WO2025183497A1 - Time falsification prevention method and apparatus for security of fod services - Google Patents

Abstract

The present disclosure relates to a time falsification prevention method and apparatus for security of FoD services. According to an aspect of the present disclosure, provided is a time falsification prevention apparatus comprising: a certificate reception unit for receiving a certificate for an FoD service within a vehicle from a server; a time acquisition unit for acquiring a first current time of the vehicle and a clock time related to activation of the FoD service; a time error acquisition unit for acquiring a first time error which is the difference between the first current time and the clock time; a time information comparison unit for generating a comparison result by comparing information related to the first time error with previous time error information previously stored in a storage in relation to the certificate; and a service determination unit for determining whether to apply the FoD service on the basis of the comparison result.

Description

Method and device for preventing time tampering for securing FOD services

The present disclosure relates to a method and device for preventing time tampering for securing FoD services.

The content described below merely provides background information related to the present embodiment and does not constitute prior art.

The electric vehicle market is steadily growing, driven by advancements in battery technology and the development of charging infrastructure. Furthermore, advancements in technologies like artificial intelligence, mobile/wireless communications, cloud computing, sensors, and precision positioning are advancing the level of autonomous driving applied to automobiles.

In this environment, many vehicles are equipped with electrified or electronic devices or components driven by electronic control units (ECUs) to perform various functions and services such as driving safety, driver assistance, and autonomous driving.

Recently, Feature on Demand (FoD) services have been provided as a means to selectively activate or deactivate equipment already installed in a vehicle, or to activate or deactivate installed software functions.

When using a certificate to apply FoD service to a vehicle, the integrity and authenticity of the contents of the service package delivered by the server can be guaranteed using the certificate's electronic signature.

However, since the FoD service has an expiration date and this expiration date is based on the time in the vehicle, even after the expiration date has passed, an attacker can attempt to illegally use the FoD service by tampering with the vehicle time, etc.

Additionally, to synchronize the time between two systems, a Network Time Protocol (NTP) server can most commonly be used, but in this case, separate costs may be incurred for setting up an NTP server, or additional burdens may arise from separate communication with an external NTP server for time synchronization.

The main purpose of the present disclosure is to provide a method and device for preventing time tampering for securing FoD services.

The problems to be solved by the present invention are not limited to the problems mentioned above, and other problems not mentioned will be clearly understood by those skilled in the art from the description below.

According to one aspect of the present disclosure, a time tampering prevention device is provided, including: a certificate receiving unit that receives a certificate for an FoD service in a vehicle from a server; a time obtaining unit that obtains a first current time of the vehicle and a clock time related to activation of the FoD service; a time error obtaining unit that obtains a first time error which is a difference between the first current time and the clock time; a time information comparing unit that compares information related to the first time error with previous time error information previously stored in a storage related to the certificate and generates a comparison result; and a service determining unit that determines whether to apply the FoD service based on the comparison result.

According to another aspect of the present disclosure, a method for preventing time tampering is provided, including: a certificate receiving process for receiving a certificate for an FoD service in a vehicle from a server; a time obtaining process for obtaining a first current time of the vehicle and a clock time related to activation of the FoD service; a time error obtaining process for obtaining a first time error which is a difference between the first current time and the clock time; a time information comparing process for generating a comparison result by comparing information related to the first time error with previous time error information previously stored in a storage related to the certificate; and a service determination process for determining whether to apply the FoD service based on the comparison result.

According to an embodiment of the present disclosure, there is an effect of preventing illegal use of FoD services.

Additionally, it can prevent the reuse of certificates by tampering with the time in the vehicle using expired certificates.

Since the use of an NTP server for time verification can be omitted, there is no need to set up an additional NTP server or communicate with an NTP server.

The effects of the present disclosure are not limited to the effects mentioned above, and other effects not mentioned will be clearly understood by those skilled in the art from the description below.

Figure 1 conceptually illustrates a vehicle system being connected to a server via a network.

Figure 2 illustrates the functional blocks that constitute a vehicle connected to an external network.

Figure 3 illustrates the functional blocks that constitute the gateway (110).

Figure 4 illustrates the functions performed by the CCU (111).

Figure 5 illustrates the functional blocks that constitute the server.

FIG. 6 is a block diagram illustrating a time tamper prevention device (600) according to one embodiment of the present disclosure.

FIG. 7 is a flowchart illustrating a time tamper prevention method according to one embodiment of the present disclosure.

Figure 8 is a flowchart illustrating a time information comparison method.

FIG. 9 is a block diagram schematically illustrating an exemplary computing device that may be used to implement a method or device according to the present disclosure.

Hereinafter, some embodiments of the present disclosure will be described in detail using exemplary drawings. When designating components in each drawing, it should be noted that, where possible, identical components are given the same reference numerals, even if they appear in different drawings. Furthermore, when describing the present disclosure, detailed descriptions of related known structures or functions will be omitted if they are deemed to obscure the gist of the present disclosure.

In describing components of embodiments according to the present disclosure, symbols such as first, second, i), ii), a), b) may be used. These symbols are only for distinguishing the components from other components, and the nature, order, or sequence of the components are not limited by the symbols. When a part in the specification is said to "include" or "have" a component, this does not mean that other components are excluded, but rather that other components may be included, unless explicitly stated otherwise.

The detailed description set forth below, together with the accompanying drawings, is intended to explain exemplary embodiments of the present disclosure and is not intended to represent the only embodiments in which the present disclosure may be practiced.

Figure 1 conceptually illustrates a vehicle system being connected to a server via a network.

The vehicle system (100) can be connected to a server (200) that provides vehicle-related functions or services through a wireless network (300) such as LTE, 5G, or Wi-Fi.

Figure 2 illustrates the functional blocks that constitute a vehicle connected to an external network.

A vehicle system (100) may be configured to include a gateway (110) connected to an external network and an internal network, and subsystems connected to the internal network. The subsystems may include, for example, a powertrain subsystem (120), a body subsystem (130), a chassis subsystem (140), an infotainment subsystem (150), etc.

Each subsystem (120, 130, 140, 150) includes one or more electrical components with similar functions connected by the same type of internal bus, and each electrical component can be controlled and driven by a corresponding ECU.

The powertrain subsystem (120) is a collection of components that generate the driving force of a vehicle, and may include components such as an engine, motor, transmission, battery, generator, etc., and an ECU (121, 122, 123) for controlling each component.

The body subsystem (130) is a collection of components for enhancing the convenience and safety of passengers, and may include components such as seats, heating/ventilation/air conditioning (HVAC), lighting, doors, windows, indoor/outdoor lighting, and an ECU (131, 132, 133) for controlling each component.

The chassis subsystem (140) is a set of parts required for driving a vehicle excluding the body, and may include parts related to steering, brakes, suspension, tire pressure measurement, etc., and an ECU (141, 142, 143) for controlling each part.

The infotainment subsystem (150) is a collection of components related to driving guidance or multimedia, and may include components such as a navigation system, a multimedia system, a head-up display, and an ECU (151, 152, 153) for controlling each component.

The internal network connecting the gateway (110) and the electrical components that constitute the subsystem can use communication protocols such as LIN (Local Interconnect Network), CAN (Control Area Network), CAN-FD, FlexRay, MOST (Media Oriented Systems Transport), and Ethernet.

Electrical components of different subsystems using different communication protocols can exchange data with each other through the gateway (110).

Figure 3 illustrates the functional blocks that constitute the gateway (110).

The gateway (110) may be configured to include a central control unit (111, CCU (Central Control Unit)), a storage unit (113, Storage), an external communication unit (115), and an internal communication unit (117).

The central control unit (111) has the function of controlling the overall operation of the vehicle system (100).

The storage unit (113) stores data received from an external network or an internal network and data or information related to the operation of the vehicle system (100).

The external communication unit (115) functions to connect to the server (200) via an external network.

The internal communication unit (117) functions to connect to the electrical components (ECU) of each subsystem (120, 130, 140, 150) through the internal network.

The central control unit (111), internal communication unit (117) and separate storage unit may be configured as separate devices separated from the gateway (110).

Figure 4 illustrates the functions performed by the CCU (111).

The central control unit (111) can control various operations of the vehicle system (100) by controlling the ECU of at least one electric component included in at least one subsystem (120, 130, 140, 150) according to a request from a passenger, a need due to a driving situation, etc.

The functions performed by the central control unit (111), particularly those performed based on data transmitted through an external network and/or an internal network, may include functions such as driving/parking management, remote diagnosis/control, subscription service (FoD) management, software update, and security management.

The driving/parking management function (411) comprehensively controls the vehicle's speed, steering, braking, and sensor data when driving and parking the vehicle, thereby improving safety and convenience.

The remote diagnosis/control function (412) transmits status information collected while the vehicle is in operation to the server (200) to enable real-time diagnosis, and changes the control conditions of the vehicle or supports remote control in an emergency situation based on the diagnosis results received from the server (200).

The subscription service (FoD) management function (413) manages FoD (Feature On Demand), a type of subscription service, which enables new features to be downloaded and activated through the server (200) or the customer's terminal, or features that are already installed but deactivated to be activated and used.

The central control unit (111) performs the setting or cancellation operation of the subscription service, and checks whether the service requested by the customer is a service activated by the customer by selecting a subscription or whether the activation of the driving service is by an illegal method, and may perform or not perform the service based on this.

The software update function (414) is a service that the central control unit (111) performs on its own when a software update condition is satisfied in a vehicle system (100) to which OTA is applied, and may include not only an update of the software (operation system of the central control unit (111)) that manages the operation of the entire vehicle system (100) but also an update of the firmware installed in the ECU of each electrical component.

The security management function (415) may include functions or services related to the security of the vehicle system (100) or authentication of a connecting external device.

Security threats related to the vehicle system (100) may include firmware tampering, vehicle remote control hacking, CAN tampering, vehicle illegal operation, and denial of service. Additionally, security threats related to external network communications may include communication eavesdropping and message tampering.

The security management function (415) can perform, for example, a function to detect and respond to intrusions into the vehicle's internal network through an external network (IDS: Intrusion Detection System), a service to record data related to security events (data immediately before a security accident) (EDR: Event Data Recorder), etc.

Figure 5 illustrates the functional blocks that constitute the server.

The server (200) may be configured to include a management unit (210, Manager), a database (220, Database), a storage unit (230, Storage), and a communication unit (240).

The management unit (210) performs a function of managing operations according to a request of the vehicle system (100), such as software update, data transmission related to FoD, vehicle security/authentication, etc.

The database (220) manages information related to each vehicle, such as the software version installed in each vehicle, activated subscription services, and authentication-related information.

The storage unit (230) stores multiple versions of software, data related to driving of multiple vehicles, etc.

The communication unit (240) performs a function for exchanging data by connecting to the vehicle system (100) through an external network.

The server (200) may be composed of multiple different systems, each of which is divided according to the function or service performed by the central control unit (111) of the vehicle system (100).

The database (220) may be installed separately from the server (200).

FIG. 6 is a block diagram illustrating a time tamper prevention device (600) according to one embodiment of the present disclosure.

A time tampering prevention device (600) according to one embodiment of the present disclosure includes a certificate receiving unit (610), a user verifying unit (620), a validity verifying unit (630), a time obtaining unit (640), a time difference obtaining unit (650), a time information comparing unit (660), a certificate information recording unit (670), and a service deciding unit (680). Not all blocks illustrated in FIG. 6 are essential components, and some blocks included in the time tampering prevention device (600) may be added, changed, or deleted in other embodiments. Meanwhile, the components illustrated in FIG. 6 represent functionally distinct elements, and at least one of the components may be implemented in a form in which they are integrated with each other in an actual physical environment.

The certificate receiving unit (610) receives a certificate for the FoD service in the vehicle from the server (200).

The certificate receiving unit (610) can be implemented as a function of the central control unit (111).

The certificate includes user identification information for a user of at least one subscribed FoD service, identification information for at least one subscribed FoD service, information on whether each subscribed FoD service is activated, the creation time of the certificate, the period of use of the certificate, and electronic signature information.

Information regarding the activation status of each subscribed FoD service may indicate whether the FoD service is activated or deactivated. Additionally, the certificate's usage period may be the same as the FoD service's validity period, and the usage period may include at least one of the certificate's start time and expiration time.

The user verification unit (620) verifies the user of the subscribed FoD service using user identification information.

The user verification unit (620) verifies the user of the FoD service by checking whether the user identification information stored in the storage is identical to the user identification information included in the certificate.

The user verification unit (620) may be implemented as a function of the central control unit (111), but depending on the embodiment, it may also be implemented as a function of one target ECU (e.g., the corresponding ECU (151) within the infotainment subsystem (150)) related to the FoD service associated with the received certificate.

In the following description, it is assumed that one target ECU corresponding to a specific FoD service related to a certificate received from a server (200) is an ECU (151) within an infotainment subsystem (150).

The validation unit (630) verifies the validity of the certificate using the electronic signature information in the received certificate.

The validation unit (630) verifies the validity of the electronic signature of the certificate using a public key stored in a storage (not shown). Here, the public key may be stored in the storage (not shown) or transmitted from the server (200). In addition, the storage (not shown) may be included in the target ECU (151) or the gateway (110).

The functions of the time acquisition unit (640), time error acquisition unit (650), time information comparison unit (660), certificate information recording unit (670), and service determination unit (680) described below may be implemented within the corresponding ECU (151), but the present invention is not limited thereto, and at least one of these functions may be implemented within the gateway (110) or other various devices.

The time acquisition unit (640) acquires the first current time of the vehicle and acquires the clock time related to the activation of the FoD service.

The time acquisition unit (640) acquires the first current time from a gateway (110) related to multiple controllers in the vehicle, and acquires it from the corresponding controller (151) that determines activation or deactivation of the FoD service corresponding to the certificate.

The first current time may be information indicating the year, month, day, hour, minute, and second of the current point in time, and may be time information converted to epoch time (EPM: Epoch Time-based Parameter).

Additionally, the clock time can be obtained from the RTC (real time clock) in the controller (151), and the data form of the clock time can be in the form of a clock counter.

In this embodiment, the data type of the first current time and the data type of the clock time are not limited to specific data types, and the two can be data types that are comparable to each other.

The time error acquisition unit (650) acquires a first time error, which is the difference between the first current time and the clock time.

Here, the first time error can be a value obtained by subtracting the clock time from the first current time, a value obtained by subtracting the first current time from the clock time, or an absolute value of the difference between the first current time and the clock time.

The time information comparison unit (660) compares information related to the first time error with previous time error information stored in a storage (not shown) related to the certificate to generate a comparison result.

If previously stored time error information related to the certificate does not exist in the storage (not shown), the certificate information recorder (670) stores information about the first time error as previous time error information related to the certificate in the storage (not shown).

The time information comparison unit (660) generates a first unique code for the first time error, and determines the generated first unique code as information related to the first time error (i.e., first time error related information).

The time information comparison unit (660) compares the determined first time error related information with the previous time error information stored in a storage (not shown) to generate a comparison result.

The time information comparison unit (660) generates a first unique code related to the first time error using a unique code generation key stored in a storage (not shown).

The first unique code may be a MAC (Message Authentication Code), which is a message authentication code generated using a unique code generation key and has a cryptographic hash value that ensures that specific data has not been tampered with.

Methods for implementing MAC include CMAC (Cipher-based Message Authentication Code), HMAC (Hash-based Message Authentication Code), and GMAC (Galois Message Authentication Code).

If the first unique code related to the first time error is implemented to be generated as information about the first time error, the previous time error information is stored in the form of a unique code in the storage (not shown).

The time information comparison unit (660) checks whether, among the plurality of first unique codes sequentially generated for the plurality of error values, there is one that matches the previous time error information stored in the storage (not shown).

The time information comparison unit (660) sequentially generates a first unique code for a plurality of error values within a certain range based on the first time error and determines the generated first unique code as information on the first time error. The time information comparison unit (660) compares the information on the first time error generated in this way with previous time error information.

The time information comparison unit (660) sequentially generates a first unique code for a plurality of error values (i.e., generates information on the first time error) and compares the information on the first time error with the previous time error information. When information on the first time error that matches the previous time error information is generated, the generation of information on the first time error for any more error values among the plurality of error values is stopped and the comparison result is determined to be normal.

The service judgment unit (680) determines whether to apply the FoD service included in the certificate based on the comparison result.

When the time information comparison unit (660) sequentially generates a first unique code for a plurality of error values within a certain range, and compares each generated first unique code with the previous time error information, if no matching comparison result is generated, i.e., if the comparison result is determined to be abnormal for the certificate, the service judgment unit (680) determines that the certificate has been used illegally and terminates the process.

If the comparison result of the time information comparison unit (660) means that the first time error information and the previously stored time error information are identical, the service judgment unit (680) activates or deactivates the corresponding FoD service according to the activation information for the FoD service in the certificate.

If the comparison result is determined to be normal by the time information comparison unit (660), the service judgment unit (680) obtains the identification information of the FoD service, information on whether the FoD service is activated, and the validity period from the certificate. At this time, the service judgment unit (680) determines whether to activate or deactivate the corresponding FoD service based on the validity period and the information on whether the corresponding FoD service is activated.

The service judgment unit (680) determines that the corresponding FoD service has ended if the first current time has passed the validity period even if the comparison result of the time information comparison unit (660) is normal.

If the comparison result of the time information comparison unit (660) is normal and the first current time has not expired, the service judgment unit (680) determines whether to activate or deactivate the FoD service based on information regarding whether the FoD service is activated. The information regarding whether the FoD service is activated may be information indicating the activation of the FoD service or information indicating the deactivation of the FoD service.

The certificate information recorder (670) updates the information on the first time error as previous time error information related to the certificate based on the comparison result of the time information comparison unit (660) and stores the updated information in a storage (not shown). Here, the information on the first time error updated in the storage (not shown) means that the first time error has been converted into a first unique code.

That is, if the comparison result of the time information comparison unit (660) is normal, the certificate information recording unit (670) updates the first unique code corresponding to the first time error as the previous time error information related to the certificate, replacing the previous time error information already stored in the storage (not shown).

FIG. 7 is a flowchart illustrating a time tamper prevention method according to one embodiment of the present disclosure.

A time tamper prevention method according to one embodiment of the present disclosure is performed by a time tamper prevention device (600).

The certificate receiving unit (610) receives a certificate for a FoD service in a vehicle from the server (200), the user verification unit (620) verifies the user of the subscribed FoD service using user identification information, and the validity verification unit (630) verifies the validity of the certificate using the electronic signature information in the received certificate (S710).

For reference, the process of the validation unit (630) verifying the validity of the certificate using the electronic signature information in the received certificate may not be performed in S710, but may be performed in the S770 process described later.

The time acquisition unit (640) acquires the first current time (GWT, Gateway Time) of the vehicle and acquires the clock time (RTC_ECU) related to the activation of the FoD service (S720).

The time error acquisition unit (650) acquires the first time error (DT, Delta (Time Difference)), which is the difference between the first current time and the clock time (S730).

The time information comparison unit (660) compares the information on the first time error with the previous time error information (MDM', MAC Delta in Minute') previously stored in the storage (701) in relation to the certificate, and generates a comparison result (S740).

Figure 8 is a drawing illustrating in detail the time information comparison process (S740) by the time information comparison unit (660).

The time information comparison unit (660) converts the first time error (DT) into a comparison time unit (S810). That is, in the S810 process, DT is divided by TW (Time Window) through the DM=round(DT/TW) operation, and then the decimal point is discarded from the divided value to obtain a time unit conversion value (DM, Delta in Minute). Here, DT means time in seconds, and TW is a coefficient for indicating the comparison time unit compared to the time unit of DT. If DT is in seconds, TW can have a value of 60 corresponding to a minute unit, or a value of 3600 corresponding to a time unit.

The time information comparison unit (660) assigns a preset value TWS (Time Window Size) to variable i (S820).

Here, TWS is a value representing the preset error range for the first time error.

The time information comparison unit (660) obtains the previous unique code (MDM') stored in the storage (701) in relation to the certificate (or in relation to the corresponding FoD service) (S830).

The time information comparison unit (660) adds the DM value to the value obtained by multiplying the variable i by TWS and stores it as DMi (S840).

The time information comparison unit (660) stores the first unique code for DMi as MDMi (S850). The first unique code MDMi for DMi is also generated using the same unique code generation key (K) as that used to generate the previous unique code (MDM').

The time information comparison unit (660) compares whether MDMi and MDM' are identical (S860). If this comparison results in MDMi and MDM' being identical, the time error verification by the time information comparison unit (660) is deemed successful.

If the time error verification by the time information comparison unit (660) is successful (i.e., if the comparison result is determined to be normal by the time information comparison unit (660), the certificate information recording unit (670) updates the information on the first time error as previous time error information related to the certificate and stores it in the storage (701) (S760). Here, the information on the first time error updated in the storage (not shown) means that the first time error has been converted into a first unique code.

The validation unit (630) verifies the validity of the certificate using the electronic signature information within the received certificate (S770). If the verification at step S770 fails, the process ends.

If the verification at step S770 is successful, the service judgment unit (680) extracts data including the identification information of the FoD service, information on whether the FoD service is activated, and the validity period from the received certificate (S780).

At this time, the service judgment unit (680) determines whether to activate or deactivate the corresponding FoD service based on the information on the validity period and whether the corresponding FoD service is activated (S790).

At step S790, the service judgment unit (680) determines that the corresponding FoD service has ended if the first current time has passed the validity period even if the comparison result of the time information comparison unit (660) is normal.

The service judgment unit (680) determines whether to activate or deactivate the FoD service based on information on whether the FoD service is activated, if the comparison result of the time information comparison unit (660) is normal and the first current time has not passed the validity period.

If, in step S860, the comparison result MDMi and MDM' are not the same, the time information comparison unit (660) checks whether the i value is the same as TWS (S870).

If, as a result of the verification at step S870, the i value is equal to TWS, all comparisons have been made for the preset error range for the first time error, and therefore the time information comparison unit (660) outputs a result of verification failure. In other words, the comparison result by the time information comparison unit (660) is determined to be abnormal.

As a result of the verification at step S870, if the i value is not equal to TWS, the time information comparison unit (660) increases the i value by 1 (S880) and proceeds to step S840 again.

FIG. 9 is a block diagram schematically illustrating an exemplary computing device that may be used to implement a method or device according to the present disclosure.

The computing device (9) may include some or all of a memory (900), a processor (920), storage (940), an input/output interface (960), and a communication interface (980). The computing device (9) may be a stationary computing device such as a desktop computer, a server, etc., as well as a mobile computing device such as a laptop computer, a smart phone, an automotive electronics, etc. The computing device (9) may be implemented with any specialized hardware accelerator capable of efficiently processing operations for an artificial intelligence model. For example, the computing device (9) may include a graphic processing unit (GPU), a tensor processing unit (TPU), or a neural processing unit (NPU).

The memory (900) may store a program that causes the processor (920) to perform a method or operation according to various embodiments of the present disclosure. For example, the program may include a plurality of instructions executable by the processor (920), and the methods illustrated in FIGS. 7 and 8 may be performed by executing the plurality of instructions by the processor (920). The memory (900) may be a single memory or a plurality of memories. In this case, information required to perform the method or operation according to various embodiments of the present disclosure may be stored in a single memory or may be divided and stored in a plurality of memories. When the memory (900) is composed of a plurality of memories, the plurality of memories may be physically separated. The memory (900) may include at least one of a volatile memory and a nonvolatile memory. The volatile memory includes a static random access memory (SRAM) or a dynamic random access memory (DRAM), and the nonvolatile memory includes a flash memory.

The processor (920) may include at least one core capable of executing at least one instruction. The processor (920) may execute instructions stored in the memory (900). The processor (920) may be a single processor or multiple processors.

Storage (940) maintains stored data even when power supplied to the computing device (9) is cut off. For example, storage (940) may include non-volatile memory, or may include storage media such as magnetic tape, optical disk, or magnetic disk. A program stored in storage (940) may be loaded into memory (900) before being executed by processor (920). Storage (940) may store a file written in a programming language, and a program generated from the file by a compiler or the like may be loaded into memory (900). Storage (940) may store data to be processed by processor (920) and/or data processed by processor (920).

The input/output interface (960) may include input devices such as a keyboard, mouse, touch display, microphone, etc., and may include output devices such as a display, speaker, etc. A user may trigger execution of a program by the processor (920) and/or check the processing result of the processor (920) through the input/output interface (960).

The communication interface (980) may provide access to an external network. The computing device (9) may communicate with other devices via the communication interface (980).

Each component of the device or method according to the present invention may be implemented in hardware, software, or a combination of hardware and software. Furthermore, the functions of each component may be implemented in software, with a microprocessor executing the software functions corresponding to each component.

Various implementations of the systems and techniques described herein may be implemented as digital electronic circuits, integrated circuits, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), computer hardware, firmware, software, and/or combinations thereof. These various implementations may include implementations of one or more computer programs executable on a programmable system. The programmable system includes at least one programmable processor (which may be a special purpose processor or a general purpose processor) coupled to receive data and instructions from and transmit data and instructions to a storage system, at least one input device, and at least one output device. Computer programs (also known as programs, software, software applications, or code) include instructions for the programmable processor and are stored on a "computer-readable recording medium."

A computer-readable recording medium includes any type of recording device that stores data that can be read by a computer system. Such a computer-readable recording medium may be a non-volatile or non-transitory medium such as a ROM, CD-ROM, magnetic tape, floppy disk, memory card, hard disk, magneto-optical disk, storage device, and may further include a transitory medium such as a data transmission medium. Furthermore, the computer-readable recording medium may be distributed across network-connected computer systems, so that computer-readable code can be stored and executed in a distributed manner.

Although the flowchart/timing diagram of this specification describes each process as being executed sequentially, this is merely an illustrative description of the technical idea of one embodiment of the present disclosure. In other words, a person of ordinary skill in the art to which one embodiment of the present disclosure belongs may modify and apply various modifications and variations by changing the order described in the flowchart/timing diagram without departing from the essential characteristics of one embodiment of the present disclosure, or by executing one or more of the processes in parallel. Therefore, the flowchart/timing diagram is not limited to a chronological order.

The above description is merely an example of the technical idea of the present embodiment, and those skilled in the art will appreciate that various modifications and variations can be made without departing from the essential characteristics of the present embodiment. Therefore, the present embodiments are not intended to limit the technical idea of the present embodiment, but rather to explain it, and the scope of the technical idea of the present embodiment is not limited by these embodiments. The scope of protection of the present embodiment should be interpreted by the claims below, and all technical ideas within a scope equivalent thereto should be interpreted as being included in the scope of rights of the present embodiment.

[Explanation of symbols]

100: Vehicle system 110: Gateway

111: CCU 113: Storage Unit

115: External Communications Department 117: Internal Communications Department

120: Powertrain subsystem 130: Body subsystem

140: Chassis subsystem 150: Infotainment subsystem

200: Server 210: Administration

220: Database 230: Storage

240: Communications Department 300: Wireless Network

411: Driving/Parking Management 412: Remote Diagnosis/Control

413: Subscription Services (FoD) Management 414: Software Renewal

415: Security Management 600: Time Tamper Protection Device

610: Certificate receiving unit 620: User verification unit

630: Validation Unit 640: Time Acquisition Unit

650: Time error acquisition unit 660: Time information comparison unit

670: Certificate Information Record 680: Service Decision Record

701: Storage

9: Computing device 900: Memory

920: Processor 940: Storage

960: Input/Output Interface 980: Communication Interface

CROSS-REFERENCE TO RELATED APPLICATION

This patent application claims priority to Korean Patent Application No. 10-2024-0029244, filed on February 28, 2024, which is incorporated herein by reference in its entirety.

Claims (20)

A certificate receiving unit that receives a certificate for a FoD service in a vehicle from a server; A time acquisition unit that acquires the first current time of the vehicle and acquires a clock time related to activation of the FoD service; A time error acquisition unit that acquires a first time error, which is the difference between the first current time and the clock time; A time information comparison unit that compares information related to the first time error with information previously stored in a storage in relation to the certificate to generate a comparison result; and A service judgment unit that determines whether to apply the FoD service based on the above comparison results. A time tamper prevention device including: In the first paragraph, The above time acquisition part is, A time tamper prevention device characterized in that it obtains the first current time from a gateway associated with a plurality of controllers within the vehicle and obtains it from a controller that determines activation or deactivation of the FoD service. In the first paragraph, A time tampering prevention device characterized in that it further includes a certificate information recording unit that stores information about the first time error in the storage as previous time error information related to the certificate when there is no previously stored previous time error information related to the certificate. In the third paragraph, The above certificate information record section is: A time tamper prevention device characterized in that, based on the comparison result, information about the first time error is updated as previous time error information related to the certificate and stored in the storage. In the third paragraph, The above certificate information record section is: A time tamper prevention device characterized in that the first unique code for the first time error is stored in the storage as previous time error information related to the certificate. In the third paragraph, The above time information comparison section, A time tamper prevention device characterized in that it generates a first unique code related to the first time error as information on the first time error, and compares the information on the first time error and the previously stored time error information to generate the comparison result. In paragraph 6, The above time information comparison section, A time tamper prevention device characterized in that the first unique code is generated using a unique code generation key stored in the above storage. In paragraph 6, The above time information comparison section is, A time tamper prevention device characterized in that it sequentially generates the first unique code for a plurality of error values within a preset error range based on the first time error. In paragraph 8, The above time information comparison section, A time tamper prevention device characterized in that it is checked whether there is one among the plurality of first unique codes sequentially generated for the plurality of error values that matches the previously stored time error information. In the first paragraph, The above service judgment department, A time tamper prevention device characterized in that, based on the comparison result, the identification information of the FoD service, information on whether the FoD service is activated, and a validity period are obtained from the certificate, and activation or deactivation of the FoD service is determined based on the validity period and the information on whether the FoD service is activated. In the first paragraph, The above service judgment department, A time tamper prevention device characterized in that, if the comparison result means that the first time error information and the previously stored time error information are identical to each other, the FoD service is activated or deactivated according to the information on whether the FOD service is activated in the certificate. Certificate receiving process for receiving a certificate for FoD service in a vehicle from a server; A time acquisition process for acquiring the first current time of the vehicle and acquiring a clock time related to activation of the FoD service; A time error acquisition process for acquiring a first time error, which is the difference between the first current time and the clock time; A time information comparison process for generating a comparison result by comparing information related to the first time error with information previously stored in a storage related to the certificate; and A service judgment process that determines whether to apply the FoD service based on the above comparison results. A method for preventing time tampering, including: In Article 12, The above time acquisition process is, A time tamper prevention method characterized in that the first current time is obtained from a gateway associated with a plurality of controllers within the vehicle, and is obtained from a controller that determines activation or deactivation of the FoD service. In paragraph 12, A time tampering prevention method characterized by further including a certificate information recording process for storing information about the first time error in the storage as previous time error information related to the certificate when there is no previously stored previous time error information related to the certificate. In Article 14, The above certificate information recording process is: A time tampering prevention method characterized in that, based on the comparison result, information about the first time error is updated as previous time error information related to the certificate and stored in the storage. In Article 13, The above time information comparison process is: A time tampering prevention method characterized in that a first unique code related to the first time error is generated as information on the first time error, and the information on the first time error and the previously stored time error information are compared with each other to generate the comparison result. In Article 16, The above time information comparison process is: A time modulation prevention method characterized in that the first unique code is sequentially generated for a plurality of error values within a preset error range based on the first time error. In Article 17, The above time information comparison process is: A time tampering prevention method characterized by checking whether, among the plurality of first unique codes sequentially generated for the plurality of error values, there is one that matches the previously stored time error information. In paragraph 12, The above service judgment process is: A time tamper prevention method characterized in that, based on the comparison result, identification information of the FoD service, information on whether the FoD service is activated, and a validity period are obtained from the certificate, and activation or deactivation of the FoD service is determined based on the validity period and the information on whether the FoD service is activated. In paragraph 12, The above service judgment process is: A time tamper prevention method characterized in that, if the comparison result means that the first time error information and the previously stored time error information are identical to each other, the FoD service is activated or deactivated according to the information on whether the FOD service is activated in the certificate.