Security device, vehicle authentication device, method and program

• US 7,868,736 B2
• Filed: 07/25/2006
• Issued: 01/11/2011
• Est. Priority Date: 01/26/2004
• Status: Expired due to Fees

• Current Assignee: Toshiba Solutions Corporation (Toshiba Corporation)
• Original Assignee: Kabushiki Kaisha Toshiba (Toshiba Corporation), Toshiba Solutions Corporation (Toshiba Corporation)
• Inventors: Fukushima, Shigeyuki, Okada, Koji
• Primary Examiner(s): Zimmerman; Brian A
• Assistant Examiner(s): Nguyen; Nam V
• Application Number:
  US11/492,188
• Publication Number:
  US 20060255910A1
• Time in Patent Office: 1,631 Days
• Field of Search: 340/5.8, 340/5.7, 340/5.6, 340/5.65, 340/5.26, 340/10.1, 340/10.2, 340/815.47, 340/815.48, 307/10.5, 307 101- 106, 180/287
• US Class Current: 340/5.8
• CPC Class Codes: B60R 25/04 operating on the propulsion system, e.g. engine or drive motor
• CPC Class Codes: B60R 25/24 using electronic identifiers containing a code not memorised by the user
• CPC Class Codes: E05B 49/00 Electric permutation locks; Circuits therefor ; Mechanical aspects of electronic locks; Mechanical keys therefor arrangements for sensing or reading record carriers G06K7/00; mechanisms including electronic locks actuated by nonmechanical keys such as passive and active electrical keys and other data carriers G07C9/00, G07F7/00; electronic switching H03K17/00

Abstract

Apart from authentication of an electronic key, authentication of an ID card and authentication of user authentication information are executed. When all the authentications have been successfully made, engine startup information is produced. In this manner, even if electronic key data or an electronic key device has been copied, vehicle theft can be prevented.

Claims

1. A security device for use in a vehicle authenticating device which is mounted on a vehicle capable of running in accordance with engine startup information and which authenticates a user of the vehicle based on an electronic key device having electronic key data (K) stored therein, the security device comprising:

key information storage device for storing an encrypted engine master key (E (EK)) obtained by encrypting an engine master key (EK) in accordance with the electronic key data (K);

certificate information storage device having an ID device certificate verification key (CK) to verify a certificate (C) in an ID device having a personal information for specifying an individual user, the certificate (C), and a user specific key (I) stored therein;

a device for verifying the certificate (C) input from the ID device by using the IC device certificate verification key (CK) in the certificate information storage device to confirm validity of the ID device;

a device for, after confirming the validity of the ID device, causing the ID device to verify user inputted authentication information by transmitting the user inputted authentication information to the ID device, the ID device verifying the user inputted authentication information based on the personal information;

a signature verification key storage device storing an electronic key data signature verification key (VMK) to verify a digital signature applied to an electronic key data (K);

an authentication device for, when a verification result by the ID device has been successfully obtained, authenticating the digital signature of the electronic key data (K) based on the electronic key data signature verification key (VMK), the electronic key data (K) inputting from the electronic key device;

a device for, when authentications of the digital signature of the electronic key data (K) have been successfully made, decrypting the encrypted engine master key (E (EK)), and then, obtaining an engine master key (EK), based on the electronic key data (K);

a device for producing the engine startup information by using the engine master key (EK); and

a device for outputting the obtained engine startup information.

2. The security device according to claim 1, comprising:

user information storage device for storing a group of user specific keys (I) made of a plurality of user specific keys (I);

wherein the authentication device comprises;

a device for matching the user specific keys (I) input from the ID device and the group of the user specific keys (I);

a device for, when a coincident user specific key (I) exists as a result of this matching, storing the electronic key data (K) input from the electronic key device; and

a device for verifying the digital signature of the electronic key data (K) based on the electronic key data signature verification key (VMK) in the signature verification key storage device.

3. The security device according to claim 1, wherein

the electronic key data (K) is stored in an electronic key device in a state in which the data has been encrypted by using the user specific keys (I);

and

the authentication device for comprises;

a device for reading the encrypted electronic key data (E (K)) from the electronic key device;

a device for decrypting the encrypted electronic key data (E (K)) by device of the user specific keys (I), thereby obtaining electronic key data (K); and

a device for verifying the digital signature of the electronic key data (K) based on the electronic key data signature verification key (VMK) in the signature verification key storage device.

4. The security device according to claim 1, wherein

the encrypted engine master key (E (EK)) is stored in the key information storage device in a state in which the key has been encrypted by using the electronic key data (K) and the user specific keys (I);

the authentication device comprises;

a device for storing the electronic key data (K) input from the electronic key device; and

a device for verifying the digital signature of the electronic key data (K) based on the electronic key data signature verification key (VMK) in the signature verification key storage device; and

the device for obtaining the engine master key (EK) decrypts the encrypted engine master key (E (EK)) based on the electronic key data (K) and the user specific keys (I), when authentication of the digital signature of the electronic key data (K) has been successfully made.

5. The security device according to claim 1, comprising:

a private key information storage device for storing an electronic key data signature generating key (SMK) to generate new electronic key data (K);

an owner authenticating device for allowing control by an owner of the vehicle and an ID device of the owner to execute the device for confirming validity of the ID device, the device for causing the ID device to verify the user authentication information, the device for storing the input user specific key (I), and the authentication device;

a registrant authentication device for, when authentication of the digital signature of the electronic key data (K) has been successfully made by the owner authenticating device, making control with respect to a registrant and an ID device of the registrant, so as to execute the device for confirming validity of the ID device, the device for causing the ID device to verify the user authentication information, and the device for storing the input user specific keys (I);

a device for, after execution of the registrant authenticating device has been completed, generating new electronic key data in accordance with the electronic key data signature generating key (SMK); and

a device for inputting the new electronic key data to an electronic key device of a registrant.

6. The security device according to claim 1, wherein

the electronic key data (K) has a digital signature applied by a certification authority;

the electronic key data signature verification key (VMK) becomes effective by a public key certificate of the certification authority;

the public key certificate of the certification authority is revoked in accordance with a revocation list of the certification authority; and

the security device comprises;

a device for, when the electronic key device is transferred, requesting the certification authority to revoke a public key certificate before transfer; and

a device for, when transfer of the electronic key device is received, requesting the certification authority to issue a new public key certificate.

7. The security device according to claim 6, comprising:

a device for, when communication with the certification authority is disabled, generating a public key pair of an electronic key data signature generating key (SMK'"'"') serving as a private key and an electronic key data signature verification key (VMK'"'"') serving as a public key;

a device for generating a public key certificate (CERT'"'"') by using an electronic data signature generating key (SMK) of an ID device serving as a transfer source for the electronic key data signature verification key (VMK'"'"'); and

a device for, when communication with the certification authority is recovered, requesting the certification authority to update the public key certificate (CERT'"'"').

8. The security device according to claim 6, comprising:

a device for, when the electronic key device is lost, requesting a certification authority to reissue electronic key data;

a device for, when the re-issuance is requested, if a user specific key (I) is received from an ID device of an owner of the lost electronic key device, outputting the user specific key to the certification authority; and

a device for inputting another new electronic key data received from the certification authority to a new electronic key device.

9. A vehicle authenticating device having the security device according to claim 1, the vehicle authenticating device comprising:

a certificate reading device for reading a certificate (C) in the ID device to input the read certificate to the security device;

a user information input device for inputting the user authentication information to the security device;

an electronic key reading device for reading electronic key data (K) in the electronic key device to the security device; and

an engine control device for controlling the engine in accordance with the engine startup information.

10. A vehicle authenticating method for use in a vehicle authenticating device which is mounted on a vehicle capable of running in accordance with engine startup information and which authenticates a user of the vehicle based on an electronic key device having electronic key data (K) stored therein, the method comprising:

storing an encrypted engine master key (E (EK)) obtained by encrypting an engine master key (EK) in accordance with the electronic key data (K);

storing in a memory an ID device certificate verification key (CK) to verify a certificate (C) in an ID device having a personal information for specifying an individual user, the certificate (C), and a user specific key (I);

verifying the certificate (C) input from the ID device by using an IC device certificate verification key (CK) in the memory to confirm validity of the ID device;

after confirming the validity of the ID device, causing the ID device to verify a user inputted authentication information by transmitting the user inputted authentication information to the ID device, the ID device verifying the user inputted authentication information based on the personal information;

storing in the memory an electronic key data signature verification key (VMK) to verify a digital signature applied to an electronic key data (K);

when a verification result by the ID device has been successfully obtained, authenticating the digital signature of the electronic key data (K) based on the electronic key data signature verification key (VMK), the electronic key data (K) inputting from the electronic key device;

when authentication of the digital signature of the electronic key data (K) has been successfully made, decrypting the encrypted engine master key (E (EK)), and then, obtaining an engine master key (EK), based on the electronic key data (K);

producing the engine startup information by using the engine master key (EK); and

outputting the obtained engine startup information.

11. A program for use in a computer of a vehicle authenticating device which is mounted on a vehicle capable of running in accordance with engine startup information and which authenticates a user of the vehicle based on an electronic key device having electronic key data (K) stored therein, the program stored in the vehicle authenticating device, the program comprising:

a first program code for causing the computer to execute a processing operation of storing in a memory an encrypted engine master key (E (EK)) produced when an engine master key (EK) is encrypted in accordance with the electronic key data (K);

a second program code for causing the computer to execute a processing operation of storing in a memory an ID device certificate verification key (CK) to verify a certificate (C) in an ID device having a personal information for specifying an individual user, the certificate, and a user specific key (I);

a third program code for causing the computer to execute a processing operation of verifying the certificate (C) input from the ID device by using an ID device certificate verification key (CK) in the memory to confirm validity of the ID device;

a fourth program code for causing the computer to execute a processing operation of, after confirming the validity of the ID device, causing the ID device to verify user inputted authentication information by transmitting the user inputted authentication information to the ID device, the ID device verifying the user inputted authentication information based on the personal information;

a fifth program code for causing the computer to execute a processing operation of storing in the memory an electronic key data signature verification key (VMK) to verify a digital signature applied to an electronic key data (K);

a sixth program code for causing the computer to execute a processing operation of, when a verification result by the ID device has been successfully obtained, authenticating the digital signature of the electronic key data (K) based on the electronic key data signature verification key (VMK), the electronic key data (K) inputting from the electronic key device;

a seventh program code for causing the computer to execute a processing operation of, when authentication of the digital signature of the electronic key data (K) has been successfully made, decrypting the encrypted engine master key (E (EK)), and then, obtaining an engine master key (EK), based on the electronic key data (K);

an eighth program code for causing the computer to execute a processing operation of producing the engine startup information by using the engine master key (EK); and

a ninth program code for causing the computer to execute a processing operation of outputting the obtained engine startup information.