations.

Next, when the relay device 3 receives the INITALIZE UPDATE command from the payment terminal 2, it transmits the INITALIZE UPDATE command to the ECU 4 (or eSE 5) (step S12). Next, when the control unit 44 of the ECU 4 receives the INITALIZE UPDATE command from the relay device 3 via the interface unit 41, it transmits the INITALIZE UPDATE command to the eSE 5 via the interface unit 42 (step S13).

Next, when the CPU 54 of the eSE 5 receives an INITALIZE UPDATE command from the ECU 4 (or the repeater 3) via the interface unit 51, it generates a random number, a session key, and ciphertext A (Card Cryptogram) in response to the INITALIZE UPDATE command (step S14). Here, the session key is an encryption key used in the secure channel, and is generated, for example, based on the random number included in the INITALIZE UPDATE command, the random number generated in step S14, and authentication data stored in the NVM 24. Next, the CPU 54 of the eSE 5 transmits a response including the random number and ciphertext A (Card Cryptogram) generated in step S14 to the ECU 4 (or the repeater 3) via the interface unit 51 (step S15).

Next, when the control unit 44 of the ECU 4 receives a response from the eSE 5 via the interface unit 42, it transmits the response to the repeater 3 via the interface unit 41 (step S16). Next, when the repeater 3 receives a response from the ECU 4 (or eSE 5), it transmits the response to the payment terminal 2 (step S17).

Next, when the processing unit 23 of the payment terminal 2 receives a response from the repeater 3 via the reader/writer 22, it generates a session key and ciphertext A (Card Cryptogram) in the same manner as eSE5 according to the authentication processing program (step S18). Next, the processing unit 23 of the payment terminal 2 verifies the legitimacy of eSE5 by comparing ciphertext A (Card Cryptogram) included in the response received from the repeater 3 with the ciphertext A (Card Cryptogram) generated in step S18 (step S19). Next, if the processing unit 23 of the payment terminal 2 successfully verifies the legitimacy of eSE5 (i.e., authentication is successful), it generates ciphertext B (Host Cryptogram) (step S20). Next, the processing unit 23 of the payment terminal 2 transmits an EXTERNAL AUTHENTICATE command including ciphertext B (Host Cryptogram) generated in step S20 to the repeater 3 via the reader/writer 22 (step S21). If validity verification fails (i.e., authentication fails), error handling will be performed.

Next, when the relay device 3 receives the EXTERNAL AUTHENTICATE command from the payment terminal 2, it transmits the EXTERNAL AUTHENTICATE command to the ECU 4 (or eSE 5) (step S22). Next, when the control unit 44 of the ECU 4 receives the EXTERNAL AUTHENTICATE command from the relay device 3 via the interface unit 41, it transmits the EXTERNAL AUTHENTICATE command to the eSE 5 via the interface unit 42 (step S23).

Next, when the CPU 54 of the eSE 5 receives the EXTERNAL AUTHENTICATE command from the ECU 4 (or the repeater 3) via the interface unit 51, it generates ciphertext B (Host Cryptogram) in response to the EXTERNAL AUTHENTICATE command in accordance with the authentication processing program in the same manner as the payment terminal 2 (step S24). Next, the CPU 54 of the eSE 5 verifies the legitimacy of the payment terminal 2 by comparing the ciphertext B (Host Cryptogram) included in the EXTERNAL AUTHENTICATE command with the ciphertext B (Host Cryptogram) generated in step S24 (step S25 ...
If the validity verification is successful (i.e., authentication is successful), a response indicating successful authentication is transmitted to the ECU 4 (or the relay 3) via the interface unit 51 (step S26). If the validity verification is unsuccessful (i.e., authentication is unsuccessful), an error process is performed.

Next, when the control unit 44 of the ECU 4 receives a response from the eSE 5 via the interface unit 42, it transmits the response to the repeater 3 via the interface unit 41 (step S27). Next, when the repeater 3 receives a response from the ECU 4 (or eSE 5), it transmits the response to the payment terminal 2 (step S28). Next, when the processing unit 23 of the payment terminal 2 receives a response from the repeater 3 via the reader/writer 22, it terminates the mutual authentication process with the eSE 5 (step S29). This establishes a secure channel between the payment terminal 2 and the eSE 5.

Next, in FIG. 7, when a secure session is initiated (step S31), the processing unit 23 of the payment terminal 2 encrypts the GET STATUS command, which indicates a request to obtain the installation status of the application in the ECU 4, with the session key, and transmits the encrypted GET STATUS command (hereinafter referred to as the "encrypted GET STATUS command") to the repeater 3 via the reader/writer 22 (step S32).

Next, when the repeater 3 receives the encrypted GET STATUS command from the payment terminal 2, it transmits the encrypted GET STATUS command to the ECU 4 (or eSE 5) (step S33). Next, when the control unit 44 of the ECU 4 receives the encrypted GET STATUS command from the repeater 3 via the interface unit 41, it transmits the encrypted GET STATUS command to the eSE 5 via the interface unit 42 (step S34).

Next, when the CPU 54 of the eSE 5 receives an encrypted GET STATUS command from the ECU 4 (or the repeater 3) via the interface unit 51, it decrypts the encrypted GET STATUS command using the session key and transmits the decrypted GET STATUS command to the ECU 4 via the interface unit 51 (step S35). Next, when the control unit 44 of the ECU 4 receives the GET STATUS command from the eSE 5, it reads the unique identification number and application list of the ECU 4 from the memory unit 43 in response to the GET STATUS command (step S36). Next, the control unit 44 of the ECU 4 transmits a response including the unique identification number and application list read in step S36 to the eSE 5 via the interface unit 42 (step S37).

Next, when the CPU 54 of the eSE 5 receives a response from the ECU 4 via the interface unit 51, it encrypts the response with the session key and transmits the encrypted response (hereinafter referred to as the "encrypted response") to the ECU 4 (or the repeater 3) via the interface unit 51 (step S38). Next, when the control unit 44 of the ECU 4 receives the encrypted response from the eSE 5 via the interface unit 42, it transmits the encrypted response to the repeater 3 via the interface unit 41 (step S39). Next, when the repeater 3 receives the encrypted response from the ECU 4 (or the eSE 5), it transmits the encrypted response to the payment terminal 2 (step S40).

Next, when the processing unit 23 of the payment terminal 2 receives the encrypted response from the repeater 3 via the reader/writer 22, it decrypts the encrypted response and obtains the unique identification number and application list from the decrypted response (step S41). Next, the processing unit 23 of the payment terminal 2 determines whether there are any applications to be added to the ECU 4 based on the unique identification number and application list obtained in step S41 (step S42).

In the determination of step S42, if a unique identification number (i.e., the unique identification number of a specific device) that matches the unique identification number obtained in step S41 is stored in the memory unit 43, and the identifier of the application associated with that unique identification number (i.e., the application identified by that unique identification number) is not shown (registered) in the application list, it is determined that an application to be added exists. In other words, the application to be added is an application identified by the unique identification number obtained in step S41 but whose identifier is not shown in the application list. If it is determined that an application to be added exists (step S42: YES), the application is identified and processing proceeds to step S43. If it is determined that the application does not exist (step S42: NO), processing proceeds to step S70.

In step S43, the processing unit 23 of the payment terminal 2 encrypts the LOAD (APPLICATION LOAD) command that provides the application identified in step S42 with the session key, and transmits the encrypted LOAD command (hereinafter referred to as the "encrypted LOAD command") to the repeater 3 via the reader/writer 22. The LOAD command, also known as the APPLICATION LOAD command, is a command for loading an application, and its data portion includes the application identified in step S42. However, if the size of the application exceeds the amount of data that can be transmitted at one time, the application is divided into multiple blocks (divided data), and each block is transmitted over multiple levels via the LOAD command.

Next, when the relay device 3 receives the encrypted LOAD command from the payment terminal 2, it transmits the encrypted LOAD command to the ECU 4 (or eSE 5) (step S44). Next, when the control unit 44 of the ECU 4 receives the encrypted LOAD command from the relay device 3 via the interface unit 41, it transmits the encrypted LOAD command to the eSE 5 via the interface unit 42 (step S45).

Next, when the CPU 54 of the eSE 5 receives an encrypted LOAD command from the ECU 4 (or the relay 3) via the interface unit 51, it decrypts the encrypted LOAD command using the session key and transmits the decrypted LOAD command to the ECU 4 via the interface unit 51 (step S46). Next, when the control unit 44 of the ECU 4 receives the LOAD command from the eSE 5, it acquires an application (payment processing program) from the LOAD command (step S47). The application (or block) is stored in RAM. Next, the control unit 44 of the ECU 4 transmits a response to the LOAD command to the eSE 5 via the interface unit 42 (step S48). Note that when an application is transmitted using multiple LOAD commands, the final response when acquisition of all blocks related to the application has been completed contains SW "9000" indicating normal completion, and the response when acquisition of all blocks has not yet been completed contains SW "91XX". Here, "XX" indicates the byte length of the next LOAD command.

Next, when the CPU 54 of the eSE 5 receives a response from the ECU 4 via the interface unit 51, it encrypts the response with the session key and transmits the encrypted response to the ECU 4 (or the repeater 3) via the interface unit 51 (step S49). Next, when the control unit 44 of the ECU 4 receives the encrypted response from the eSE 5 via the interface unit 42, it transmits the encrypted response to the repeater 3 via the interface unit 41 (step S50). Next, when the repeater 3 receives the encrypted response from the ECU 4 (or the eSE 5), it transmits the encrypted response to the payment terminal 2 (step S51).

Next, when the processing unit 23 of the payment terminal 2 receives the encrypted response from the repeater 3 via the reader/writer 22, it decrypts the encrypted response. Next, when transmission of the application is complete (for example, when transmission of all blocks related to the application is complete), the processing unit 23 of the payment terminal 2 encrypts the INSTALL command that installs the loaded application with the session key, and transmits the encrypted INSTALL command (hereinafter referred to as the "encrypted INSTALL command") to the repeater 3 via the reader/writer 22, as shown in FIG. 8 (step S52).

Next, when the repeater 3 receives the encrypted INSTALL command from the payment terminal 2, it transmits the encrypted INSTALL command to the ECU 4 (or eSE 5) (step S53). Next, when the control unit 44 of the ECU 4 receives the encrypted INSTALL command from the repeater 3 via the interface unit 41, it transmits the encrypted INSTALL command to the eSE 5 via the interface unit 42 (step S54).

Next, when the CPU 54 of the eSE 5 receives the encrypted INSTALL command from the ECU 4 (or the relay 3) via the interface unit 51, it decrypts the encrypted INSTALL command with the session key and transmits the decrypted INSTALL command to the ECU 4 via the interface unit 51 (step S55). Next, when the control unit 44 of the ECU 4 receives the INSTALL command from the eSE 5, it installs the acquired application in accordance with the INSTALL command (step S56). When installation of the application is complete, the control unit 44 of the ECU 4 transmits a response indicating successful completion to the eSE 5 via the interface unit 42 (step S57). Note that if the application is not installed successfully, the control unit 44 of the ECU 4 performs rollback processing.

Next, when the CPU 54 of the eSE 5 receives a response from the ECU 4 via the interface unit 51, it encrypts the response with the session key and transmits the encrypted response to the ECU 4 (or the repeater 3) via the interface unit 51 (step S58). Next, when the control unit 44 of the ECU 4 receives the encrypted response from the eSE 5 via the interface unit 42, it transmits the encrypted response to the repeater 3 via the interface unit 41 (step S59). Next, when the repeater 3 receives the encrypted response from the ECU 4 (or the eSE 5), it transmits the encrypted response to the payment terminal 2 (step S60).

Next, when the processing unit 23 of the payment terminal 2 receives the encrypted response from the repeater 3 via the reader/writer 22, it decrypts the encrypted response. Next, the processing unit 23 of the payment terminal 2 encrypts a SELECT command that selects an application (payment processing program) for performing payment processing using the session key, and transmits the encrypted SELECT command to the repeater 3 via the reader/writer 22 (step S61). This SELECT command includes the identifier (AID) of the application to be selected.

Next, when the repeater 3 receives the encrypted SELECT command from the payment terminal 2, it transmits the encrypted SELECT command to the ECU 4 (or eSE 5) (step S62). Next, when the control unit 44 of the ECU 4 receives the encrypted SELECT command from the repeater 3 via the interface unit 41, it transmits the encrypted SELECT command to the eSE 5 via the interface unit 42 (step S63).

Next, when the CPU 54 of the eSE 5 receives the encrypted SELECT command from the ECU 4 (or the repeater 3) via the interface unit 51, it decrypts the encrypted SELECT command with the session key and transmits the decrypted SELECT command to the ECU 4 via the interface unit 51 (step S64). Next, when the control unit 44 of the ECU 4 receives the SELECT command from the eSE 5, it selects an application (payment processing program) in accordance with the SELECT command (step S65). Next, the control unit 44 of the ECU 4 transmits a response to the SELECT command to the eSE 5 via the interface unit 42 (step S66).

Next, when the CPU 54 of the eSE 5 receives a response from the ECU 4 via the interface unit 51, it encrypts the response with the session key and transmits the encrypted response to the ECU 4 (or the repeater 3) via the interface unit 51 (step S67). Next, when the control unit 44 of the ECU 4 receives the encrypted response from the eSE 5 via the interface unit 42, it transmits the encrypted response to the repeater 3 via the interface unit 41 (step S68). Next, when the repeater 3 receives the encrypted response from the ECU 4 (or the eSE 5), it transmits the encrypted response to the payment terminal 2 (step S69).

Next, when the processing unit 23 of the payment terminal 2 receives the encrypted response from the repeater 3 via the reader/writer 22, it decrypts the encrypted response and proceeds to step S70. In step S70, the processing unit 23 of the payment terminal 2 encrypts a GET DATA command indicating a request to obtain payment data with the session key, and transmits the encrypted GET DATA command to the repeater 3 via the reader/writer 22.

Next, when the repeater 3 receives the encrypted GET DATA command from the payment terminal 2, it transmits the encrypted GET DATA command to the ECU 4 (or eSE 5) (step S71). Next, when the control unit 44 of the ECU 4 receives the encrypted GET DATA command from the repeater 3 via the interface unit 41, it transmits the encrypted GET DATA command to the eSE 5 via the interface unit 42 (step S72).

Next, when the CPU 54 of the eSE 5 receives an encrypted GET DATA command from the ECU 4 (or the repeater 3) via the interface unit 51, it decrypts the encrypted GET DATA command using the session key and transmits the decrypted GET DATA command to the ECU 4 via the interface unit 51 (step S73). Next, when the control unit 44 of the ECU 4 receives the GET DATA command from the eSE 5, it reads payment data from the memory unit 43 using the selected application (payment processing program) in response to the GET DATA command (step S74). Next, the control unit 44 of the ECU 4 transmits a response including the payment data read in step S74 to the eSE 5 via the interface unit 42 (step S75).

Next, when the CPU 54 of the eSE 5 receives a response from the ECU 4 via the interface unit 51, it encrypts the response with the session key and transmits the encrypted response to the ECU 4 (or the repeater 3) via the interface unit 51 (step S76). Next, when the control unit 44 of the ECU 4 receives the encrypted response from the eSE 5 via the interface unit 42, it transmits the encrypted response to the repeater 3 via the interface unit 41 (step S77). Next, when the repeater 3 receives the encrypted response from the ECU 4 (or the eSE 5), it transmits the encrypted response to the payment terminal 2 (step S78).

Next, when the processing unit 23 of the payment terminal 2 receives the encrypted response from the repeater 3 via the reader/writer 22, the processing unit 23 decrypts the encrypted response and executes payment for the fee based on the payment data included in the decrypted response (step S79). For example, the processing unit 23 of the payment terminal 2 executes a process of charging (e.g., debiting) the parking fee to the user using the payment method specified by the payment data.

In the above example, the payment terminal 2 is configured to obtain the unique identification number and application list from the ECU 4 and determine whether there is an application to add. Alternatively, the ECU 4 may obtain the unique identification number of a specific device and the identifier of a specific application from the payment terminal 2 via the repeater 3 or the like, and determine whether the unique identification number of the specific device matches the unique identification number stored in the memory unit 43 and whether the identifier of the specific application is listed in the application list. If the ECU 4 determines that the two unique identification numbers match and that the identifier of the specific application is listed in the application list, it may obtain the specific application by sending a request for the specific application to the payment terminal 2 via the repeater 3.

In addition, while the above example describes the case of adding an application that is not listed in the application list of the ECU 4, it is also applicable to the case of adding an application that is not listed in the application list of the eSE 5. In this case, the eSE 5 transmits its unique identification number and application list to the payment terminal 2. Then, if the payment terminal 2 determines, based on the unique identification number and application list, that there is an application that should be added to the eSE 5, it provides the application to the eSE 5 and causes the application to be installed on the eSE 5.

As described above, according to the above embodiment, an electronic device such as an ECU 4 stores its own unique identification number and application list, and after authentication processing is completed between the payment terminal 2 and the electronic device, it is configured to obtain from the payment terminal 2 via the repeater 3 an application identified by the stored unique identification number and whose identifier is not shown in the application list, and install the obtained application. This allows applications to be added to an electronic device in vehicle C more efficiently. This embodiment is particularly effective in cases where vehicle C is not equipped with a device capable of connecting to a mobile communications network having a base station for wireless communication, or where vehicle C is equipped with a device capable of connecting to such a mobile communications network but is located in an area where radio waves from the base station cannot reach.

In the above embodiment, a payment processing program was used as an example of an application to be added, but this is not limited to this and other applications required for using various services may also be used. While the ECU 4 was used as an example of the electronic device of the present invention, it may also be an electronic device of a passenger in vehicle C. In this case, the electronic device stores a unique identification number specific to the electronic device and a list indicating the identifiers of applications installed on the electronic device. The electronic device then performs the authentication process as described above by communicating with the payment terminal 2 via the repeater 3. After the authentication process is complete, the electronic device obtains from the payment terminal 2 via the repeater 3 an application identified by the stored unique identification number but whose identifier is not shown in the application list, and installs the obtained application.

1 Management server 2 Payment terminal 3 Relay 4 ECU
5 eSE
21 Memory unit 22 Reader/writer 23 Processing unit 21 Antenna 41 Interface unit 42 Interface unit 43 Memory unit 44 Control unit 51 Interface unit 52 RAM
53 NVM
54 CPU
S Payment processing system

Claims (8)

An electronic device capable of communicating with an external device installed outside a mobile body via a relay device mounted on the mobile body,
a storage means for storing a list indicating the unique identification number of the electronic device and the identifiers of applications installed on the electronic device;
an authentication unit that executes an authentication process between the relay device and the external device;
an acquisition means for acquiring, after the authentication process is completed, from the external device via the relay device, an application identified by the unique identification number stored in the storage means and whose identifier is not shown in the list;
an installation means for installing the application acquired by the acquisition means;
Equipped with
The electronic device is characterized in that the acquisition means acquires a specific unique identification number and an identifier of a specific application from the external device via the relay device, and if the specific unique identification number matches the unique identification number stored in the memory means and the identifier of the specific application is not shown in the list, the electronic device acquires the application from the external device via the relay device by sending a request for the application to the external device via the relay device . An electronic device capable of communicating with an external device installed outside a mobile body via a relay device mounted on the mobile body,
a storage means for storing a list indicating the unique identification number of the electronic device and the identifiers of applications installed on the electronic device;
an authentication unit that executes an authentication process between the relay device and the external device;
an acquisition means for acquiring, after the authentication process is completed, from the external device via the relay device, an application identified by the unique identification number stored in the storage means and whose identifier is not shown in the list;
an installation means for installing the application acquired by the acquisition means;
Equipped with
the electronic device is configured by a secure element and an ECU (Electronic Control Unit) mounted on the mobile object,
the secure element includes the authentication means and the acquisition means, and the acquisition means acquires the application encrypted with a session key that is generated in the authentication process and is common to the external device, and decrypts the application with the session key;
The electronic device is characterized in that the ECU includes the storage means and the installation means, and the installation means installs the decrypted application. The electronic device according to claim 1 or 2, characterized in that the acquisition means acquires the application from the external device via the relay device by transmitting the unique identification number and the list to the external device via the relay device. A terminal device capable of communicating with an electronic device installed in a mobile body or an electronic device carried by a passenger of the mobile body via a relay device mounted on the mobile body,
the electronic device stores a unique identification number of the electronic device and a list indicating identifiers of applications installed on the electronic device;
The terminal device
an authentication unit that performs an authentication process between the electronic device and the relay device;
an acquisition means for acquiring the unique identification number and the list from the electronic device via the relay device after the authentication process is completed;
a transmitting means for transmitting, via the relay device, an application identified by the unique identification number acquired by the acquiring means and whose identifier is not shown in the list;
A terminal device comprising: 1. A method for adding an application executed by an electronic device capable of communicating with an external device installed outside a mobile object via a relay device mounted on the mobile object, the method comprising:
storing in a storage means a list indicating the unique identification number of the electronic device and identifiers of applications installed on the electronic device;
performing an authentication process between the relay device and the external device via the relay device;
an acquisition step of acquiring, after the authentication process is completed, from the external device via the relay device, an application identified by the unique identification number stored in the storage means and whose identifier is not shown in the list;
installing the obtained application;
Including,
In the acquisition step, a specific unique identification number and an identifier of a specific application are acquired from the external device via the relay device, and if the specific unique identification number matches the unique identification number stored in the memory means and the identifier of the specific application is not shown in the list, a request for the application is sent to the external device via the relay device, thereby acquiring the application from the external device via the relay device . 1. A method for adding an application executed by an electronic device capable of communicating with an external device installed outside a mobile body via a relay device mounted on the mobile body, the electronic device including a secure element mounted on the mobile body and an ECU (Electronic Control Unit),
a step of the ECU storing in a storage means a list indicating the unique identification number of the electronic device and identifiers of applications installed on the electronic device;
a step of performing an authentication process between the secure element and the external device via the relay device;
an acquisition step in which the secure element acquires, after the authentication process is completed, from the external device via the relay device, an application identified by the unique identification number stored in the storage means and whose identifier is not shown in the list;
an installation step in which the ECU installs the acquired application;
Including,
In the obtaining step, the application encrypted with a session key generated in the authentication process and shared with the external device is obtained, and the application is decrypted with the session key;
In the installing step, the decrypted application is installed. A computer included in an electronic device capable of communicating with an external device installed outside a mobile body via a relay device mounted on the mobile body,
a storage means for storing a list indicating the unique identification number of the electronic device and the identifiers of applications installed on the electronic device;
an authentication unit that executes an authentication process between the relay device and the external device;
an acquisition means for acquiring, after the authentication process is completed, from the external device via the relay device, an application identified by the unique identification number stored in the storage means and whose identifier is not shown in the list;
a program that functions as an installation unit that installs the application acquired by the acquisition unit,
The acquisition means acquires a specific unique identification number and an identifier of a specific application from the external device via the relay device, and if the specific unique identification number matches the unique identification number stored in the storage means and the identifier of the specific application is not shown in the list, the program acquires the application from the external device via the relay device by sending a request for the application to the external device via the relay device . An electronic device capable of communicating with an external device installed outside a mobile body via a relay device mounted on the mobile body, the electronic device being configured with a secure element mounted on the mobile body and an ECU (Electronic Control Unit),
a storage means for storing a list indicating the unique identification number of the electronic device and the identifiers of applications installed on the electronic device;
an authentication unit that executes an authentication process between the relay device and the external device;
an acquisition means for acquiring, after the authentication process is completed, from the external device via the relay device, an application identified by the unique identification number stored in the storage means and whose identifier is not shown in the list;
a program that functions as an installation unit that installs the application acquired by the acquisition unit,
the acquisition means acquires the application encrypted with a session key that is generated in the authentication process and is common to the external device, and decrypts the application with the session key;
The program is characterized in that the installation means installs the decrypted application.