JP2018053489A - Smart key system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a smart key system capable of changing a security level against relay attack according to necessity.SOLUTION: The smart key system includes a first transmission unit transmitting a first signal to a mobile device, a first receiving unit receiving a second signal from the mobile device, a second receiving unit receiving the first signal, a detection unit detecting a radio field intensity of the first signal that has been received, a second transmission unit transmitting, in a case where the first signal is received, the second signal including authentication information unique to the mobile device and a detection value that the detection unit detects, an authentication unit authenticating the mobile device based on the authentication information included in the second signal when the second signal is received, a control unit allowing a door to unlock or a vehicle to activate if the detection value included in the second signal is equal to or less than a predetermined threshold value in a case where a specific operation has been conducted to the vehicle and the authentication of the mobile device has been successful, the control unit inhibiting the door to unlock and the vehicle to activate if the detection value is not less than the predetermined threshold value, and a setting changing unit changing the predetermined threshold value depending on an external request.SELECTED DRAWING: Figure 2

Description

  The present invention relates to a smart key system.

  Conventionally, when a user carries a smart key, the door of the vehicle is locked and unlocked, the engine of the vehicle is started (or the electric vehicle is driven) based on bidirectional communication between the vehicle (on-vehicle device) and the portable device. A smart key system capable of starting up a power supply for a computer is known. Specifically, an LF (Low Frequency) signal is transmitted from the vehicle (on-vehicle device), the smart key that has received the LF signal transmits an RF (Radio Frequency) signal, and the on-vehicle device receives the RF signal. The in-vehicle device authenticates the smart key based on the information included in the received RF signal, and performs door locking / unlocking, engine starting, and the like based on the authentication result.

  With regard to such a smart key system, a vehicle theft method called a relay attack is known. Since the LF signal transmitted from the vehicle-mounted device is transmitted so as to reach only a limited area around the vehicle inside or outside the vehicle compartment, the smart key owned by the user located outside the area is LF The signal cannot be received. On the other hand, in relay attack, a malicious third party uses a repeater to transmit an LF signal transmitted from an in-vehicle device even though the user who owns the portable device exists outside the area. By relaying to the smart key, it becomes possible to unlock the door, start the engine, and the like. For this reason, various techniques for preventing a relay attack have been proposed (see, for example, Patent Document 1).

  In Patent Literature 1, there is a method for determining a relay attack based on the correlation between the RSSI (Received Signal Strength Indicator) value of the LF signal received by the smart key in the relay attack and the RSSI value of the RF signal received by the vehicle-mounted device. Proposed.

  In addition, the relay attack that is the subject of the present application is used in the sense that it is limited to a mode in which only the request signal transmitted from the vehicle-mounted device is relayed and transmitted to the smart key by using the repeater. A mode in which a response signal transmitted from the smart key is relayed and transmitted to the vehicle is not included.

JP 2012-060482 A

  However, in Patent Document 1, a case where the correlation between both RSSI values deviates from a fixed predetermined range is determined as a relay attack. For this reason, when it is desired to change the security according to the user's will, the security situation around the vehicle, or the like, it is not possible to change the range determined to be a relay attack.

  Then, in view of the said subject, it aims at providing the smart key system which can change the security with respect to a relay attack according to necessity.

In order to achieve the above object, in this embodiment,
A smart key system for unlocking the door of the vehicle or starting the vehicle based on bidirectional communication between the vehicle and a portable device,
A first transmitter that is provided in the vehicle and transmits a first signal to the portable device;
A first receiver that is provided in the vehicle and receives a second signal transmitted from the portable device;
A second receiving unit provided in the portable device for receiving the first signal transmitted from the vehicle;
A detection unit that is provided in the portable device and detects a radio field intensity of the first signal received by the second reception unit;
When the second receiving unit is provided in the portable device and the second receiving unit receives the first signal, the second signal including authentication information unique to the portable device and the detection value of the detecting unit is A second transmitter for transmitting to the vehicle;
An authentication unit that is provided in the vehicle and that authenticates the portable device based on the authentication information included in the second signal when the first reception unit receives the second signal;
The detection value included in the second signal is less than or equal to a predetermined threshold when a predetermined operation is performed on the operation unit of the vehicle and the authentication of the portable device is successful by the authentication unit. The door of the vehicle is unlocked or the vehicle is activated, and when the detected value included in the second signal is not less than a predetermined threshold, the door of the vehicle is unlocked, and the vehicle A control unit prohibiting activation;
A setting changing unit provided in the vehicle and changing the predetermined threshold according to an external request;
A smart key system is provided.

  According to this embodiment, when the radio field intensity of the first signal received by the portable device (second receiving unit) is not equal to or less than the predetermined threshold, the vehicle door is unlocked and the vehicle is started (engine start or engine start of the engine vehicle). Car power supply) is prohibited. Normally, when a relay attack is performed, a malicious third party attempts to establish communication from a place as far away as possible from the user who owns the portable device. Therefore, the radio field intensity of the first signal output from the repeater is In many cases, it is larger than the output intensity of the transmitted first signal. Therefore, the radio field intensity of the first signal received by the portable device via the repeater is larger than when the portable device directly receives the first signal transmitted from the vehicle. Therefore, the vehicle theft by the relay attack can be made difficult by appropriately setting the predetermined threshold value. In addition, since the predetermined threshold can be changed in response to an external request, for example, the security against relay attacks can be changed according to the necessity of a request from a user, a request from a security situation, or the like. Can do.

  According to the present embodiment, it is possible to provide a smart key system capable of changing the security against a relay attack according to necessity.

It is a block diagram showing roughly an example of composition of a smart key system concerning a 1st embodiment. It is a flowchart which shows roughly an example of the smart entry process by collation ECU. It is a flowchart which shows roughly the other example of the smart entry process by collation ECU. It is a block diagram which shows roughly an example of a structure of the smart key system which concerns on 2nd Embodiment.

  Hereinafter, embodiments for carrying out the invention will be described with reference to the drawings.

[First Embodiment]
FIG. 1 is a block diagram schematically showing an example of the configuration of a smart key system 1 according to the present embodiment. The smart key system 1 is based on bidirectional communication between the vehicle 2 and a smart key 3 (an example of a portable device) that is registered in advance in the vehicle 2 (a verification ECU 10 described later) and can be carried by the user. The door 2 is unlocked and the vehicle 2 is turned on (IG-ON). In other words, the smart key system 1 has a smart entry function, for example, a function in which the user carries the smart key 3 and locks / unlocks the door only by touching the lock / unlock sensor (locking / unlocking operation unit 13) of the door handle. The user can carry the function of turning on the vehicle 2 simply by carrying the smart key 3 and pressing a predetermined button (IG operation unit 15) in the passenger compartment.

  The IG-ON of the vehicle 2 represents the start of the vehicle 2 and includes the start of the engine in the engine vehicle and the start (power ON) of the high-voltage power source (power source for the drive motor) in the electric vehicle. In the present embodiment, the description will proceed on the assumption that the vehicle 2 is an engine vehicle.

  The vehicle 2 includes a verification ECU (Electronic Control Unit) 10, an LF transmission unit 11, an RF reception unit 12, a locking / unlocking operation unit 13, a body ECU 14, an IG operation unit 15, an engine ECU 16, a security ECU 20, and an HMI (Human Machine Interface) device. 30 is included.

  The verification ECU 10 is an electronic control unit that performs various control processes for realizing the smart entry function. The functions of various ECUs (body ECU 14, engine ECU 16, security ECU 20, smart key ECU 70, etc.) of this embodiment including the verification ECU 10 may be realized by arbitrary hardware, software, or a combination thereof. Hereinafter, the description will proceed on the assumption that the various ECUs are configured mainly with a microcomputer including a CPU, a RAM, a ROM, an I / O, and the like.

  The verification ECU 10 includes an LF transmission processing unit 101, an RF reception processing unit 102, an authentication processing unit 103, an unauthorized signal determination unit 104, a smart unit as functional units realized by executing one or more programs stored in the ROM. A control unit 105 is included. The verification ECU 10 includes a storage unit 110 as a storage area defined in a nonvolatile internal memory such as an EEPROM (Electrically Erasable Programmable Read-Only Memory).

  The LF transmission processing unit 101 controls the LF transmission unit 11 to perform processing of transmitting LF band radio waves (for example, radio waves of 30 kHz to 300 kHz) to at least one of the vehicle interior and the vehicle exterior. For example, the LF transmission processing unit 101 periodically sends a wake signal (polling signal) from the LF transmission unit 11 to the smart key 3 outside the vehicle compartment at a predetermined timing, for example, during a period when the vehicle 2 is IG-OFF. ). For example, when a predetermined operation is performed on the locking / unlocking operation unit 13, the LF transmission processing unit 101 transmits a wake signal to the smart key 3 outside the vehicle compartment from the LF transmission unit 11. For example, when a predetermined operation is performed on the IG operation unit 15, the LF transmission processing unit 101 transmits a wake signal to the smart key 3 in the vehicle interior from the LF transmission unit 11. The wake signal is a signal for waking up the smart key 3. For example, the LF transmission processing unit 101 transmits a request signal (an example of a first signal) to the smart key 3 from the LF transmission unit 11 in response to a transmission request from the authentication processing unit 103.

  The RF reception processing unit 102 controls the RF reception unit 12 to perform processing for receiving RF band radio waves (for example, radio waves of 30 MHz to 3 GHz). For example, the RF reception processing unit 102 receives an ACK signal transmitted from the smart key 3 that has received the wake signal. For example, the RF reception processing unit 102 receives a response signal transmitted from the smart key 3 that has received the request signal (challenge signal).

  The authentication processing unit 103 (an example of the authentication unit) is authentication information unique to the smart key 3 included in the response signal (an example of the second signal) received by the RF reception processing unit 102, for example, unique to the smart key 3. Authentication of the smart key 3 is performed based on an ID (Identification) 7101 that is an identifier of the ID and a “response” by an encryption key 7102 unique to the smart key 3. Specifically, when the RF reception processing unit 102 receives an ACK signal from the smart key 3, the authentication processing unit 103 starts processing for authenticating the validity of the smart key 3 (hereinafter simply referred to as authentication processing). . As a method for authenticating the validity of the smart key 3, for example, an arbitrary method such as ID collation, challenge response authentication, or a combination thereof is employed. In the case of ID collation, the authentication processing unit 103 collates the ID 7101 included in the response signal received by the RF reception processing unit 102 with the master ID 1101 registered (stored) in the storage unit 110 in advance. The validity of the smart key 3 is authenticated (authentication success). In the case of challenge-response authentication, the authentication processing unit 103 generates an encryption code (so-called “challenge”) that can be decrypted with the encryption key 7102 unique to the smart key 3, and sends a transmission request to the LF transmission processing unit 101. As a result, the LF transmission processing unit 101 transmits a request signal (challenge signal) including “challenge” from the LF transmission unit 11 to the smart key 3 as described above. Further, when the smart key 3 receives the challenge signal, the smart key 3 transmits to the vehicle 2 a response signal including a decryption result (so-called “response”) of the encryption code included in the challenge signal by the encryption key 7102. Then, the authentication processing unit 103 collates the decryption result of the “challenge” encryption key (the same as the encryption key 7102) with the “response”, and if they match, authenticates the validity of the smart key 3 (successful authentication). ).

  The unauthorized signal determination unit 104 is transmitted in response to whether or not the response signal received by the RF reception processing unit 102 is an unauthorized signal, that is, in response to a request signal received via a malicious third party repeater. It is determined whether or not the signal is the same. In other words, the unauthorized signal determination unit 104 determines whether or not a relay attack is being performed. The unauthorized signal determination unit 104 determines that the RSSI value included in the response signal, that is, the RSSI value indicating the radio wave intensity of the request signal received by the smart key 3, is not less than or equal to the threshold 1102 stored in the storage unit 110 (that is, the threshold 1102 If the response signal is an illegal signal, the response signal is determined to be an illegal signal. Usually, a malicious third party tries to establish communication at a position as far as possible from the owner who owns the smart key 3. Therefore, the radio field intensity of the request signal output from the repeater is often sufficiently larger than the radio field intensity of the request signal transmitted from the vehicle 2 (for example, the radio field intensity exceeding the upper limit value of the Radio Law). Therefore, when the relay attack is performed, the radio signal intensity of the request signal received by the smart key 3 is relatively large. Therefore, when the RSSI value exceeds the threshold 1102 that is set as appropriate, the relay attack is performed. Judgment can be made.

  As described above, the LF transmitter 11 may include a plurality of LF transmitters. In this case, the unauthorized signal determination unit 104 determines that the response signal is an unauthorized signal when at least one of the RSSI values indicating the radio field strengths of the request signals from the plurality of LF transmitting units received by the smart key 3 is not equal to or less than the threshold value 1102. judge.

  Further, the unauthorized signal determination unit 104 performs a process of changing the threshold 1102 of the storage unit 110 in response to a change request received from the security ECU 20. Specifically, the unauthorized signal determination unit 104 updates the threshold value 1102 of the storage unit 110 with the changed value included in the change request.

  The smart control unit 105 (an example of a control unit) performs control for realizing the smart entry function based on the authentication result of the smart key 3 by the authentication processing unit 103 and the determination result by the unauthorized signal determination unit 104. For example, the smart control unit 105 performs an illegal signal when a predetermined operation (for example, a contact operation or a pressing operation) is performed on the locking / unlocking operation unit 13 and the authentication of the smart key 3 by the authentication processing unit 103 is successful. When the determination unit 104 determines that the response signal is not an unauthorized signal, it outputs a request for unlocking the door of the vehicle 2 or a request for locking to the body ECU 14. Thereby, when the body ECU 14 receives the unlocking request or the locking request, the body ECU 14 controls a locking / unlocking device (not shown) such as a door lock motor, and unlocks or locks the door of the vehicle 2. For example, the smart control unit 105 performs an unauthorized signal determination unit when a predetermined operation (for example, a pressing operation) is performed on the IG operation unit 15 and the authentication of the smart key 3 by the authentication processing unit 103 is successful. When it is determined by 104 that the response signal is not an illegal signal, a request to start the engine of the vehicle 2 is output to the engine ECU 16. Thus, the engine ECU 16 controls the starter, the engine ignition device, the fuel injection device, etc. (all not shown) and starts the engine. On the other hand, when a predetermined operation is performed on the locking / unlocking operation unit 13 or the IG operation unit 15 and the authentication of the smart key 3 by the authentication processing unit 103 is successful, the smart control unit 105 performs an unauthorized signal determination unit 104. When it is determined that the response signal is an illegal signal, unlocking of the door of the vehicle 2 and activation of the vehicle 2 are prohibited, that is, the smart entry function is stopped. Details of the smart entry process by the verification ECU 10 regarding the smart entry function will be described later.

  The LF transmission unit 11 (an example of a first transmission unit) includes a transmission antenna, and transmits LF band radio waves (signals) under the control of the verification ECU 10 (LF transmission processing unit 101). For example, the LF transmitter 11 includes an LF transmitter that transmits LF band radio waves to the outside of the passenger compartment, and an LF transmitter that transmits LF band radio waves to the passenger compartment. In addition, for example, the LF transmitter 11 includes a plurality of LF transmitters provided corresponding to each of a plurality of doors provided in the vehicle 2 as LF transmitters that transmit LF band radio waves outside the passenger compartment.

  The RF receiving unit 12 (an example of a first receiving unit) includes a receiving antenna, and receives radio waves (signals) in the RF band under the control of the verification ECU 10 (RF reception processing unit 102).

  The locking / unlocking operation unit 13 (an example of the operation unit) is provided on, for example, a door handle of the vehicle 2, and an operation input (for example, a contact operation or a pressing operation) for unlocking or locking the door by the user of the vehicle 2. ) Is performed. The locking / unlocking operation unit 13 is connected to the verification ECU 10 via a one-to-one communication line or an in-vehicle network such as a CAN (Controller Area Network), and signals related to the operation state of the locking / unlocking operation unit 13 are transmitted to the verification ECU 10. Is done.

  The body ECU 14 is an electronic control unit that controls a door locking / unlocking device or the like of the vehicle 2. The body ECU 14 is communicably connected to the verification ECU 10 through an in-vehicle network such as CAN, and receives a signal (locking request, unlocking request, etc.) from the verification ECU 10.

  The IG operation unit 15 (another example of the operation unit) is provided on, for example, an instrument panel on the driver's seat in the passenger compartment, and an operation for starting the vehicle 2 by the user, that is, an operation for starting the engine. Input is made. The IG operation unit 15 is connected to the verification ECU 10 through a one-to-one communication line or a vehicle-mounted network such as CAN, and a signal related to the operation state of the IG operation unit 15 is transmitted to the verification ECU 10.

  The engine ECU 16 is an electronic control unit that controls the engine of the vehicle 2 (specifically, a starter, an ignition device, a fuel injection device, etc.). The engine ECU 16 is communicably connected to the verification ECU 10 through an in-vehicle network such as CAN, and receives a signal (such as a start request) from the verification ECU 10.

  The security ECU 20 is an electronic control unit that performs processing for changing a setting related to security for a relay attack. The security ECU 20 includes a display control unit 201 and a setting change unit 202 as functional units realized by executing one or more programs stored in the ROM.

  Note that some or all of the functions of the security ECU 20 may be realized by other ECUs. For example, part or all of the functions of the security ECU 20 may be realized by the verification ECU 10.

  The display control unit 201 performs processing for displaying various screens on the HMI device 30 (display unit 31). Specifically, the display control unit 201 generates images corresponding to various screens and outputs them to the HMI device 30. For example, the display control unit 201 causes the display unit 31 to display a setting screen for changing the setting of the threshold value 1102 stored in the verification ECU 10 (storage unit 110) according to a predetermined operation by the user. Further, for example, when an operation for changing the threshold value 1102 is performed on the setting screen, the display control unit 201 clearly indicates the current value and the changed value, and determines whether the threshold value 1102 may be changed. A confirmation screen to be confirmed is displayed on the display unit 31. Further, for example, the display control unit 201 is a case where an operation for changing the threshold value 1102 is performed on the setting screen, and there is an influence such as a part of usability (usability) being limited. Is displayed on the display unit 31 on the confirmation screen or as another attention display screen.

  The setting change unit 202 performs a process of changing the threshold value 1102 according to an operation of a user or a worker of a dealer on the HMI device 30 (operation input unit 32). For example, when the user performs an operation of changing the threshold value 1102 on the setting screen of the display unit 31 using the operation input unit 32, the setting change unit 202 requests a change of the threshold value 1102 according to the operation content. A change request is transmitted to verification ECU10. At this time, the setting changing unit 202 changes to the verification ECU 10 after confirming that not only the operation of changing the threshold value 1102 on the setting screen but also the user's predetermined operation on the above-described confirmation screen and caution display screen has been performed. Send a request. As described above, the change request includes a changed value corresponding to the user's operation content on the setting screen.

  The HMI device 30 is provided in the passenger compartment, and displays various information for the user, and receives various operations from the user for the notification content. The HMI device 30 includes a display unit 31 and an operation input unit 32.

  The display unit 31 is, for example, a liquid crystal display, and displays the above-described setting screen, confirmation screen, caution display screen, and the like under the control of the security ECU 20 (display control unit 201).

  The operation input unit 32 is an operation means for the user to operate various screens of the display unit 31. The operation input unit 32 is, for example, a touch panel on the surface of the display unit 31 (liquid crystal display), a touch pad provided separately from the display unit 31, a click wheel, or the like.

  The smart key 3 (an example of a portable device) includes an LF receiver 40, an RF transmitter 50, an RSSI detection circuit 60, and a smart key ECU 70.

  The LF reception unit 40 includes a reception antenna, and receives LF band radio waves under the control of a smart key ECU 70 (an LF reception processing unit 701 described later).

  The RF transmission unit 50 includes a transmission antenna, and transmits radio waves in the RF band under the control of a smart key ECU 70 (an RF transmission processing unit 702 described later).

  The RSSI detection circuit 60 (an example of a detection unit) detects the radio field intensity of radio waves in the LF band received by the LF reception unit 40. For example, the RSSI detection circuit 60 detects the radio field intensity of the request signal received by the LF receiver 40 and transmits the detection signal to the smart key ECU 70.

  The smart key ECU 70 is an electronic control unit that performs various control processes for realizing various functions of the smart key 3. The smart key ECU 70 includes an LF reception processing unit 701, an RF transmission processing unit 702, and a signal generation unit 703 as functional units realized by executing one or more programs on the CPU. The smart key ECU 70 includes a storage unit 710 as a storage area defined in a nonvolatile internal memory such as an EEPROM.

  The LF reception processing unit 701 controls the LF reception unit 40 to perform processing for receiving radio waves in the LF band. For example, the LF reception processing unit 701 receives a wake signal, a request signal, and the like transmitted from the vehicle 2.

  The smart key ECU 70 is normally in a sleep state in which functions other than the function of receiving radio waves in the LF band (ie, the LF reception processing unit 701) are stopped, and the wake signal received by the LF reception processing unit 701. Due to this, other functions get up.

  The RF transmission processing unit 702 controls the RF transmission unit 50 to perform processing for transmitting radio waves in the RF band. For example, the RF transmission processing unit 702 transmits an ACK signal to the vehicle 2 in response to a transmission request from the signal generation unit 703. For example, the RF transmission processing unit 702 transmits a response signal to the vehicle 2 in response to a transmission request from the signal generation unit 703.

  The signal generation unit 703 generates a signal to be returned to the vehicle 2 according to the content of the signal received from the vehicle 2 by the LF reception processing unit 701, and performs processing to transmit to the vehicle 2 through the RF transmission processing unit 702. For example, when the LF reception processing unit 701 receives a wake signal transmitted from the vehicle 2, the signal generation unit 703 generates an ACK signal and sends a transmission request to the RF transmission processing unit 702. In addition, when the LF reception processing unit 701 receives a request signal transmitted from the vehicle 2, the signal generation unit 703 receives authentication information unique to the smart key 3 and the radio wave of the request signal received by the RSSI detection circuit 60. A response signal including the detected intensity value (RSSI value) is generated, and a transmission request is sent to the RF transmission processing unit 702. As described above, the authentication information unique to the smart key 3 includes an ID 7101 that is an identifier unique to the smart key 3, a “response” that is a decryption result of the “challenge” encryption key 7102 included in the request signal, and the like. It can be done. The ID 7101 and the encryption key 7102 are registered (stored) in the storage unit 710 in advance.

  Next, with reference to FIG. 2 and FIG. 3, the process flow of the smart entry process by collation ECU10 is demonstrated.

  First, FIG. 2 is a flowchart schematically showing an example of smart entry processing by the verification ECU 10. This flowchart is repeatedly executed at predetermined time intervals when, for example, the vehicle 2 is parked, that is, when the vehicle 2 is in the IG-OFF state and the function stop flag F is “0”. The

  The function stop flag F is a flag for stopping the execution of the smart entry function. The function stop flag F has an initial value of “0”, and when it is set to “1” by the process described later, the process according to this flowchart is not executed, so the execution of the smart entry function is stopped.

  In step S <b> 102, the LF transmission processing unit 101 controls the LF transmission unit 11 to perform processing for transmitting a wake signal (polling signal) to the smart key 3.

  In step S <b> 104, the RF reception processing unit 102 determines whether or not the ACK signal transmitted from the smart key 3 is received through the RF reception unit 12. When the RF reception processing unit 102 receives an ACK signal from the smart key 3, the process proceeds to step S106. When the RF reception processing unit 102 does not receive the ACK signal within a predetermined time, the RF reception processing unit 102 ends the current process.

  In step S <b> 106, the LF transmission processing unit 101 controls the LF transmission unit 11 in response to the transmission request from the authentication processing unit 103 and transmits a request signal to the smart key 3.

  In step S108, the RF reception processing unit 102 determines whether or not the response signal transmitted from the smart key 3 has been received through the RF reception unit 12. The RF reception processing unit 102 proceeds to step S110 when a response signal is received from the smart key 3, and ends the current process when the response signal is not received within a predetermined time.

  In step S110, the authentication processing unit 103 performs authentication processing of the smart key 3.

  In step S112, the authentication processing unit 103 determines whether the authentication of the smart key 3 is successful. If the authentication of the smart key 3 is successful, the authentication processing unit 103 proceeds to step S114. If the authentication of the smart key 3 is unsuccessful, the authentication processing unit 103 ends the current process.

  In step S114, the unauthorized signal determination unit 104 determines whether or not the response signal is an unauthorized signal based on the RSSI value included in the response signal received by the RF reception processing unit 102 (that is, a relay attack is performed). Whether or not). The illegal signal determination unit 104 proceeds to step S116 if the response signal is not an illegal signal, and proceeds to step S120 if the response signal is an illegal signal.

  In step S116, the smart control unit 105 determines whether a predetermined operation has been performed on the locking / unlocking operation unit 13 or the IG operation unit 15. If the predetermined operation is performed, the smart control unit 105 proceeds to step S118. If the predetermined operation is not performed within the predetermined time, the smart control unit 105 ends the current process.

  In step S118, the smart control unit 105 performs control for realizing the smart entry function, and ends the current process. That is, the smart control unit 105 transmits a door unlocking request or locking request of the vehicle 2 to the body ECU 14 in accordance with a predetermined operation on the locking / unlocking operation unit 13 to realize unlocking or locking of the door. Further, the smart control unit 105 transmits an engine start request to the engine ECU 16 in accordance with a predetermined operation on the IG operation unit 15 to realize engine start.

  On the other hand, in step S120, the smart control unit 105 sets the function stop flag F to “1” and ends the current process. As a result, the process according to this flowchart, that is, the process for realizing the smart entry function is stopped in a situation where it can be determined that the relay attack is being performed, and thus it is difficult to steal the vehicle 2 by the relay attack. it can.

  The function stop flag F may be initialized to “0” when, for example, a sufficient time (for example, several hours) is assumed that a malicious third party gives up theft by relay attack. Thereby, since the stop period of a smart entry function becomes temporary, the fall of a user's convenience can be suppressed. In addition, the function stop flag F is, for example, a request signal (request signal for unlocking or locking the door of the vehicle 2, a request signal for starting the vehicle 2) by other means from the smart key 3 or the vehicle 2 (verification ECU 10). May be initialized to “0”. This is because when the vehicle 2 receives a request signal from another means, it is possible to determine that the possibility of vehicle theft by relay attack is low. For example, the request signal by other means includes a request signal (RF signal) by a remote keyless entry function using the operation unit of the smart key 3, a request signal by a transponder communication function using the transponder of the smart key 3, and the like. . The remote keyless entry function requires the user to operate the operation unit of the smart key 3, and the transponder communication function requires the distance between the vehicle 2 and the smart key 3 to be short. Thus, it is possible to determine the situation in which the door of the vehicle 2 is locked and unlocked and the vehicle 2 is activated. That is, it can be determined that the possibility of vehicle theft due to a relay attack is low.

  FIG. 3 is a flowchart schematically showing another example of the smart entry process performed by the verification ECU 10. This flowchart is similar to FIG. 2, for example, when the vehicle 2 is in a parking state, that is, when the vehicle 2 is in an IG-OFF state and the function stop flag F is “0”. It is executed repeatedly at intervals.

  As in the case of FIG. 2, the function stop flag F has an initial value of “0”. If the function stop flag F is set to “1” by the process described later, the process according to this flowchart is not executed. Execution is stopped.

  In step S202, the smart control unit 105 determines whether a predetermined operation has been performed on the locking / unlocking operation unit 13 or the IG operation unit 15. When the predetermined operation is performed, the smart control unit 105 proceeds to step S204, and when the predetermined operation is not performed, the smart control unit 105 ends the current process.

  In step S <b> 204, the LF transmission processing unit 101 controls the LF transmission unit 11 to perform processing for transmitting a wake signal for the smart key 3.

  In step S206, the RF reception processing unit 102 determines whether or not the ACK signal transmitted from the smart key 3 has been received through the RF reception unit 12 as in step S104. If the RF reception processing unit 102 receives an ACK signal from the smart key 3, the process proceeds to step S208. If the ACK signal is not received within a predetermined time, the RF reception processing unit 102 ends the current process.

  In step S208, the LF transmission processing unit 101 controls the LF transmission unit 11 in response to a transmission request from the authentication processing unit 103 and sends a request signal (challenge signal) to the smart key 3 in the same manner as in step S106. Send.

  In step S210, the RF reception processing unit 102 determines whether or not the response signal transmitted from the smart key 3 has been received through the RF reception unit 12 as in step S108. The RF reception processing unit 102 proceeds to step S110 when a response signal is received from the smart key 3, and ends the current process when the response signal is not received within a predetermined time.

  In step S212, the authentication processing unit 103 performs the authentication process for the smart key 3 as in step S110.

  In step S214, the authentication processing unit 103 determines whether the authentication of the smart key 3 has succeeded, as in step S112. If the authentication of the smart key 3 is successful, the authentication processing unit 103 proceeds to step S216. If the authentication of the smart key 3 is unsuccessful, the authentication processing unit 103 ends the current process.

  In step S216, the unauthorized signal determination unit 104 determines whether the response signal is an unauthorized signal based on the RSSI value included in the response signal received by the RF reception processing unit 102, as in step S114. The illegal signal determination unit 104 proceeds to step S218 when the response signal is not an illegal signal, and proceeds to step S220 when the response signal is an illegal signal.

  In step S218, the smart control unit 105 performs control for realizing the smart entry function as in step S118, and ends the current process.

  On the other hand, in step S220, the smart control unit 105 sets the function stop flag F to “1” as in step S120, and ends the current process. As a result, as in the case of FIG. 2, the process according to this flowchart, that is, the process for realizing the smart entry function is stopped in a situation where it can be determined that the relay attack is being performed. Theft can be difficult.

  As in the case of FIG. 2, the function stop flag F is set to “0” when a sufficient time (for example, several hours) assumed that a malicious third party gives up theft by the relay attack elapses. May be initialized. As in the case of FIG. 2, for example, the function stop flag F is received by the vehicle 2 (verification ECU 10) by a request signal from the smart key 3 by another means (a request signal by a remote keyless entry function or a transponder communication function). In this case, it may be initialized to “0”. Thereby, there exists an effect | action and effect similar to the case of FIG.

  As described above, in the present embodiment, when the radio wave intensity of the request signal (first signal) received by the smart key 3 (LF receiver 40) is not less than or equal to the predetermined threshold (threshold 1102), the door of the vehicle 2 is unlocked. And the start of the vehicle 2 (engine start of the engine car or start of the power source for driving the electric car) is prohibited. As described above, when a relay attack is performed, a malicious third party attempts to establish communication from a place as far away as possible from the user who owns the smart key 3, so the radio wave intensity of the request signal output by the repeater is 2 is often larger than the output intensity of the request signal transmitted from 2. Therefore, the radio field intensity of the request signal received by the smart key 3 via the repeater is larger than when the smart key 3 directly receives the request signal transmitted from the vehicle 2. Therefore, by appropriately setting the predetermined threshold value (threshold value 1102), it is possible to make vehicle theft by relay attack difficult. In the present embodiment, the threshold 1102 can be changed according to a request from the outside, specifically, a request from a user of the vehicle 2 through the HMI device 30 or the like. Therefore, security against relay attack can be changed according to a request from a user or the like.

  In the present embodiment, the threshold 1102 is changed from the in-vehicle HMI device 30, but the threshold 1102 may be changed from the outside of the vehicle 2. For example, a configuration in which an external tool is connected to the vehicle 2 via a DLC (Data Link Coupler) connector and a command for requesting a change of the threshold 1102 from the external tool to the in-vehicle network to which the verification ECU 10 belongs may be possible. In this case, the verification ECU 10 (incorrect signal determination unit 104) changes the threshold value 1102 after determining whether or not the external tool is a regular tool through bidirectional communication with the external tool.

[Second Embodiment]
Next, a smart key system 1A according to the second embodiment will be described.

  The smart key system 1A according to the present embodiment is mainly configured in the first embodiment in that the security ECU 20A (setting changing unit 202A) changes the security, that is, the threshold value 1102 according to the security situation around the vehicle 2. And different. Hereinafter, the same components as those in the first embodiment will be denoted by the same reference numerals, and description will be made focusing on portions different from the first embodiment.

  FIG. 4 is a block diagram schematically showing an example of the configuration of the smart key system 1A according to the present embodiment. Similar to the first embodiment, the smart key system 1A is based on bidirectional communication between the vehicle 2A and the smart key 3 that is registered in advance in the vehicle 2A (verification ECU 10) and can be carried by the user. The door is unlocked and the vehicle 2A is IG-ON. That is, the smart key system 1A realizes a smart entry function as in the first embodiment.

  The vehicle 2A includes a verification ECU 10, an LF transmission unit 11, an RF reception unit 12, a locking / unlocking operation unit 13, a body ECU 14, an IG operation unit 15, an engine ECU 16, a security ECU 20A, a GPS (Global Positioning System) device 21A, and a DCM (Data Communication). Module) 22A and HMI device 30.

  As in the first embodiment, the security ECU 20A is an electronic control unit that performs a process for changing a setting relating to security against a relay attack. The security ECU 20A includes a display control unit 201A and a setting change unit 202A as functional units realized by executing one or more programs stored in the ROM.

  Note that some or all of the functions of the security ECU 20A may be realized by other ECUs. For example, part or all of the functions of the security ECU 20A may be realized by the verification ECU 10.

  The display control unit 201A performs a process of displaying various screens on the HMI device 30 (display unit 31), as in the first embodiment. For example, when the setting change of the threshold value 1102 stored in the verification ECU 10 (storage unit 110) is performed by the setting change unit 202A, the display control unit 201A clearly indicates the current value and the changed value, and sets the threshold value 1102 A confirmation screen for confirming whether or not the change can be made is displayed on the display unit 31. Further, for example, the display control unit 201A is a case where the setting change unit 202A changes the setting of the threshold value 1102 stored in the verification ECU 10 (storage unit 110), and the usability (usability) is partially limited. Or the like is displayed on the display unit 31 on the confirmation screen or as another attention display screen.

  The setting changing unit 202A performs a process of changing the threshold value 1102 based on the position information of the vehicle 2A received from the GPS device 21A and the information on the security situation received through the DCM 22A. For example, when the vehicle 2 is IG-OFF, the setting change unit 202A controls the DCM 22A to request a remote information server to distribute information (security information) related to the security situation near the current position of the vehicle 2 ( Request signal). At this time, the setting changing unit 202A transmits a request signal including the current position information of the vehicle 2 received from the GPS device 21A to the remote information server. When the setting change unit 202A receives the security information from the remote information server through the DCM 22A, the setting change unit 202A derives a recommended value of the threshold value 1102 corresponding to the security level (degree of security) included in the security information. For example, a map representing the correspondence relationship between the security level set in advance in a plurality of stages and the recommended value of the threshold value 1102 is stored in the nonvolatile internal memory of the security ECU 20, and the setting changing unit 202A includes the security level included in the security information. Based on the level and the map, a recommended value for the threshold 1102 is derived. When the security level is defined in such a manner that the security level becomes worse as the security level value becomes larger, the map may be defined so that the recommended value of the threshold value 1102 becomes smaller as the security level value becomes larger. . Thereby, when the value of the security level is large and the security situation is bad, the threshold 1102 becomes a relatively small value, so that the probability that the unauthorized signal determination unit 104 determines that the relay attack is being performed is increased, Security can be improved. When the recommended value for the threshold value 1102 is derived, the setting changing unit 202A compares the current threshold value 1102 with the current threshold value 1102 and, if different, transmits a change request for changing the threshold value 1102 to the derived recommended value to the verification ECU 10. At this time, the setting changing unit 202A transmits a change request to the verification ECU 10 after confirming that the user's predetermined operation has been performed on the above-described confirmation screen and caution display screen.

  The security level is set based on a predetermined evaluation standard such as a crime rate.

  The GPS device 21A receives GPS signals distributed from three or more GPS satellites orbiting the earth orbit, and measures the position of the vehicle 2A based on the GPS signals (GPS positioning). The GPS device 21A is communicably connected to the security ECU 20A through a one-to-one communication line or an in-vehicle network such as CAN, and transmits a positioning result (GPS position information) to the security ECU 20A.

  The DCM 22A is a communication device for communicating with a remote information server through a predetermined communication network (for example, a mobile phone network or an Internet network terminated with a base station) under the control of the security ECU 20A.

  As described above, in the present embodiment, the threshold 1102 is set according to a request from the outside, specifically, a request from the security level included in the information on the security situation around the vehicle 2A distributed from the external information server. Can be changed. Therefore, the security against the relay attack can be changed according to the security situation at the current position of the vehicle 2.

  In the present embodiment, the DCM 22A is used to connect to an external information server so as to be communicable. For example, the mobile terminal of the user of the vehicle 2 can be used to communicate with an external information server. It may be a mode of connecting to. Similarly, in the present embodiment, the position information of the vehicle 2 is acquired using the GPS device 21 </ b> A. For example, the position information of the vehicle 2 using the GPS function built in the mobile terminal of the user of the vehicle 2. May be obtained. In this case, the user's mobile terminal and the vehicle 2 (security ECU 20A) are communicably connected via short-range wireless communication such as Bluetooth (registered trademark) communication, a cable, or the like. In the present embodiment, the security ECU 20A obtains information on the security situation from a remote information server, but it may be stored in advance in a nonvolatile internal memory. In this case, the information related to the security situation stored in advance in the internal memory of the security ECU 20A may be map information representing the correspondence between the pre-segmented regional division and the security level. Thereby, the setting changing unit 202A can recognize the corresponding area section from the position information of the vehicle 2 received from the GPS device 21A, and can derive the security level corresponding to the recognized area section from the map information.

  As mentioned above, although the form for implementing this invention was explained in full detail, this invention is not limited to this specific embodiment, In the range of the summary of this invention described in the claim, various Can be modified or changed.

1, 1A Smart key system 2, 2A Vehicle 3 Smart key (portable device)
10 Verification ECU
11 LF transmitter (first transmitter)
12 RF receiver (first receiver)
13 Locking / unlocking operation unit (operation unit)
14 Body ECU
15 IG operation unit (operation unit)
16 Engine ECU
20, 20A Security ECU
40 LF receiver (second receiver)
50 RF transmitter (second transmitter)
60 RSSI detection circuit (detection unit)
70 Smart Key ECU
101 LF transmission processing unit 102 RF reception processing unit 103 authentication processing unit (authentication unit)
104 Illegal signal determination unit 105 Smart control unit (control unit)
202, 202A Setting change unit 701 LF reception processing unit 702 RF transmission processing unit 1102 Threshold (predetermined threshold)
7101 ID (information for authentication)

Claims (1)

A smart key system for unlocking the door of the vehicle or starting the vehicle based on bidirectional communication between the vehicle and a portable device,
A first transmitter that is provided in the vehicle and transmits a first signal to the portable device;
A first receiver that is provided in the vehicle and receives a second signal transmitted from the portable device;
A second receiving unit provided in the portable device for receiving the first signal transmitted from the vehicle;
A detection unit that is provided in the portable device and detects a radio field intensity of the first signal received by the second reception unit;
When the second receiving unit is provided in the portable device and the second receiving unit receives the first signal, the second signal including authentication information unique to the portable device and the detection value of the detecting unit is A second transmitter for transmitting to the vehicle;
An authentication unit that is provided in the vehicle and that authenticates the portable device based on the authentication information included in the second signal when the first reception unit receives the second signal;
The detection value included in the second signal is less than or equal to a predetermined threshold when a predetermined operation is performed on the operation unit of the vehicle and the authentication of the portable device is successful by the authentication unit. The door of the vehicle is unlocked or the vehicle is activated, and when the detected value included in the second signal is not less than a predetermined threshold, the door of the vehicle is unlocked, and the vehicle A control unit prohibiting activation;
A setting changing unit provided in the vehicle and changing the predetermined threshold according to an external request;
Smart key system.

Images