JP3582422B2 - Security module - Google Patents

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention belongs to the technical field of a security module for ETC.
[0002]
[Prior art]
As a toll collection system on a toll road, there is a non-stop automatic toll collection system (ETC: Electronic Toll Collection System). Communication between the tollgate side and the vehicle side in this ETC is performed by short range wireless communication (DSRC). An outline for executing the DSRC radio is as illustrated in FIG. 1, and a roadside device (also referred to as a roadside antenna or a roadside wireless device) 100 is installed at the entrance side of the tollgate. An on-board unit 110 is mounted on a passing vehicle. Although the diameter of the communication area can be set within a range of 3 to 30 m, it is usually set to be wide (usually 30 m).
[0003]
As shown in FIG. 2, the roadside device 100 includes a roadside host 101 and a DSRC wireless antenna 102. The DSRC wireless antenna 102 can perform communication based on the DSRC wireless protocol (ARIB standard), and the roadside host 101 controls the DSRC wireless antenna 102, manages application information, and exchanges information with the vehicle-mounted device 110. Do. Although illustration is omitted, the roadside host 101 is connected to a management computer that performs a charge calculation and the like, and information obtained by the roadside host 101 from the vehicle-mounted device 110 is transmitted to the management computer.
[0004]
On the other hand, the vehicle-mounted device 110 has a DSRC wireless (interface) I / F 103, a control processing unit (microcomputer) 104, a security module (SAM) 105, a human machine interface (HMI) 106, and a slot for an IC card 107 (not shown). Etc. are provided. The DSRC wireless I / F 103 is a functional block corresponding to the DSRC wireless antenna 102 of the roadside device 100, and is capable of performing communication based on the DSRC wireless protocol (ARIB standard). The control processing unit 104, which is a microcomputer, performs processing of DSRC wireless communication information via the DSRC wireless I / F 103, controls the HMI 106, and the like. Further, the control processing unit 104 adds a processing command to information acquired from the roadside device 100 by DSRC wireless communication and inputs the information to the SAM 105 to request, for example, decryption of encryption information, and to transmit the decryption information to the roadside device 100. Requesting information from the IC card 107 and encrypting it. The SAM 105 decrypts encrypted information, reads information from the IC card 107, encrypts information, and the like in response to a request from the control processing unit 104.
[0005]
FIG. 15 illustrates an example of a communication sequence between the roadside device 100 and the vehicle-mounted device 110. When the vehicle-mounted device 110 (that is, the vehicle) enters the communication area of the roadside device 100, communication starts according to the DSRC wireless protocol.
First, a frame control message (FCM: Frame Control Message) is transmitted from the roadside device 100 to the vehicle-mounted device 110, and in response to this, the vehicle-mounted device 110 transmits an activation channel (ACTC: Activation Channel). Next, the roadside device 100 transmits an FCM, subsequently transmits a beacon service table (BST: Beacon Service Table), and transmits the FCM again. When the vehicle-mounted device 110 transmits a vehicle service table (VST: Vehicle Service Table) in response thereto, the roadside device 100 transmits the FCM. Note that FCM, ACTC, BST, and VST are all defined by the ARIB standard and are frames used for a link sequence.
[0006]
The link connection between the roadside device 100 and the vehicle-mounted device 110 has been completed by the procedure up to this point, and then substantial information is exchanged. FIG. 15 shows an example in which information A including a cipher text is transmitted from the roadside device 100 and information B including the cipher text is also transmitted from the vehicle-mounted device 110 for simplicity of description.
[0007]
The information A (cipher text) is transmitted from the roadside device 100, and the control processing unit 104 of the vehicle-mounted device 110 that has obtained the information A adds a decryption request command to the information A and inputs the information A to the SAM 105. The SAM 105 decodes the information A according to this command and sends it to the control processing unit 104. Next, when the control processing unit 104 requests the encryption of the information B, the SAM 105 encrypts the information B including information read in advance from the IC card 107 and stored in the RAM and information unique to the vehicle-mounted device. And sends it to the control processing unit 104. The control processing unit 104 transmits the encrypted information B to the roadside device 100 after waiting for the FCM from the roadside device 100.
[0008]
When the transmission and reception of information from both sides are completed, the communication is completed, and the vehicle-mounted device 110 eventually moves out of the communication area.
This example is an example in which the communication between the roadside device 100 and the vehicle-mounted device 110 is normally performed.
[0009]
[Problems to be solved by the invention]
By the way, communication between the SAM 105 and the IC card 107 is performed at the time of communication with the roadside device 100, such as when the IC card 107 is inserted into the card slot immediately before the vehicle-mounted device 110 enters the communication area. There is.
[0010]
As shown in FIG. 16, when the IC card 107 is inserted into the vehicle-mounted device 110, the power is supplied from the SAM 105 to the IC card 107, and the ATR, the select file 1, the authentication, and the read data are sequentially communicated and processed. Such a series of processing (IC card access) requires a considerable amount of time due to the low processing speed and communication speed of the IC card 107 itself. Although depending on the speed of the vehicle, it usually exceeds the time from when the vehicle-mounted device 110 enters the communication area to when it exits.
[0011]
As described above, when the SAM 105 is accessing the IC card 107, the communication between the roadside device 100 and the control processing unit 104 is performed as described above, and the control processing unit 104 sends a composite request of the information A to the SAM 105. However, since the SAM 105 is accessing the IC card 107, the SAM 105 cannot respond to the request from the control processing unit 104 (returns busy. Therefore, the control processing unit 104 cannot obtain the decryption result of the information A and responds to the roadside device 100. No, since there is no response from the vehicle-mounted device 110, the roadside device 100 repeats retransmission of the information A. In this state, the traveling vehicle goes out of the communication area, and the communication is not completed.
[0012]
FIG. 16 shows an example caused by the insertion of the IC card 107. However, the same trouble (for example, when communication with the roadside device 100 is not completed) is also possible when reading the usage history of the IC card 107 or the like. Completion).
When such a situation occurs, for example, at a tollgate (for example, an exit) of an ETC application, the following major problems often occur.
[0013]
First, since communication was not possible, that is, payment could not be made, the gate was closed and the vehicle was stopped, so that non-stop passage, which is the most merit of ETC, could not be made. In addition, since the following vehicle cannot pass, a traffic jam is caused.
[0014]
Second, when viewed from the roadside unit, there is no response from the vehicle-mounted device, so nothing can be understood from the communication log. That is, the cause cannot be investigated by the administrator of the ETC.
Third, investigation of the cause for the vehicle-mounted device cannot be dealt with on site, and it is necessary to remove the vehicle-mounted device. Therefore, it is difficult for a general user to perform the treatment, so that the user has to go to a specialty store.
[0015]
Fourth, no matter how much the cause is investigated, the communication error is not reproduced because it is a normal vehicle-mounted device, and the cause is eventually unknown.
Fifth, the above work is performed on the in-vehicle device having no problem, and a large wasteful cost is incurred.
[0016]
Sixth, the ETC is installed in many vehicles and spreads, which has the effect of alleviating traffic congestion at toll booths. However, if such a problem occurs, the user will have a distrust of the system and hinder its spread.
The following countermeasures can be considered for these problems.
(Countermeasure 1)
In order to avoid a non-response, the vehicle-mounted device does not perform the encryption process during the processing of the IC card, and returns a status of the vehicle-mounted device including that during the processing of the IC card. The roadside device can determine the status of the vehicle-mounted device, perform a retry process, and leave it as a communication log. However, if the processing time of the IC card is long, the vehicle passes through the communication area, so that the problem remains that the IC card cannot be passed non-stop even though the IC card is correctly inserted.
(Countermeasure 2)
If the DSRC wireless communication starts during the IC card processing, the IC card processing is interrupted and the DSRC wireless processing is performed. In this case, non-stop passage is possible, but a problem may occur in IC card processing. For example, when the user attempts to read the usage history, the usage history cannot be read or the response becomes slow. However, as compared with the measure 1, the degree of the problem is reduced and the method is effective.
(Measures 3)
Enables simultaneous processing inside the SAM. This is something everyone will think about. However, the communication speed of DSRC wireless communication is as fast as 1 MBPS, and even encryption processing is required. Therefore, it is extremely difficult to simultaneously process a command from a roadside device and an IC card communication process. To put it simply, it is possible to construct a microcomputer (CPU) with a high processing capability. However, if a high-grade CPU such as a personal computer is used in a DSRC wireless device, the cost increases and the system becomes popular. May hinder promotion.
[0017]
The present invention relates to a security module (SAM) mounted on a vehicle-mounted device for short-range wireless communication (DSRC) such as the ETC system exemplified above. The purpose of the present invention is to enable simultaneous processing equivalent to the measure 3.
[0018]
Means for Solving the Problems and Effects of the Invention
A security module according to claim 1 for solving the above-mentioned problem is mounted on a vehicle-mounted device for short-range wireless communication (DSRC), and uses encryption information included in information from a roadside wireless device installed on a roadside. In a security module that decrypts and encrypts part or all of the information transmitted from the on-vehicle device to the roadside apparatus, an arithmetic processing unit that performs arithmetic processing including the decryption and encryption according to the acquired command, A priority determining means for determining which of the command corresponding to the process currently being executed and the newly acquired command is prioritized by the arithmetic processing means; and a determination that the new command has priority by the priority determining means. And priority processing means for causing the arithmetic processing means to preferentially execute the arithmetic processing according to the new command when If the higher priority than the processing in the resident execution command is input, it may preferentially process the command.
[0019]
In the case of giving priority to a new command, a configuration may be employed in which the arithmetic processing means interrupts the process currently being executed and executes an arithmetic process according to the new command. Also, for example, the system is allowed to process a new command when the arithmetic processing means is idle (for example, waiting for a response or the like, in a state where processing is being executed formally but no substantial processing is being performed). It is also possible to adopt a configuration in which processing is performed in an interrupted manner within a time period (a range that does not interfere with the processing currently being executed). The processing by the interrupt is substantially the same as the parallel processing of the processing according to the old and new commands.
[0020]
Specifically, for example, if the priority of the decryption command and the encryption command is set higher than that of the command related to the IC card access, the idle of the process related to the IC card access even under the situation illustrated in FIG. The decryption process and the encryption process can be executed at the time (such as when waiting for data reception from the IC card) or by temporarily suspending the process related to the IC card access. For this reason, it is possible to prevent communication with the roadside device from being incomplete.
[0021]
In addition, since the command and the IC card communication process are not simultaneously performed while processing the command from the roadside device, it is not necessary to use a high-grade CPU (expensive CPU) having a high processing capability, and the cost increases. Can be avoided.
The priority of a command can be set for each individual command. Further, according to various situations, for example, it is possible to set such that the command A has priority over the command B in the situation 1, but the command B has priority over the command A in the situation 2.
[0022]
Ideally, precise priorities should be set according to such situations, types of individual commands, and the like. However, setting too finely requires a large amount of setting work, and may be too precise to cause a problem.
Therefore, a security module according to a second aspect of the present invention is the security module according to the first aspect, wherein the vehicle-mounted device includes a wireless communication unit that communicates with the roadside device, and a removable device that is mounted on the vehicle-mounted device by a user. Medium communication means for performing communication with a storage medium, wherein the priority order determination means includes a command (referred to as a DSRC command) relating to DSRC wireless communication with the roadside apparatus and the storage means. The command accompanying the communication with the medium (medium-side command) adopts a configuration in which the DSRC command has priority.
[0023]
In general, in DSRC, there are many situations in which communication with a roadside device (roadside wireless device) is more important than communication with a storage medium (for example, an IC card or, of course, another form of storage medium).
In the security module according to the second aspect, since the DSRC command related to the DSRC wireless communication with the roadside apparatus has a higher priority than the medium side command associated with the communication with the storage medium, the priority order setting for the command is relatively simple. The setting work is also easy. Since the DSRC command (communication with the roadside apparatus) which is considered to be more important is given priority, it is possible to prevent the communication with the roadside apparatus from being incomplete.
[0024]
In addition, since the onboard equipment performs HMI processing such as commands related to DSRC wireless communication, IC card processing, display, voice, switch input, and multiple other processing, various types of processing input to the security module along with such various processing are performed. Among these commands, a command related to DSRC wireless communication may be set to the highest priority. Then, even if the security module is executing any type of command other than the DSRC command, it is possible to prevent communication with the roadside apparatus from being incomplete.
[0025]
By the way, the security module may encrypt all the information to be transmitted to the roadside apparatus, but this increases the processing amount and is wasteful.
Therefore, in the security module according to a third aspect, in the security module according to the second aspect, the information to be encrypted is user information read from the storage medium. As a specific example, the configuration is such that only information such as the user's credit number and account number that is unique to the user and that can be misused when leaked or information related to the privacy of the user is encrypted. Therefore, the processing amount does not increase, and no unnecessary processing is performed.
[0026]
In addition, in the ETC, the unique information of the vehicle-mounted device (for example, vehicle inspection information) is also transmitted to the roadside apparatus, so that the unique information of the vehicle-mounted device is preferably encrypted in the security module. That is, it is preferable to encrypt the user information read from the storage medium and the unique information of the vehicle-mounted device. Even if the unique information of the on-vehicle device is also encrypted, the above-described effect is maintained because the processing amount does not increase significantly.
[0027]
The security module according to any one of claims 1 to 3 can be widely applied to DSRC radio, but it is particularly preferable to apply the configuration according to claim 4, that is, to the automatic toll collection system (ETC).
[0028]
BEST MODE FOR CARRYING OUT THE INVENTION
Next, embodiments of the present invention will be described with reference to some examples of the present invention.
[0029]
Embodiment 1
Since the hardware configuration of this embodiment is as shown in FIG. 2, the description is omitted here. The configuration of the SAM 105 is as shown in FIG. 3, and includes a CPU 120 for executing various processes, a HOST interface 121 for controlling communication with the control processing unit 104, a ROM 122 in which an execution program is written, and an IC for performing encryption processing of the IC card 107. A card encryption processing circuit 123, a DSRC wireless encryption processing circuit 124 for performing encryption processing of DSRC wireless information, an IC card interface 125 for controlling communication with the IC card 107, a RAM 126 serving as a work area of the CPU 120, and time management. And the like. The CPU 120 receives an interrupt IRQ0 from the HOST interface 121 and an interrupt IRQ1 from the IC card interface 125.
[0030]
The programs written in the ROM 122 include an operating system (OS), a HOST processing task for processing a command from the control processing unit 104, a communication processing of the IC card 107, and an IC card processing task for processing the command. HOST processing tasks include HOST command monitoring, HOST command analysis and command processing, and IC card processing tasks include IC card monitoring, IC card communication control, and IC card encryption processing. . The OS monitors the inputs of IRQ0 and IRQ1 by a real-time monitor.
[0031]
The CPU 120 controls the DSRC wireless encryption processing circuit 124 to decrypt the encryption information from the roadside device 100 and the unique information of the vehicle-mounted device, and controls the IC card encryption processing circuit 123 to encrypt the information from the IC card 107. I do. That is, the CPU 120 functions as an arithmetic processing unit in cooperation with the DSRC wireless encryption processing circuit 124 and the IC card encryption processing circuit 123. Note that the DSRC wireless encryption processing circuit 124 and the IC card encryption processing circuit 123 can be replaced with software.
[0032]
The CPU 120 also functions as a priority determining unit and a priority processing unit by executing a program written in the ROM 122. Next, these will be described in detail.
As shown in FIG. 4, the HOST processing task is executed by the IRQ0 signal, and the IC card processing task is executed by the IRQ1 signal. When the IRQ0 signal and the IRQ1 signal are input at the same time, the HOST processing task is set to be executed.
[0033]
The HOST processing task first waits for a command (S1), and upon acquiring a command, determines its priority (S2) and determines whether to execute the command (S3). Specifically, when the priority is higher than the command being executed in the IC card processing task, the IC card processing task is temporarily interrupted, or when the IC card processing task is not operating, the command is executed. The command is determined to be executed (S3: YES), the command is analyzed (S4), processing according to the command (for example, encryption processing for encryption and decryption) is performed (S5), and the processing result is notified to the control processing unit 104. (S6). If it is determined not to execute (low priority) in the determination of execution permission (S3), the process returns to waiting for a command (S1).
[0034]
In the IC card processing task, first, a command is waited for (S11). When a command is acquired, its priority is determined (S12), and it is determined whether or not to execute the command (S13). Specifically, when the priority is higher than the command being executed in the HOST processing task, the HOST processing task is temporarily suspended, or when the HOST processing task is not operating, the command execution is determined. (S13: YES), the command is analyzed (S14), processing according to the command (specifically, communication processing with the IC card 107) is performed (S15), and the processing result is notified to the control processing unit 104. (S16). If it is determined not to execute (low priority) in the determination of execution (S13), the process returns to the command waiting (S11).
[0035]
As described above, based on the determination of the priority of the command (S2, S12), it is determined whether or not to execute the command (if another processing task is executing a process, whether or not to temporarily suspend the process). (S3, S13).
In the case of the present embodiment, since the priority of the command of the encryption processing (encryption, decryption) in the HOST processing task is set higher than the command executed in the IC card processing task, the encryption processing is requested. When a command is input, even if some processing is being executed by the IC card processing task, this is interrupted and encryption processing is executed. Therefore, even if the communication with the roadside device 100 is started while the SAM 105 is accessing the IC card 107, there is no possibility that the communication with the roadside device 100 is not completed. A specific example will be described with reference to FIG.
[0036]
When the IC card 107 is inserted into the vehicle-mounted device 110, the power is supplied to the IC card 107 under the control of the SAM 105 or the control processing unit 104, and the ATR, the select file, the authentication, and the read data are sequentially communicated and processed.
When the vehicle-mounted device 110 enters the communication area during such processing (during access to the IC card), communication between the roadside device 100 and the vehicle-mounted device 110 is started according to the DSRC wireless protocol.
[0037]
First, as described above, when the FCM, ACTC, FCM, BST, FCM, VST, and FCM are transmitted and received, a link is established, and when the information A including the ciphertext is transmitted from the roadside device 100, the information is acquired. The control processing unit 104 of the on-vehicle device 110 inputs the IRQ0 signal to the SAM 105, and subsequently adds a decoding request command (decoding command) to the information A and inputs the information A to the SAM 105. In the SAM 105, the HOST processing task is started by the IRQ0 signal, and the priority of the decoding command is determined (S2). Since the decoding command is superior to the command being executed in the IC card processing task, it is given priority. It is decided to execute the task, the task for IC card processing is temporarily interrupted (S3: YES), the command analysis (S4), the decoding process (S5) is executed, the information A is decoded and sent to the control processing unit 104 (S6). ).
[0038]
Next, when the control processing unit 104 requests the encryption of the information B (encryption command), since this is also superior to the command executed by the IC card processing task, the priority processing is performed similarly to the case of the decryption. Then, the result (ciphertext) is sent to the control processing unit 104, and the command waits.
[0039]
The control processing unit 104 waits for the FCM from the roadside device 100, transmits the encrypted information B to the roadside device 100, and completes the communication.
In the SAM 105, when the HOST processing task waits for a command, the processing in the IC card processing task is resumed, and, for example, access to the select file 2, response, read command, response, select file 3,. .
[0040]
As described above, when the SAM 105 is accessing the IC card 107, the communication between the roadside device 100 and the control processing unit 104 is performed, and the control processing unit 104 sends the SAM 105 a compound request for information A and encrypts the information B. Even if there is a request, the SAM 105 can temporarily suspend access to the IC card 107 and respond to the request from the control processing unit 104. Therefore, the communication with the roadside device 100 is prevented from being incomplete, and all the various inconveniences caused by the incomplete communication can be avoided.
[0041]
Even if the access to the IC card 107 is temporarily suspended, substantial interruption of processing (for example, a situation in which a response from the IC card 107 cannot be obtained) almost occurs because the response speed of the IC card 107 is low. Absent.
[0042]
Embodiment 2
In this embodiment, a HOST command (a command from the control processing unit 104) is prioritized. Since the configuration of the vehicle-mounted device 110 (the control processing unit 104, the SAM 105, and the like) is the same as that of the first embodiment, the description of the device configuration is omitted using the same reference numerals as those of the first embodiment.
[0043]
As shown in FIG. 6, in this embodiment, the CPU 120 first determines whether or not a HOST command has been input (S31). If there is a HOST command (S31: YES), the CPU 120 analyzes the HOST command (S31: YES). (S32), HOST command processing (for example, encryption processing) is executed (S33). Then, the presence or absence of the IC card processing flag is determined (S34). If the determination is negative, the process returns to S31.
[0044]
In the case of a negative determination in S31 (when there is no HOST command), it is determined whether or not there is an IC card command which is a request from the IC card interface 125 (S35).
If the determination is negative, the process returns to S31. If the determination is positive (there is an IC card command), the IC card processing flag is set (S36), the IC card command is analyzed (S37), and communication with the IC card 107 is performed (S36). S38), for example, transmitting a read command or the like to the IC card 107 (S39).
[0045]
Since the response from the IC card 107 to the read command or the like requires a relatively long time as compared with the exchange with the control processing unit 104, the presence or absence of a new HOST command is determined here (S40). If there is a HOST command (S40: YES), S32, S33, and S34 are executed as described above.
[0046]
If there is no HOST command (S40: NO), the process waits for completion of reception from the IC card 107 (S41: YES), resets the IC card processing flag (S42), and returns to S31.
In the case of this embodiment, if there is a HOST command (S31 or S40: YES), S32, S33, and S34 are executed immediately, so that the SAM 105 accesses the IC card 107 as in the first embodiment. In the meantime, even if the communication between the roadside device 100 and the control processing unit 104 is performed and the control processing unit 104 issues a compound request of the information A or an encryption request of the information B to the SAM 105, the SAM 105 does not access the IC card 107. It is possible to temporarily stop and respond to a request from the control processing unit 104. Accordingly, the communication with the roadside device 100 is prevented from being incomplete, and various inconveniences caused by the communication incomplete can be avoided.
[0047]
Even if the access to the IC card 107 is temporarily suspended, substantial interruption of processing (for example, a situation in which a response from the IC card 107 cannot be obtained) almost occurs because the response speed of the IC card 107 is low. Absent.
In this embodiment, as shown in FIG. 6B, the priorities of the HOST command and the currently executing IC card command are compared between S40 and S32 (S40a), and the HOST command has a higher priority. If the value is higher, it may be determined that this is to be preferentially executed (S40b: YES), and a process of shifting to S32 may be interposed. By doing so, the IC card access is interrupted only when the HOST command has a higher priority than the IC card command being executed, so that the frequency of interruption of IC card access can be reduced.
[0048]
Embodiment 3
In this embodiment, an IC card process is normally executed, and a HOST command is executed by an IRQ0 signal or a timer interrupt. Since the configuration of the vehicle-mounted device 110 (the control processing unit 104, the SAM 105, and the like) is the same as that of the first embodiment, the description of the device configuration is omitted by using the same reference numerals for the common parts.
[0049]
In this embodiment, the CPU 120 normally executes an IC card processing task shown in FIG. In this process, the process waits for an IC card command, which is a request from the IC card interface 125, to be input (S51). If there is an IC card command (S51: YES), an IC card processing flag is set (S52). ), Analyze the IC card command (S53), perform communication processing with the IC card 107 (S54), and transmit a read command or the like to the IC card 107 (S55). Then, after completion of the reception from the IC card 107 (S56: YES), the IC card processing flag is reset (S57), and the process returns to S51.
[0050]
On the other hand, the interrupt processing shown in FIG. 7B is executed by the timer interrupt or the IRQ0 signal from the control processing unit 104. In this interrupt processing, it is determined whether or not a HOST command has been input (S61). If there is a HOST command (S61: YES), the priority between the HOST command and the IC card command being executed is determined. After the comparison (S62), if the HOST command has a higher priority, it is determined that the HOST command is to be preferentially executed (S63: YES), and the process proceeds to S64. In S64, the HOST command is analyzed, and in S65, HOST command processing (for example, encryption processing) is executed, and the process returns from the interrupt processing. Also, when no HOST command is input (S61: NO) and when a negative determination is made in S63, the process returns from the interrupt process.
[0051]
Also in this embodiment, if there is a HOST command (S61: YES) and the priority of the HOST command is higher than the IC card command being executed (S63: YES), the HOST command is executed with priority. Similarly to the first embodiment, when the SAM 105 is accessing the IC card 107, the communication between the roadside device 100 and the control processing unit 104 is performed, and the control processing unit 104 sends the SAM 105 a compound request of the information A or the information. Even if there is an encryption request for B, the SAM 105 can temporarily suspend access to the IC card 107 and respond to the request from the control processing unit 104. Accordingly, the communication with the roadside device 100 is prevented from being incomplete, and various inconveniences caused by the communication incomplete can be avoided.
[0052]
Embodiment 4
This embodiment is an example in which a HOST processing task is executed using the IRQ0 signal. Note that the configuration of the vehicle-mounted device 110 (the control processing unit 104, the SAM 105, and the like) is almost the same as that of the first embodiment. However, since the path of the IRQ0 signal is unique to the present embodiment, it will be described with reference to FIGS.
[0053]
As shown in FIG. 8, a READY signal indicating that the SAM 105 can accept a command is input to the input port A of the control processing unit 104, and that the SAM 105 is executing the command processing is input to the input port B. BUSY signals shown in FIG. Reading and writing of data between the control processing unit 104 and the SAM 105 uses a read / write signal R / W to the SAM 105, a chip select signal CS to the SAM 105, and a data bus (DATA BUS) in the same manner as in the known one. .
[0054]
A gate 901 is connected to the read / write signal input port (R / W) and chip select signal input port (CS) of the SAM 105, and the output of the gate 901 is input to another gate 902. The other input terminal of the gate 902 is connected to an IRQ input port (IRQin) to which a signal from an IRQ output port (IRQout) of the control processing unit 104 is input. When the control processing unit 104 writes a request to the SAM 105, the read / write signal R / W, the chip select signal CS, and the IRQout are set to low. Then, since the output of the gate 901 to which the read / write signal R / W and the chip select signal CS are input becomes low, the IRQ0 signal from the gate 902 to the CPU 120 is generated. As shown in FIG. 9, the gate 901 can be provided outside the SAM 105. In this case, it is not necessary to make the SAM 105 a special order product (a general-purpose SAM can be used), so that an increase in the cost of the SAM can be avoided.
[0055]
Next, the operation of the vehicle-mounted device 110 will be described with reference to the timing charts of FIGS.
The timing chart of FIG. 10 is an example of a case where a DSRC wireless decoding request command is input from the control processing unit 104 while data is being transmitted from the IC card 107. In the timing chart of FIG. Equivalent. Note that the IC card interface 125 processes the transmission signal (data) from the IC card 107 by hardware, and the CPU 120 of the SAM 105 performs the same processing as the processing shown in FIG. 4 (processing using the OS).
[0056]
In the figure, IC indicates an IC card processing task, OS indicates an OS, and HT indicates a HOST processing task. The term “SAM software” indicates that the CPU 120 of the SAM 105 performs processing by the OS, the IC card processing task, and the HOST processing task.
[0057]
In FIG. 10, first, the SAM software (CPU 120) prepares for reception of the IC card interface 125 to receive the transmission signal of the IC card 107. The IC card interface 125 receives the transmission signal from the IC card 107, records the transmission signal in the buffer, and issues an IRQ1 signal when the predetermined amount of data is received, thereby notifying the CPU 120 of the completion of the reception.
[0058]
Since the IC card interface 125 is hardware, the CPU 120 (SAM software) is idle (= substantial processing is not performed) while data is being received from the IC card 107. The same applies when data is transmitted to the IC card 107 by the IC card interface 125. This is because the communication speed of the IC card 107 is generally 9600 BPS, which is much lower than that of the DSRC radio (about 1 MBPS).
[0059]
When, for example, a decoding request is written from the control processing unit 104 in the idle state, the IRQ0 signal is input to the CPU 120 as described above, and the OS operates the HOST processing task. The CPU 120 performs a decoding process using the HOST processing task, and transmits a decoding result to the control processing unit 104.
[0060]
Next, a case where the CPU 120 receives a processing request (for example, a decryption request) from the control processing unit 104 while executing the IC card processing (for example, data analysis) will be described with reference to FIG.
When the transmission from the IC card 107 is completed and the IC card interface 125 that has completed the reception inputs the IRQ1 signal to the CPU 120, the CPU 120 executes data analysis by the IC card processing task. At this time, when a decoding request is written from the control processing unit 104, the IRQ0 signal is input to the CPU 120 as described above. In this embodiment, the HOST process is set higher in priority than the IC card process. Therefore, the OS receiving the IRQ0 signal interrupts the IC card process task, switches to the HOST process task, and performs the decoding process. And transmits the decryption result to the control processing unit 104. Then, the processing of the CPU 120 is returned to the IC card processing task, and the continuation of the interrupted processing (data analysis in this example) is performed.
[0061]
As described above, when the SAM 105 is accessing the IC card 107, the communication between the roadside device 100 and the control processing unit 104 is performed, and the control processing unit 104 issues a compound request or an encryption request to the SAM 105. Also, the SAM 105 can temporarily suspend access processing of the IC card 107 and respond to a request from the control processing unit 104. Accordingly, the communication with the roadside device 100 is prevented from being incomplete, and various inconveniences caused by the communication incomplete can be avoided.
[0062]
Embodiment 5
In this example, the configuration of the vehicle-mounted device is made more compact.
Prior to the description of the embodiment, the current vehicle-mounted device will be described. The outline is as described with reference to FIG. 2. More specifically, as shown in FIG. 12, the block includes three blocks of a DSRC wireless I / F, a control processing unit, and a SAM, and each block has a CPU. In this embodiment, these three CPUs are shared.
[0063]
As shown in FIG. 13, the vehicle-mounted device 110a includes a CPU 130, an external input terminal 131, an external output terminal 132, an external input interrupt terminal 133, a DSRC wireless I / F 134, an IC card I / F 135, a DMA 136, an encryption processing unit 137, It has a one-chip configuration including flash ROMs 138a and 138b, a RAM 139, a timer 140, an interrupt controller 141, and the like.
[0064]
The flash ROMs 138a and 138b store an OS having the structure shown in FIG. 14, a task for DSRC processing, a task for IC card processing, and a task for HMI processing. The DSRC processing task corresponds to the HOST processing task in each of the above-described embodiments, and the IC card processing task is the same as the IC card processing task in each of the above-described embodiments. The HMI processing task processes a command from an HMI (Human Machine Interface).
[0065]
Also in this embodiment, as in the above-described embodiments, the configuration is such that the priority of the command is determined, the lower priority is interrupted, and the higher priority is immediately executed. The same effect as in the above embodiments can be exhibited by setting the priority to.
[0066]
Moreover, since only one CPU 130 is used, the cost can be significantly reduced, which can contribute to the spread of the on-vehicle device.
Further, the one-chip configuration enables further miniaturization.
If an object that becomes an obstacle is placed around the antenna unit of the vehicle-mounted device, the wireless communication may be interrupted and communication may not be performed. Therefore, the vehicle-mounted device is usually disposed near the dashboard or the front window in the vehicle cabin. However, it is also important to consider safety so as not to obstruct the driver's view. According to this embodiment, the vehicle-mounted device can be downsized, so that the safety is enhanced and the degree of freedom in selecting the installation location is also increased.
[0067]
The embodiments of the present invention have been described with reference to the examples. However, it is needless to say that the present invention is not limited to these examples, and can be variously implemented without departing from the gist of the present invention.
Although description is omitted in the above embodiments, a command related to IC card processing in addition to a command related to DSRC wireless communication may be input from the control processing unit 104 to the SAM 105.
[Brief description of the drawings]
FIG. 1 is a schematic diagram of a roadside device and a vehicle-mounted device in DSRC radio.
FIG. 2 is a block diagram of a schematic configuration of a roadside device and a vehicle-mounted device of DSRC radio.
FIG. 3 is a block diagram of a SAM according to the first embodiment.
FIG. 4 is a flowchart illustrating switching between a HOST task and an IC card task by the OS according to the first embodiment.
FIG. 5 is a timing chart of a communication process performed by the vehicle-mounted device according to the first embodiment.
FIG. 6 is a flowchart of a process executed by a SAM CPU according to the second embodiment.
FIG. 7 is a flowchart of a process executed by a SAM CPU according to a third embodiment;
FIG. 8 is an explanatory diagram of an input path of an IRQ0 signal to a SAM CPU according to a fourth embodiment.
FIG. 9 is an explanatory diagram of a modified example of FIG. 8;
FIG. 10 is a timing chart of a processing example when a decoding request is input when the SAM software is in an idle state in the fourth embodiment.
FIG. 11 is a timing chart of a processing example when a decryption request is input during processing of an IC card by the SAM software in the fourth embodiment.
FIG. 12 is a block diagram of a schematic configuration of a conventional vehicle-mounted device.
FIG. 13 is a block diagram of a schematic configuration of a vehicle-mounted device according to a fifth embodiment.
FIG. 14 is an explanatory diagram of an execution program according to a fifth embodiment.
FIG. 15 is a timing chart of an example in which communication by a conventional vehicle-mounted device is normally performed.
FIG. 16 is a timing chart of an example in which communication by a conventional vehicle-mounted device is not completed.
[Explanation of symbols]
100 roadside machine (roadside wireless device),
103 ··· DSRC wireless I / F (wireless communication means),
104 ... control processing unit,
105 ··· SAM (security module)
107: IC card (storage medium),
110, 110a ... on-vehicle device,
120... CPU (calculation processing means, priority order determination means, priority processing means)
123 ... IC card encryption processing circuit (arithmetic processing means)
124 ... DSRC wireless encryption processing circuit (arithmetic processing means)
125 ... IC card interface (medium communication means)
134 DSRC wireless I / F (wireless communication means),
135 ... IC card I / F (medium communication means),
137 ... Cryptographic processing unit (arithmetic processing means).

Claims (4)

It is installed in a vehicle-mounted device for short-range wireless communication (DSRC), decrypts encrypted information included in information from a roadside device installed on the road side, and transmits information to be transmitted from the vehicle-mounted device to the roadside device. In a security module that encrypts part or all,
Arithmetic processing means for performing arithmetic processing including the decryption and encryption according to the acquired command;
A priority determination unit for determining which of the command corresponding to the process currently being executed and the newly acquired command the arithmetic processing unit gives priority to,
A security module, comprising: priority processing means for causing the arithmetic processing means to execute arithmetic processing in accordance with the new command when the priority order determining means determines that the new command has priority. The security module according to claim 1,
A wireless communication unit that communicates with the roadside device,
Medium communication means for performing communication with a removable storage medium mounted on the in-vehicle device by a user,
The priority order determination unit determines that the DSRC command has priority in the command (DSRC command) related to DSRC wireless communication with the roadside apparatus and the command (media command) in communication with the storage medium. A security module, comprising: The security module according to claim 2,
The security module according to claim 1, wherein the information to be encrypted is user information read from the storage medium. The security module according to any one of claims 1 to 3,
A security module, wherein the vehicle-mounted device is a vehicle-mounted device for an automatic toll collection system (ETC).

Images