In-vehicle computer system, vehicle, key generation device, management method, key generation method, and computer program

A management method for use in an in-vehicle computer system provided in a vehicle, the management method comprising:

• a message authentication code generation step;
• an authentication step;
• a MASTER_ECU_KEY (MEK) key generation step;
• a first transmission step;
• a key exchange key registration step;
• a second transmission step;
• and
• a message authentication code (MAC) key registration step,
• wherein the in-vehicle computer system includes:
• a first in-vehicle computer including a first arithmetic processing device, a hardware security module (HSM), and a first storage;
• and
• a second in-vehicle computer including a second arithmetic processing device, a secure hardware extension (SHE), and a second storage,
• wherein the first in-vehicle computer and the second in-vehicle computer are connected to a communication network provided in the vehicle,
• wherein an initial key is set to a KEY_N key usable in a generation process and a verification process for a message authentication code in the SHE,
• wherein, in the message authentication code generation step, the first arithmetic processing device causes the message authentication code for an identifier of the second in-vehicle computer received from the second in-vehicle computer to be generated through a secure element storing a master key used together with the identifier of the second in-vehicle computer for generating the message authentication code to be used as the initial key,
• wherein, in the authentication step, the first arithmetic processing device causes the secure element to execute a process of authenticating validity of the second in-vehicle computer using the generated message authentication code,
• wherein, in the MEK key generation step, the first arithmetic processing device causes a MEK key of the SHE to be generated using the master key through the secure element,
• wherein, in the first transmission step, the first arithmetic processing device causes a key registration message for registering a key exchange key in another KEY_N key usable in an encryption process and a decryption process of the SHE or the KEY_N key usable in the generation process and the verification process for the message authentication code of the SHE to be generated using the MEK key through the secure element and transmits the key registration message to the second in-vehicle computer,
• wherein, in the key exchange key registration step, the second arithmetic processing device registers the key exchange key in the SHE according to the key registration message,
• wherein, in the second transmission step, the first arithmetic processing device causes a key registration message for registering a MAC key in a RAM_KEY key of the SHE to be generated using the key exchange key through the HSM and transmits the key registration message to the second in-vehicle computer, and
• wherein, in the MAC key registration step, the second arithmetic processing device registers the MAC key in the SHE according to the key registration message.

An in-vehicle computer system provided in a vehicle, the in-vehicle computer system comprising:

• a first in-vehicle computer including a first arithmetic processing device, a hardware security module (HSM), and a first storage;
• and
• a second in-vehicle computer including a second arithmetic processing device, a secure hardware extension (SHE), and a second storage,
• wherein the first in-vehicle computer and the second in-vehicle computer are connected to a communication network provided in the vehicle,
• wherein an initial key is set to a KEY_N key usable in a generation process and a verification process for a message authentication code in the SHE,
• wherein a master key is stored in the HSM, the master key being used together with an identifier of the second in-vehicle computer for generating the message authentication code to be used as the initial key,
• wherein the first arithmetic processing device is configured to cause the message authentication code for the identifier of the second in-vehicle computer received from the second in-vehicle computer to be generated using the master key through the HSM,
• wherein the first arithmetic processing device is further configured to execute a process of authenticating validity of the second in-vehicle computer by using the generated message authentication code,
• wherein the first arithmetic processing device is further configured to cause a MASTER_ECU_KEY (MEK) key of the SHE to be generated using the master key through the HSM,
• wherein the first arithmetic processing device is further configured to cause a key registration message for registering a key exchange key in another KEY_N key usable in an encryption process and a decryption process of the SHE or the KEY_N key usable in the generation process and the verification process for the message authentication code of the SHE to be generated using the MEK key through the HSM and transmit the key registration message to the second in-vehicle computer,
• wherein the second arithmetic processing device is configured to register the key exchange key in the SHE according to the key registration message,
• wherein the first arithmetic processing device is further configured to cause a key registration message for registering a message authentication code (MAC) key in a RAM_KEY key of the SHE to be generated using the key exchange key through the HSM and transmit the key registration message to the second in-vehicle computer, and
• wherein the second arithmetic processing device is further configured to register the MAC key in the SHE according to the key registration message.

An in-vehicle computer system provided in a vehicle, the in-vehicle computer system comprising:

• a first in-vehicle computer including a first arithmetic processing device, a first secure hardware extension (SHE), and a first storage;
• and
• a second in-vehicle computer including a second arithmetic processing device, a second SHE, and a second storage,
• wherein the first in-vehicle computer and the second in-vehicle computer are connected to a communication network provided in the vehicle,
• wherein an initial key is set to a KEY_N key usable in a generation process and a verification process for a message authentication code in the second SHE,
• wherein the first arithmetic processing device is configured to cause the message authentication code for an identifier of the second in-vehicle computer received from the second in-vehicle computer to be generated through a secure element storing a master key used together with the identifier of the second in-vehicle computer for generating the message authentication code to be used as the initial key,
• wherein the first arithmetic processing device is further configured to cause the secure element to execute a process of authenticating validity of the second in-vehicle computer using the generated message authentication code,
• wherein the first arithmetic processing device is further configured to cause a MASTER_ECU_KEY (MEK) key of the second SHE to be generated using the master key through the secure element,
• wherein the first arithmetic processing device is further configured to cause a key registration message for registering a key exchange key in another KEY_N key usable in an encryption process and a decryption process of the second SHE or the KEY_N key usable in the generation process and the verification process for the message authentication code of the second SHE to be generated using the MEK key through the secure element and transmit the key registration message to the second in-vehicle computer,
• wherein the second arithmetic processing device is configured to register the key exchange key in the second SHE according to the key registration message,
• wherein the first arithmetic processing device is further configured to cause a key registration message for registering a message authentication code (MAC) key in a RAM_KEY key of the second SHE to be generated using the key exchange key through the first SHE and transmit the key registration message to the second in-vehicle computer, and
• wherein the second arithmetic processing device is further configured to register the MAC key in the second SHE according to the key registration message.

An in-vehicle computer system provided in a vehicle, the in-vehicle computer system comprising:

• a first in-vehicle computer including a first arithmetic processing device, a hardware security module (HSM), and a first storage;
• and
• a second in-vehicle computer including a second arithmetic processing device, a secure hardware extension (SHE), and a second storage,
• wherein the first in-vehicle computer and the second in-vehicle computer are connected to a communication network provided in the vehicle,
• wherein an initial key is set to a KEY_N key usable in a generation process and a verification process for a message authentication code in the SHE,
• wherein the first arithmetic processing device is configured to cause the message authentication code for an identifier of the second in-vehicle computer received from the second in-vehicle computer to be generated through a secure element storing a master key used together with the identifier of the second in-vehicle computer for generating the message authentication code to be used as the initial key,
• wherein the first arithmetic processing device is further configured to cause the secure element to execute a process of authenticating validity of the second in-vehicle computer using the generated message authentication code,
• wherein the first arithmetic processing device is further configured to cause a MASTER_ECU_KEY (MEK) key of the SHE to be generated using the master key through the secure element,
• wherein the first arithmetic processing device is further configured to cause a key registration message for registering a key exchange key in another KEY_N key usable in an encryption process and a decryption process of the SHE or the KEY_N key usable in the generation process and the verification process for the message authentication code of the SHE to be generated using the MEK key through the secure element and transmit the key registration message to the second in-vehicle computer,
• wherein the second arithmetic processing device is configured to register the key exchange key in the SHE according to the key registration message,
• wherein the first arithmetic processing device is further configured to cause a key registration message for registering a message authentication code (MAC) key in a RAM_KEY key of the SHE to be generated using the key exchange key through the HSM and transmit the key registration message to the second in-vehicle computer, and
• wherein the second arithmetic processing device is further configured to register the MAC key in the SHE according to the key registration message.

A management method for use in an in-vehicle computer system provided in a vehicle, the management method comprising:

• a message authentication code generation step;
• an authentication step;
• a MASTER_ECU_KEY (MEK) key generation step;
• a first transmission step;
• a key exchange key registration step;
• a second transmission step;
• and
• a message authentication code (MAC) key registration step,
• wherein the in-vehicle computer system includes:
• a first in-vehicle computer including a first arithmetic processing device, a first secure hardware extension (SHE), and a first storage;
• and
• a second in-vehicle computer including a second arithmetic processing device, a second SHE, and a second storage,
• wherein the first in-vehicle computer and the second in-vehicle computer are connected to a communication network provided in the vehicle,
• wherein an initial key is set to a KEY_N key usable in a generation process and a verification process for a message authentication code in the second SHE,
• wherein a master key is set to a KEY_N key usable in the generation process and the verification process for the message authentication code in the first SHE, the master key being used together with an identifier of the second in-vehicle computer for generating the message authentication code to be used as the initial key,
• wherein, in the message authentication code generation step, the first arithmetic processing device causes the message authentication code for the identifier of the second in-vehicle computer received from the second in-vehicle computer to be generated using the master key through the first SHE,
• wherein, in the authentication step, the first arithmetic processing device executes a process of authenticating validity of the second in-vehicle computer by using the generated message authentication code,
• wherein, in the MEK key generation step, the first arithmetic processing device causes a MEM key of the second SHE to be generated using the master key through the first SHE,
• wherein, in the first transmission step, the first arithmetic processing device causes a key registration message for registering a key exchange key in another KEY_N key usable in an encryption process and a decryption process of the second SHE or the KEY_N key usable in the generation process and the verification process for the message authentication code of the second SHE to be generated using the MEK key through the first SHE and transmits the key registration message to the second in-vehicle computer,
• wherein, in the key exchange key registration step, the second arithmetic processing device registers the key exchange key in the second SHE according to the key registration message,
• wherein, in the second transmission step, the first arithmetic processing device causes a key registration message for registering a MAC key in a RAM_KEY key of the second SHE to be generated using the key exchange key through the first SHE and transmits the key registration message to the second in-vehicle computer, and
• wherein, in the MAC key registration step, the second arithmetic processing device registers the MAC key in the second SHE according to the key registration message.

A management method for use in an in-vehicle computer system provided in a vehicle, the management method comprising:

• a message authentication code generation step;
• an authentication step;
• a MASTER_ECU_KEY (MEK) key generation step;
• a first transmission step;
• a key exchange key registration step;
• a second transmission step;
• and
• a message authentication code (MAC) key registration step,
• wherein the in-vehicle computer system includes:
• a first in-vehicle computer including a first arithmetic processing device, a hardware security module (HSM), and a first storage;
• and
• a second in-vehicle computer including a second arithmetic processing device, a secure hardware extension (SHE), and a second storage,
• wherein the first in-vehicle computer and the second in-vehicle computer are connected to a communication network provided in the vehicle,
• wherein an initial key is set to a KEY_N key usable in a generation process and a verification process for a message authentication code in the SHE,
• wherein a master key is stored in the HSM, the master key being used together with an identifier of the second in-vehicle computer for generating the message authentication code to be used as the initial key,
• wherein, in the message authentication code generation step, the first arithmetic processing device causes the message authentication code for the identifier of the second in-vehicle computer received from the second in-vehicle computer to be generated using the master key through the HSM,
• wherein, in the authentication step, the first arithmetic processing device executes a process of authenticating validity of the second in-vehicle computer by using the generated message authentication code,
• wherein, in the MEK key generation step, the first arithmetic processing device causes a MEK key of the SHE to be generated using the master key through the HSM,
• wherein, in the first transmission step, the first arithmetic processing device causes a key registration message for registering a key exchange key in another KEY_N key usable in an encryption process and a decryption process of the SHE or the KEY_N key usable in the generation process and the verification process for the message authentication code of the SHE to be generated using the MEK key through the HSM and transmits the key registration message to the second in-vehicle computer,
• wherein, in the key exchange key registration step, the second arithmetic processing device registers the key exchange key in the SHE according to the key registration message,
• wherein, in the second transmission step, the first arithmetic processing device causes a key registration message for registering a message authentication code (MAC) key in a RAM_KEY key of the SHE to be generated using the key exchange key through the HSM and transmits the key registration message to the second in-vehicle computer, and
• wherein, in the MAC key registration step, the second arithmetic processing device registers the MAC key in the SHE according to the key registration message.

A management method for use in an in-vehicle computer system provided in a vehicle, the management method comprising:

• a message authentication code generation step;
• an authentication step;
• a MASTER_ECU_KEY (MEK) key generation step;
• a first transmission step;
• a key exchange key registration step;
• a second transmission step;
• and
• a message authentication code (MAC) key registration step,
• wherein the in-vehicle computer system includes:
• a first in-vehicle computer including a first arithmetic processing device, a first secure hardware extension (SHE), and a first storage;
• and
• a second in-vehicle computer including a second arithmetic processing device, a second SHE, and a second storage,
• wherein the first in-vehicle computer and the second in-vehicle computer are connected to a communication network provided in the vehicle,
• wherein an initial key is set to a KEY_N key usable in a generation process and a verification process for a message authentication code in the second SHE,
• wherein, in the message authentication code generation step, the first arithmetic processing device causes the message authentication code for an identifier of the second in-vehicle computer received from the second in-vehicle computer to be generated through a secure element storing a master key used together with the identifier of the second in-vehicle computer for generating the message authentication code to be used as the initial key,
• wherein, in the authentication step, the first arithmetic processing device causes the secure element to execute a process of authenticating validity of the second in-vehicle computer using the generated message authentication code,
• wherein, in the MEK key generation step, the first arithmetic processing device causes a MEK key of the second SHE to be generated using the master key through the secure element,
• wherein, in the first transmission step, the first arithmetic processing device causes a key registration message for registering a key exchange key in another KEY_N key usable in an encryption process and a decryption process of the second SHE or the KEY_N key usable in the generation process and the verification process for the message authentication code of the second SHE to be generated using the MEK key through the secure element and transmits the key registration message to the second in-vehicle computer,
• wherein, in the key exchange key registration step, the second arithmetic processing device registers the key exchange key in the second SHE according to the key registration message,
• wherein, in the second transmission step, the first arithmetic processing device causes a key registration message for registering a MAC key in a RAM_KEY key of the second SHE to be generated using the key exchange key through the first SHE and transmits the key registration message to the second in-vehicle computer, and
• wherein, in the MAC key registration step the second arithmetic processing device registers the MAC key in the second SHE according to the key registration message.

A non-transitory computer-readable recording medium having a computer program for causing a computer serving as a first arithmetic processing device of an in-vehicle computer system provided in a vehicle to execute:

• a message authentication code generation step;
• an authentication step;
• a MASTER_ECU_KEY (MEK) key generation step;
• a first transmission step;
• a key exchange key registration step;
• a second transmission step;
• and
• a message authentication code (MAC) key registration step,
• wherein the in-vehicle computer system includes:
• a first in-vehicle computer including the first arithmetic processing device, a first secure hardware extension (SHE), and a first storage;
• and
• a second in-vehicle computer including a second arithmetic processing device, a second SHE, and a second storage,
• wherein the first in-vehicle computer and the second in-vehicle computer are connected to a communication network provided in the vehicle,
• wherein an initial key is set to a KEY_N key usable in a generation process and a verification process for a message authentication code in the second SHE,
• wherein a master key is set to a KEY_N key usable in the generation process and the verification process for the message authentication code in the first SHE, the master key being used together with an identifier of the second in-vehicle computer for generating the message authentication code to be used as the initial key,
• wherein, in the message authentication code generation step, the first arithmetic processing device causes the message authentication code for the identifier of the second in-vehicle computer received from the second in-vehicle computer to be generated using the master key through the first SHE,
• wherein, in the authentication step, the first arithmetic processing device executes a process of authenticating validity of the second in-vehicle computer by using the generated message authentication code,
• wherein, in the MEK key generation step, the first arithmetic processing device causes a MEM key of the second SHE to be generated using the master key through the first SHE,
• wherein, in the first transmission step, the first arithmetic processing device causes a key registration message for registering a key exchange key in another KEY_N key usable in an encryption process and a decryption process of the second SHE or the KEY_N key usable in the generation process and the verification process for the message authentication code of the second SHE to be generated using the MEK key through the first SHE and transmits the key registration message to the second in-vehicle computer,
• wherein, in the key exchange key registration step, the second arithmetic processing device registers the key exchange key in the second SHE according to the key registration message,
• wherein, in the second transmission step, the first arithmetic processing device causes a key registration message for registering a MAC key in a RAM_KEY key of the second SHE to be generated using the key exchange key through the first SHE and transmits the key registration message to the second in-vehicle computer, and
• wherein, in the MAC key registration step, the second arithmetic processing device registers the MAC key in the second SHE according to the key registration message.

A non-transitory computer-readable recording medium having a computer program for causing a computer serving as a first arithmetic processing device of an in-vehicle computer system provided in a vehicle to execute:

• a message authentication code generation step;
• an authentication step;
• a MASTER_ECU_KEY (MEK) key generation step;
• a first transmission step;
• a key exchange key registration step;
• a second transmission step;
• and
• a message authentication code (MAC) key registration step,
• wherein the in-vehicle computer system includes:
• a first in-vehicle computer including the first arithmetic processing device, a hardware security module (HSM), and a first storage;
• and
• a second in-vehicle computer including a second arithmetic processing device, a secure hardware extension (SHE), and a second storage,
• wherein the first in-vehicle computer and the second in-vehicle computer are connected to a communication network provided in the vehicle,
• wherein an initial key is set to a KEY_N key usable in a generation process and a verification process for a message authentication code in the SHE,
• wherein a master key is stored in the HSM, the master key being used together with an identifier of the second in-vehicle computer for generating the message authentication code to be used as the initial key,
• wherein, in the message authentication code generation step, the first arithmetic processing device causes the message authentication code for the identifier of the second in-vehicle computer received from the second in-vehicle computer to be generated using the master key through the HSM,
• wherein, in the authentication step, the first arithmetic processing device executes a process of authenticating validity of the second in-vehicle computer by using the generated message authentication code,
• wherein, in the MEK key generation step, the first arithmetic processing device causes a MEK key of the SHE to be generated using the master key through the HSM,
• wherein, in the first transmission step, the first arithmetic processing device causes a key registration message for registering a key exchange key in another KEY_N key usable in an encryption process and a decryption process of the SHE or the KEY_N key usable in the generation process and the verification process for the message authentication code of the SHE to be generated using the MEK key through the HSM and transmits the key registration message to the second in-vehicle computer,
• wherein, in the key exchange key registration step, the second arithmetic processing device registers the key exchange key in the SHE according to the key registration message,
• wherein, in the second transmission step, the first arithmetic processing device causes a key registration message for registering a message authentication code (MAC) key in a RAM_KEY key of the SHE to be generated using the key exchange key through the HSM and transmits the key registration message to the second in-vehicle computer, and
• wherein, in the MAC key registration step, the second arithmetic processing device registers the MAC key in the SHE according to the key registration message.

A non-transitory computer-readable recording medium having a computer program for causing a computer serving as a first arithmetic processing device of an in-vehicle computer system provided in a vehicle to execute:

• a message authentication code generation step;
• an authentication step;
• a MASTER_ECU_KEY (MEK) key generation step;
• a first transmission step;
• a key exchange key registration step;
• a second transmission step;
• and
• a message authentication code (MAC) key registration step,
• wherein the in-vehicle computer system includes:
• a first in-vehicle computer including the first arithmetic processing device, a first secure hardware extension (SHE), and a first storage;
• and
• a second in-vehicle computer including a second arithmetic processing device, a second SHE, and a second storage,
• wherein the first in-vehicle computer and the second in-vehicle computer are connected to a communication network provided in the vehicle,
• wherein an initial key is set to a KEY_N key usable in a generation process and a verification process for a message authentication code in the second SHE,
• wherein, in the message authentication code generation step, the first arithmetic processing device causes the message authentication code for an identifier of the second in-vehicle computer received from the second in-vehicle computer to be generated through a secure element storing a master key used together with the identifier of the second in-vehicle computer for generating the message authentication code to be used as the initial key,
• wherein, in the authentication step, the first arithmetic processing device causes the secure element to execute a process of authenticating validity of the second in-vehicle computer using the generated message authentication code,
• wherein, in the MEK key generation step, the first arithmetic processing device causes a MEK key of the second SHE to be generated using the master key through the secure element,
• wherein, in the first transmission step, the first arithmetic processing device causes a key registration message for registering a key exchange key in another KEY_N key usable in an encryption process and a decryption process of the second SHE or the KEY_N key usable in the generation process and the verification process for the message authentication code of the second SHE to be generated using the MEK key through the secure element and transmits the key registration message to the second in-vehicle computer,
• wherein, in the key exchange key registration step, the second arithmetic processing device registers the key exchange key in the second SHE according to the key registration message,
• wherein, in the second transmission step, the first arithmetic processing device causes a key registration message for registering a MAC key in a RAM_KEY key of the second SHE to be generated using the key exchange key through the first SHE and transmits the key registration message to the second in-vehicle computer, and
• wherein, in the MAC key registration step the second arithmetic processing device registers the MAC key in the second SHE according to the key registration message.

A non-transitory computer-readable recording having a computer program for causing a computer serving as a first arithmetic processing device of an in-vehicle computer system provided in a vehicle to execute:

• a message authentication code generation step;
• an authentication step;
• a MASTER_ECU_KEY (MEK) key generation step;
• a first transmission step;
• a key exchange key registration step;
• a second transmission step;
• and
• a message authentication code (MAC) key registration step,
• wherein the in-vehicle computer system includes:
• a first in-vehicle computer including the first arithmetic processing device, a hardware security module (HSM), and a first storage;
• and
• a second in-vehicle computer including a second arithmetic processing device, a secure hardware extension (SHE), and a second storage,
• wherein the first in-vehicle computer and the second in-vehicle computer are connected to a communication network provided in the vehicle,
• wherein an initial key is set to a KEY_N key usable in a generation process and a verification process for a message authentication code in the SHE,
• wherein, in the message authentication code generation step, the first arithmetic processing device causes the message authentication code for an identifier of the second in-vehicle computer received from the second in-vehicle computer to be generated through a secure element storing a master key used together with the identifier of the second in-vehicle computer for generating the message authentication code to be used as the initial key,
• wherein, in the authentication step, the first arithmetic processing device causes the secure element to execute a process of authenticating validity of the second in-vehicle computer using the generated message authentication code,
• wherein, in the MEK key generation step, the first arithmetic processing device causes a MEK key of the SHE to be generated using the master key through the secure element,
• wherein, in the first transmission step, the first arithmetic processing device causes a key registration message for registering a key exchange key in another KEY_N key usable in an encryption process and a decryption process of the SHE or the KEY_N key usable in the generation process and the verification process for the message authentication code of the SHE to be generated using the MEK key through the secure element and transmits the key registration message to the second in-vehicle computer,
• wherein, in the key exchange key registration step, the second arithmetic processing device registers the key exchange key in the SHE according to the key registration message,
• wherein, in the second transmission step, the first arithmetic processing device causes a key registration message for registering a MAC key in a RAM_KEY key of the SHE to be generated using the key exchange key through the HSM and transmits the key registration message to the second in-vehicle computer, and
• wherein, in the MAC key registration step, the second arithmetic processing device registers the MAC key in the SHE according to the key registration message.