JP2014150425A - Control system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a control system which can prevent damage by a relay attack.SOLUTION: An electronic key 3 comprises a GPS unit 35 for calculating its own location. When the key 3 receives an LF (Long Frequency) signal requesting ID reply, the key 3 transmits the calculated position of the key with an ID 34 as an RF (Radio Frequency) signal. A vehicle 2 can calculate its own position by a navigation ECU 7. When the vehicle 2 receives the RF signal, and if the key 3 locates at an appropriate position from the position of the vehicle (close to the vehicle 2, for example) and collation of the received ID is successful, the vehicle 2 permits unlocking doors, starting its engine, etc..

Description

  The present invention relates to a control system.

  A smart key system (registered trademark) of a vehicle is widespread. In the current smart key system, for example, a signal in the LF band that requests an electronic key to return an ID (identification signal) periodically or when a user performs an operation such as a door handle contact or an engine start switch depression. (Hereinafter referred to as LF signal) is transmitted. When the ID transmitted from the electronic key is compared with the master ID stored on the vehicle side, door unlocking, engine starting, etc. are permitted.

  For example, in Patent Document 1 below, in the smart key system, a means for determining whether or not the occupant intends to continue driving is equipped, and the portable device is separated from the vehicle, and driving continues for those who do not have the portable device. A system is disclosed that permits the restart of the internal combustion engine when there is an intention to prevent theft of the vehicle more reliably.

JP 2007-153190 A

  A theft technique called relay attack is known for smart key systems. An example is shown in FIG. In this method, criminals A and B are located between the vehicle and the owner in a situation where the owner is away from the vehicle. Assume that the owner carries the vehicle's authorized electronic key. Criminals A and B have radio wave repeaters.

  In this state, first, criminals A and B relay the LF signal transmitted from the vehicle and transmit it to the owner's place. Usually, the reach range of the LF signal is limited to the vicinity of the vehicle, but the LF signal can reach the owner by relaying the criminals A and B. When the electronic key carried by the owner of the vehicle receives the LF signal, the electronic key unique ID stored in the electronic key is returned as a radio signal (RF signal).

  When the returned RF signal reaches the vehicle, the vehicle executes a verification process between the received RF signal and the master ID. Since the RF signal is a signal transmitted from the electronic key owned by the owner, the verification is naturally successful. As a result, the vehicle is allowed to unlock the door. Thus, the criminal can invade the vehicle.

  Further, when the same procedure is repeated after the criminal A gets on the vehicle, the vehicle interior verification is successful and the engine start of the vehicle is permitted. Thus, the criminal can drive the vehicle. The above is an example of the relay attack (note that there is a pattern in which the criminal C intervenes, which will be described later). Effective measures against such relay attacks are necessary.

  Therefore, in view of the above, the problem to be solved by the present invention is to provide a control system capable of preventing damage caused by a relay attack.

  In order to achieve the above object, a control system according to the present invention includes first acquisition means (S110) for acquiring position information of a portable device carried by a user, and identification information that is information for identifying the portable device. Including the identification information and the position information acquired by the first acquisition means when the portable device receives a request signal that is a signal transmitted from a vehicle to request the portable device to transmit A transmission means (S120) for transmitting a transmission signal, which is a signal, from the portable device, a second acquisition means (S30) for acquiring position information of the vehicle, and provided in the vehicle and transmitted from the transmission means. Receiving the transmission signal, the position of the portable device indicated by the position information included in the received transmission signal is within a predetermined area including the position of the vehicle acquired by the second acquisition means, and received did If the identification information included in the signal signal is identification information of the portable device associated with the vehicle, characterized by comprising a, a permission means for permitting a predetermined operation (S80) in the vehicle. According to this invention, it is determined not only that the identification signal of the portable device is collated, but also that the portable device is within a predetermined area including the vehicle. Therefore, when there is no key in a predetermined area (for example, close to the vehicle), the predetermined operation in the vehicle is not permitted, so that damage due to the relay attack can be effectively prevented.

The figure which shows the 1st structural example in one Embodiment of the control system of this invention. The flowchart which shows the 1st example of the process sequence in a control system. The flowchart which shows the 2nd example of the process sequence in a control system. The figure which shows the 2nd structural example in one Embodiment of the control system of this invention. The figure which shows the example of a relay attack.

  Embodiments of the present invention will be described below with reference to the drawings. First, FIG. 1 is a schematic diagram of an apparatus configuration of a vehicle control system 1 according to the present invention. A system 1 shown in FIG. 1 includes a collation control unit (ECU: Electronic Control Unit) 4 provided in a vehicle 2 and an electronic key 3 (smart key, key, portable device) that can be carried by a user. The vehicle 2 may be an automobile, for example.

  The verification ECU 4 includes an LF transmitter 40 and an RF receiver 41. For example, a plurality of LF transmitters 40 are installed in the door handle portion or the vehicle interior of the vehicle 2 and transmit a signal (LF signal) in an LF (long wave) band. The transmitted LF signal is a signal for requesting the electronic key to return an ID. Examples of the form of the LF signal include a polling signal that is periodically transmitted and a request signal that is transmitted in response to a door handle contact or an engine start switch operation by a user. The RF receiving unit 41 is installed in, for example, the vehicle interior and receives an RF signal transmitted from the outside of the vehicle or the vehicle interior.

  The verification ECU 4 has a normal computer structure, and includes a CPU that controls various calculations and information processing, a RAM that is a temporary storage unit as a work area of the CPU, and a nonvolatile memory 42 that stores various information. It is assumed that a master ID 43 is stored in the memory 42.

  The door 5 of the vehicle 2 is equipped with a lock mechanism 50 and a touch sensor 51. The door is locked or unlocked by the lock mechanism 50. The touch sensor 51 is a sensor that is mounted on the outer side door handle of the vehicle 2 and detects that the user has gripped the door handle.

  The vehicle 2 also includes an engine start switch 6 in the passenger compartment. The engine start switch 6 is a switch for starting an engine (or a drive unit including an electric motor) in the smart key system, and is a switch for starting the engine when operated by a user in a state where the vehicle interior verification is successful. The vehicle 2 includes a navigation ECU 7 (navigation ECU). The navigation ECU 7 receives a GPS signal transmitted from a GPS satellite by the GPS receiver 70, and calculates the position (latitude, longitude) of the vehicle 2 by a known calculation method. Each of the above units is connected by in-vehicle communication (for example, CAN) and can exchange information.

  The key 3 is an electronic key related to the smart key system, which can be carried by the user, and includes an LF receiver 30, an RF transmitter 31, a controller 32, a memory 33, and a GPS unit 35. The memory 33 is a non-volatile storage unit, and an identification signal 34 (ID code, ID) unique to the key 3 is stored.

  The LF receiver 30 receives the above-described LF signal. Upon receiving the LF signal, the RF transmitter 31 transmits the ID code 34 unique to the key 3 as an RF signal. The control unit 32 has the same structure as a normal computer, and includes a CPU for various information processing, a RAM of a temporary storage unit as a work area of the CPU, and the like. The GPS unit 35 receives the GPS signal and calculates the position (latitude, longitude) of the key 3 by a known calculation method. The control unit 32 controls the equipment of the key 3 such as the LF reception unit 30, the RF transmission unit 31, the memory 33, and the GPS unit 35.

  In the configuration of FIG. 1, the system 1 executes a process related to the smart key system in the vehicle 2 including a process for preventing theft by a relay attack. An example of the processing procedure is shown in FIG. The processing procedure on the verification ECU 7 side in FIG. 2 (and FIG. 3 to be described later) may be programmed in advance and stored in, for example, the memory 42 and called by the verification ECU 4 and automatically executed. Further, the processing on the key 3 side in FIG. 2 is also programmed and stored in the memory 33, and the control unit 32 may automatically execute it. In the processing example in FIG. 2, the processing on the right side is processing by the regular key 3 of the vehicle 2.

  In the process of FIG. 2, the collation ECU 4 first determines whether or not a user operation on the vehicle 2 has been detected in S10. Here, the user operation is, for example, that the user touches the touch sensor 51 by gripping the outer side door handle of the vehicle 2 or the user operates the engine start switch 6. If a user operation is detected (S10: YES), the process proceeds to S20. If no user operation is detected (S10: NO), S10 is repeated to wait for the user operation. After proceeding to S20, the verification ECU 4 transmits an LF signal from the LF transmitter 40. At that time, if the user operation is a touch sensor contact, the transmission is performed from the LF transmission unit of the door, and if the user operation is an engine start switch operation, the transmission is performed from the LF transmission unit in the passenger compartment. .

  The key 3 receives the LF signal transmitted in S20 by the LF receiver 30 in S100. Next, the key 3 is S110, and the GPS unit 35 calculates the position (latitude, longitude) of the key 3 at that time. In S120, the key 3 transmits an RF signal including both the ID 34 unique to the key 3 and the position information calculated in S110 from the RF transmission unit 31.

  On the other hand, collation ECU4 acquires the position (latitude, longitude) of vehicle 2 at that time from navigation ECU7 via in-vehicle communication at S30. Then, the verification ECU 4 determines whether or not an RF signal has been received in S40. When the RF signal is received (S40: YES), the process proceeds to S50, and when the RF signal is not received (S40: NO), the process proceeds to S70.

  After proceeding to S50, the verification ECU 4 determines whether or not the key 3 is in an appropriate position from the position information of the key 3 included in the RF signal confirmed to be received in S40. Here, the appropriate position is, for example, a position sufficiently close to the vehicle 2 and may be a position where it can be considered that no relay attack is performed. Therefore, for example, a range where the LF signal reaches from the vehicle 2 may be used. What range should be determined as an appropriate position may be determined in advance. For example, the inside of a circle having a predetermined radius (for example, the reach distance of the LF signal) centered on the position of the vehicle 2 may be set as the appropriate position. If the key 3 is in such an appropriate position (S50: YES), the process proceeds to S60, and if not (S50: NO), the process proceeds to S70.

  After proceeding to S60, the verification ECU 4 performs verification between the ID 34 and the master ID 44 included in the RF signal confirmed to be received at S30, and determines whether the verification is successful. If the collation is successful (S60: YES), the process proceeds to S80, and if the collation is unsuccessful (S60: NO), the process proceeds to S70.

  After proceeding to S70, the verification ECU 4 determines whether or not the elapsed time has exceeded a predetermined time. Here, the elapsed time may be, for example, the elapsed time after transmitting the LF signal in S20. If the elapsed time exceeds the predetermined time (S70: YES), the processing of FIG. 2 is terminated. If the predetermined time has not been exceeded (S70: NO), the process returns to S40 and waits for reception of the RF signal.

  After proceeding to S80, the verification ECU 4 permits a predetermined operation in the vehicle 2. Here, the predetermined operation may be the door unlocking operation when the user operation at S10 is a touch to the touch sensor 51, and the engine operation when the user operation at S10 is the operation of the engine start switch 6. It may be a start. The above is an example of the processing procedure in FIG.

  As described above, in the process of FIG. 2, in the smart key system, not only the identification of the ID but also the position information of the vehicle 2 and the key 3 is used and the key 3 is not in the proper position (for example, too far from the vehicle 2) Do not allow door unlocking or engine starting. Therefore, damage due to relay attack can be effectively prevented.

  The processing procedure of FIG. 2 may be modified as shown in FIG. In the processing procedure of FIG. 3, S45 and S115 are added to FIG. The processes with the same reference numerals in FIGS. 2 and 3 are the same unless otherwise described, and thus the duplicate description is omitted.

  In S115, the control unit 32 of the key 3 encrypts the entire data including the ID 34 unique to the key 3 and the position information calculated in S110. The encryption key may be determined in advance. In step S120 of FIG. 3, the control unit 32 transmits the data encrypted in step S115 from the RF transmission unit 31 as an RF signal. In step S45, the verification ECU 4 performs a decryption process on the RF signal confirmed to be received in step S40 with the same encryption key as that in step S115.

  Thus, in the process of FIG. 3, the encryption procedure is incorporated into the process procedure of FIG. The advantage of incorporating encryption as shown in FIG. 3 is that it can cope with a relay attack in which a criminal C intervenes in FIG. 5, for example. In this form, the criminal C is responsible for receiving the RF signal transmitted from the key 3 in S120, changing it, and transmitting it to the vehicle 2. Specifically, the criminal C changes the position information of the key 3 included in the RF signal to the position information in the vicinity of the vehicle 2 by the process of FIG.

  Even with such a relay attack, if the processing procedure of FIG. 3 is used, the criminal C cannot change the position information in the RF signal because the RF signal is encrypted. Therefore, the processing procedure of FIG. 3 can cope with such a relay attack and realize high security.

  The system configuration of FIG. 1 may be modified as shown in FIG. In the system 1 ′ in FIG. 4, a mobile phone 8 is used instead of the electronic key 3. In FIG. 1 and FIG. 4, the parts with the same reference numerals are the parts with the same function, and thus redundant explanation is omitted. Note that the mobile phone 8 may include a smartphone or the like.

  The cellular phone 8 includes a CPU 80, a memory 81, a GPS unit 82, a line communication unit 83, and a short-range wireless communication unit 84. The CPU 80 governs overall information processing in the mobile phone 8. The memory 81 is a storage unit for information processing in the CPU 80, and includes a volatile storage unit (RAM) and a nonvolatile storage unit. In particular, the memory 81 stores a program 810 obtained by programming the processing procedure on the mobile phone 8 side according to the present invention. The GPS unit 82 receives a GPS signal and calculates the position (latitude, longitude) of the mobile phone 8. The line communication unit 83 performs wireless communication such as a telephone call and data communication through a public telephone line network (including a mobile phone line network). The short-range wireless communication unit 84 performs short-range wireless communication based on a short-range wireless communication standard (for example, Bluetooth (registered trademark) or Wi-fi (registered trademark)).

  The vehicle 2 in FIG. 4 includes the line communication unit 44 and the short-range wireless communication unit 45 instead of the LF transmission unit 40 and the RF reception unit 41 from the configuration of FIG. The line communication unit 44 performs wireless communication such as a telephone call or data communication through a public telephone line network (including a mobile phone line network). The short-range wireless communication unit 45 performs short-range wireless communication based on a short-range wireless communication standard. However, the near field communication unit 84 and the near field communication unit 45 belong to the same standard and can communicate with each other.

  The processing of FIG. 2 or 3 may be performed even under the configuration of FIG. At that time, transmission and reception at S20 and S40 are performed using the line communication unit 44 (or near field communication unit 45), and reception and transmission at S100 and S120 are performed at the line communication unit 83 (or near field communication unit). 84). The position calculation in S110 may be performed by the GPS unit 82. The processing procedure on the portable device side in FIGS. 2 and 3 may be processed by the mobile phone 8 by the CPU 80 executing the program 810. With such a configuration of FIG. 4, the communication function and GPS function of the existing mobile phone can be effectively utilized and shared, so that a new system configuration can be reduced in cost.

  Embodiments of the present invention may be modified as appropriate without departing from the spirit and scope of the claims. For example, the electronic key 3 and the mobile phone 8 described above are not limited to these, and any wireless communication device that can be carried by the user, such as a computer with a wireless communication function (such as a notebook computer or a tablet computer), is used. Also good. Further, the user operation in S10 of FIG. 2 and the predetermined operation in S80 are not limited to the above example, and may include the operation of the door lock button and the door locking provided on the outer handle of the door. Operations may be included.

1 Control System 2 Vehicle 3 Electronic Key (Portable Machine)
4 verification ECU

Claims (5)

First acquisition means (S110) for acquiring position information of the portable device (3, 8) carried by the user;
When the portable device receives a request signal that is a signal transmitted from the vehicle (2) to request the portable device to transmit identification information that is information for identifying the portable device, the identification is performed. Transmitting means (S120) for transmitting a transmission signal, which is a signal including information and position information acquired by the first acquisition means, from the portable device;
Second acquisition means (S30) for acquiring positional information of the vehicle;
The vehicle, which is provided in the vehicle, receives the transmission signal transmitted from the transmission unit, and the position of the portable device indicated by the position information included in the received transmission signal is acquired by the second acquisition unit Permission to permit a predetermined operation in the vehicle when the identification information included in the predetermined area including the position of the vehicle is the identification information of the portable device associated with the vehicle Means (S80);
A control system characterized by comprising: The transmission means includes an encryption means (S115) for encrypting the transmission signal with a predetermined encryption key before transmission,
The control system according to claim 1, wherein the permission unit includes a decoding unit (S45) for decoding the received transmission signal.   The control system according to claim 1, wherein the predetermined area is a range where the request signal reaches from a position of the vehicle. The portable device is a cellular phone (8);
The control system according to any one of claims 1 to 3, wherein the portable device includes a storage unit (81) that stores a program that causes the portable device to function as the first acquisition unit and the transmission unit.   The control system according to claim 4, wherein the transmission means is a line communication unit (83) that performs wireless communication through a public telephone line or a short-range wireless communication unit (84) that performs short-range wireless communication.

Images