JP2019108680A - On-vehicle control device, on-vehicle control system, on-vehicle control method, and computer program - Google Patents

Abstract

To provide an on-vehicle control device, on-vehicle control system, on-vehicle control method, and computer program.SOLUTION: An on-vehicle control device comprises: an operation unit for receiving operation related to an actuation request for an accessory mounted in a vehicle; and a transmission unit for transmitting a response request signal for requesting a response to a portable apparatus when the operation unit receives the operation; the on-vehicle control device actuating the accessory when the portable apparatus is authenticated on the basis of a response signal from the portable apparatus in response to the response request signal. The on-vehicle control device comprises: a detection unit for detecting the existence of the portable apparatus; and a transmission stopping unit that stops transmission of the response request signal when the operation is received by the operation unit without the detection unit detecting the existence of the portable apparatus.SELECTED DRAWING: Figure 4

Description

  The present invention relates to an in-vehicle control device, an in-vehicle control system, an in-vehicle control method, and a computer program.

  A vehicle communication system for locking and unlocking a vehicle door without using a mechanical key has been put to practical use. Specifically, a keyless entry system that locks or unlocks a vehicle door by wireless remote control using a portable device carried by the user, a user carrying the portable device approaches the vehicle, or only holds the door handle The smart entry (registered trademark) system and the like for unlocking the vehicle door has been put to practical use (see, for example, Patent Document 1). A vehicle communication system for starting a vehicle engine without using a mechanical key is also in practical use. Specifically, a push-start system has been put into practical use, in which a user carrying a portable device starts an engine simply by pressing an engine start button. Furthermore, when a user carrying a portable device approaches a vehicle, a welcome light system has been put to practical use, which turns on the interior light or the exterior light.

  In the above-described vehicle communication system, the in-vehicle control device performs wireless communication with the portable device. In the wireless communication, various signals are transmitted from the transmission antenna of the on-vehicle control device to the portable device using radio waves in the LF (low frequency) band, and the portable device receiving the signals uses the radio waves in the RF (radio frequency) band And by transmitting a response signal. The on-vehicle control device performs control of unlocking, locking, engine start, welcome light lighting, etc. after authentication and position confirmation of the portable device.

JP, 2015-101908, A

  The signal transmitted from the on-vehicle control device is a signal of the LF band, and the transmission range of the signal is limited to a predetermined range around the vehicle. For this reason, the portable device receives the signal of the LF band transmitted from the in-vehicle control device, and the signal of the RF band is returned from the portable device as a response. It is limited to the case where the occupant is inside or around the vehicle.

  However, by using a relay that relays the signal of the LF band transmitted from the in-vehicle controller to the portable device and the signal of the RF band transmitted from the portable device to the in-vehicle controller, the occupant carrying the portable device Even when the vehicle is away from the vehicle, communication can be performed between the on-vehicle control device and the portable device. When an unauthorized access to the in-vehicle control device occurs due to the relay attack using such a relay machine, there is a possibility that a malicious third party may execute the door lock release, the engine start, the power transition, and the like.

  The present invention has been made in view of such circumstances, and it is an object of the present invention to provide an on-vehicle control device, an on-vehicle control system, an on-vehicle control method, and a computer program that can suppress unauthorized access due to relay attack.

  The on-vehicle control device according to an aspect of the present application requests a response to the portable device when the operation unit receives an operation relating to a start request of an accessory mounted on a vehicle, and the operation unit receives the operation. An on-vehicle control device for starting the accessory when the portable device is authenticated based on a response signal from the portable device in response to the response request signal. A detection unit for detecting the presence of a portable device, and a transmission stop unit for stopping transmission of the response request signal when the operation unit receives the operation without detecting the presence of the portable device by the detection unit And

  An on-vehicle control system according to an aspect of the present application requests an operation unit that receives an operation related to a start request of an accessory mounted on a vehicle, and a response to the portable device when the operation unit receives the operation. An on-vehicle control device having a transmission unit for transmitting a response request signal, and a portable device for transmitting a response signal when the response request signal from the on-vehicle control device is received, the portable device for the response request signal An on-vehicle control system that starts the accessory when the portable device is authenticated based on a response signal from the control unit, wherein the on-vehicle control device detects the presence of the portable device by a detection unit, and the detection unit And a transmission stop unit that stops transmission of the response request signal when the operation unit receives the operation without detecting the presence of the portable device.

  An on-vehicle control system according to an aspect of the present application requests an operation unit that receives an operation related to a start request of an accessory mounted on a vehicle, and a response to the portable device when the operation unit receives the operation. An on-vehicle control device having a transmission unit for transmitting a response request signal, and a portable device for transmitting a response signal when the response request signal from the on-vehicle control device is received, the portable device for the response request signal An on-vehicle control system that starts the accessory when the portable device is authenticated based on a response signal from the mobile communication device, wherein the on-vehicle control device includes a detection unit that detects the presence of the portable device, the portable device An acquisition unit for acquiring a detection result from the detection unit from the on-vehicle control device, and the response signal when the response request signal is received without the presence of the portable device being detected by the detection unit; And a transmission stopping unit for stopping the transmission.

  The on-vehicle control method according to an aspect of the present invention transmits a response request signal for requesting a response to the portable device when receiving an operation related to a start request for an accessory mounted on the vehicle, and transmits the response request signal An on-vehicle control method for starting the accessory when the portable device is authenticated based on a response signal from the portable device, wherein the presence of the portable device is detected and the presence of the portable device is not detected. When the operation is accepted, transmission of the response request signal is stopped.

  The computer program according to an aspect of the present invention transmits a response request signal for requesting a response to the portable device when receiving an operation related to a start request for an accessory mounted in a vehicle, and transmits the response request signal to the portable device. It is a program for starting the equipment when the portable device is authenticated based on a response signal from the portable device, and the presence of the portable device is detected and the presence of the portable device is not detected. It is a computer program for making a computer perform processing which stops transmission of the said response request signal, when the said operation is received.

  According to the present application, it is possible to suppress unauthorized access due to a relay attack.

FIG. 1 is a schematic view illustrating a schematic configuration of an in-vehicle control system according to a first embodiment. It is a block diagram explaining an internal configuration of an in-vehicle control device. It is a block diagram explaining an internal configuration of a portable machine. It is a flowchart explaining the procedure of the process which the vehicle-mounted control apparatus which concerns on Embodiment 1 performs. It is a flowchart explaining the procedure of the process which the vehicle-mounted control apparatus which concerns on Embodiment 2 performs. It is a flowchart explaining the procedure of the process which the portable machine which concerns on Embodiment 3 performs.

  Embodiments of the present invention will be listed and described. In addition, at least part of the embodiments described below may be arbitrarily combined.

  The on-vehicle control device according to an aspect of the present application requests a response to the portable device when the operation unit receives an operation relating to a start request of an accessory mounted on a vehicle, and the operation unit receives the operation. An on-vehicle control device for starting the accessory when the portable device is authenticated based on a response signal from the portable device in response to the response request signal. A detection unit for detecting the presence of a portable device, and a transmission stop unit for stopping transmission of the response request signal when the operation unit receives the operation without detecting the presence of the portable device by the detection unit And

  In the above one aspect, when detecting an operation by a third party whose normal procedure has not been followed, it is determined that there is a possibility that a relay attack has occurred, and a response request for requesting a response signal from the portable device Stop transmission of the signal. With such a configuration, it is possible to prevent the relay attack from starting the engine and unlocking the vehicle door.

  The on-vehicle control device according to an aspect of the present invention further includes a release unit that releases the transmission stop of the response request signal when an instruction to release the transmission stop of the response request signal is received from the portable device.

  In the above aspect, even when the on-vehicle control device prohibits the start of the accessory, the prohibition can be canceled by the operation of the appropriate occupant.

  The on-vehicle control device according to an aspect of the present invention further includes a release unit that cancels the transmission stop of the response request signal when a set time has elapsed since the transmission of the response request signal is stopped.

  In the above aspect, even when the on-vehicle control device prohibits the start of the accessory, the prohibition can be canceled when the set time has elapsed.

  The on-vehicle control device according to an aspect of the present invention further includes a notification unit that notifies that the transmission of the response request signal is stopped when the transmission stop unit stops the transmission of the response request signal.

  In the above one aspect, since the notification that the transmission of the detection signal has stopped is made, it is possible to notify the occupant of the occurrence of the unauthorized access due to the relay attack.

  The on-vehicle control device according to an aspect of the present invention further includes a lighting control unit that turns on a vehicle light when the detection unit detects the presence of the portable device.

  In the above aspect, when an operation relating to a request for starting equipment is received while the welcome function is not performed, it is determined that an operation by a third party who has not been subjected to a formal procedure is detected. it can.

  In the in-vehicle control device according to one aspect of the present application, the accessory is an engine or a battery system for driving provided in the vehicle, or a door lock mechanism that locks or unlocks a door of the vehicle.

  In the above aspect, when it is determined that an unauthorized access may occur due to a relay attack, it is possible to prevent the start of the engine or drive battery system provided in the vehicle and the unlocking of the vehicle door.

  An on-vehicle control system according to an aspect of the present application requests an operation unit that receives an operation related to a start request of an accessory mounted on a vehicle, and a response to the portable device when the operation unit receives the operation. An on-vehicle control device having a transmission unit for transmitting a response request signal, and a portable device for transmitting a response signal when the response request signal from the on-vehicle control device is received, the portable device for the response request signal An on-vehicle control system that starts the accessory when the portable device is authenticated based on a response signal from the control unit, wherein the on-vehicle control device detects the presence of the portable device by a detection unit, and the detection unit And a transmission stop unit that stops transmission of the response request signal when the operation unit receives the operation without detecting the presence of the portable device.

  In the above one aspect, when detecting an operation by a third party whose normal procedure has not been followed, it is determined that there is a possibility that a relay attack has occurred, and a response request for requesting a response signal from the portable device Stop transmission of the signal. With such a configuration, it is possible to prevent the relay attack from starting the engine and unlocking the vehicle door.

  An on-vehicle control system according to an aspect of the present application requests an operation unit that receives an operation related to a start request of an accessory mounted on a vehicle, and a response to the portable device when the operation unit receives the operation. An on-vehicle control device having a transmission unit for transmitting a response request signal, and a portable device for transmitting a response signal when the response request signal from the on-vehicle control device is received, the portable device for the response request signal An on-vehicle control system that starts the accessory when the portable device is authenticated based on a response signal from the mobile communication device, wherein the on-vehicle control device includes a detection unit that detects the presence of the portable device, the portable device An acquisition unit for acquiring a detection result from the detection unit from the on-vehicle control device, and the response signal when the response request signal is received without the presence of the portable device being detected by the detection unit; And a transmission stopping unit for stopping the transmission.

  In the above-mentioned one mode, when there is a possibility that the in-vehicle control device receives an operation by a third party who does not follow the formal procedure, the transmission of the response signal from the portable device to the in-vehicle control device is stopped. With such a configuration, it is possible to prevent the relay attack from starting the engine and unlocking the vehicle door.

  The on-vehicle control method according to an aspect of the present invention transmits a response request signal for requesting a response to the portable device when receiving an operation related to a start request for an accessory mounted on the vehicle, and transmits the response request signal An on-vehicle control method for starting the accessory when the portable device is authenticated based on a response signal from the portable device, wherein the presence of the portable device is detected and the presence of the portable device is not detected. When the operation is accepted, transmission of the response request signal is stopped.

  In the above one aspect, when detecting an operation by a third party whose normal procedure has not been followed, it is determined that there is a possibility that a relay attack has occurred, and a response request for requesting a response signal from the portable device Stop transmission of the signal. With such a configuration, it is possible to prevent the relay attack from starting the engine and unlocking the vehicle door.

  The computer program according to an aspect of the present invention transmits a response request signal for requesting a response to the portable device when receiving an operation related to a start request for an accessory mounted in a vehicle, and transmits the response request signal to the portable device. It is a program for starting the equipment when the portable device is authenticated based on a response signal from the portable device, and the presence of the portable device is detected and the presence of the portable device is not detected. It is a computer program for making a computer perform processing which stops transmission of the said response request signal, when the said operation is received.

  In the above one aspect, when detecting an operation by a third party whose normal procedure has not been followed, it is determined that there is a possibility that a relay attack has occurred, and a response request for requesting a response signal from the portable device Stop transmission of the signal. With such a configuration, it is possible to prevent the relay attack from starting the engine and unlocking the vehicle door.

Hereinafter, the present invention will be specifically described based on the drawings showing the embodiments thereof.
Embodiment 1
FIG. 1 is a schematic view illustrating a schematic configuration of the on-vehicle control system according to the first embodiment. The on-vehicle control system according to the first embodiment includes, for example, an on-vehicle control device 100 mounted on a vehicle C, and a portable device 200 carried by an occupant.

  The in-vehicle control device 100 is, for example, an ECU (Electronic Controller Unit), and integrally performs control related to the operation of the engine provided in the vehicle C, control related to locking and unlocking of the vehicle door, and the like.

  The in-vehicle control device 100 includes a plurality of LF transmission antennas 106 a to 106 e and an RF reception antenna 107 a to perform wireless communication with the portable device 200. The LF transmission antennas 106a to 106e are, for example, antennas provided in the vicinity of each vehicle door provided in the vehicle C or in each tire house, and transmit a signal having a frequency of LF band (hereinafter also referred to as an LF signal). The LF transmission antennas 106a to 106e are provided, for example, in the vicinity of a vehicle door for a driver's seat, a passenger seat, a right rear seat, a left rear seat, and the rear door and in each tire house. The RF receiving antenna 107a is, for example, an antenna incorporated in the on-vehicle control device 100, and receives a signal having a frequency of an RF band (hereinafter also referred to as an RF signal).

  The portable device 200 includes an LF reception antenna 204a and an RF transmission antenna 205a to perform wireless communication with the on-vehicle control device 100 mounted on the vehicle C (see FIG. 3). The LF receiving antenna 204 a is an antenna incorporated in the portable device 200, and receives an LF signal transmitted from the on-vehicle control device 100. Further, the RF transmission antenna 205a is an antenna built in the portable device 200, and for example, when receiving an LF signal transmitted from the in-vehicle control device 100, transmits an RF signal as the response signal to the in-vehicle control device 100.

  In such a vehicle communication system between the on-vehicle control device 100 and the portable device 200, the communication range of wireless communication using an RF signal is about several tens of meters, but the communication range of wireless communication using an LF signal Is about several meters. Therefore, if the portable device 200 receives the LF signal transmitted from the on-vehicle control device 100 and transmits the RF signal as the response signal from the portable device 200, the portable device 200 should be properly possessed. It is limited to the case where the vehicle occupant is present inside or around the vehicle C.

  However, by using a relay that relays the LF signal transmitted from the on-board controller 100 to the portable device 200 and the RF signal transmitted from the portable device 200 to the on-vehicle controller 100, the passenger carrying the portable device 200 can Even in the case of being separated from the vehicle C, communication between the on-vehicle control device 100 and the portable device 200 can be achieved. If an unauthorized access to the in-vehicle control device 100 occurs, there is a possibility that a malicious third party may execute door lock release, engine start, power transition, and the like.

  On the other hand, in the present embodiment, the door lock is released, the engine is started, when an operation that does not follow the normal procedure is received with respect to the operation that requests the start of the engine or the operation that requests the door lock. By employing a configuration in which power supply transition is not performed, unauthorized access due to relay attack is suppressed.

  FIG. 2 is a block diagram for explaining the internal configuration of the on-vehicle control device 100. As shown in FIG. The on-vehicle control device 100 includes a control unit 101, a storage unit 102, an input unit 103, an output unit 104, an in-vehicle communication unit 105, an LF transmission unit 106, and an RF reception unit 107.

  The control unit 101 includes, for example, a central processing unit (CPU), a read only memory (ROM), and a random access memory (RAM). The CPU in the control unit 101 executes the control program stored in the ROM to control the operation of the hardware included in the in-vehicle control device 100, and causes the entire device to function as the in-vehicle device of the present application. The RAM in the control unit 101 stores various data generated during execution of the control program.

  The control unit 101 is not limited to the above configuration, and may be one or more processing circuits including a single core CPU, a multi-core CPU, a microcomputer, a volatile or non-volatile memory, and the like. Further, the control unit 101 may have functions such as a clock for outputting date and time information, a timer for measuring an elapsed time from giving a measurement start instruction to giving a measurement end instruction, and a counter for counting the number.

  The storage unit 102 is formed of, for example, a nonvolatile memory such as an EEPROM (Electronically Erasable Programmable Read Only Memory), and stores various information. Here, various information stored in the storage unit 102 includes, for example, the ID (Identifier) of the vehicle C on which the on-vehicle control device 100 is mounted, the ID of the portable device 200 serving as the communication partner, and authentication of key information used for encryption processing. Information is included.

  The input unit 103 includes an interface for connecting request switches such as the engine start switch 111 and the door lock switch 112.

  The engine start switch 111 is a request switch for receiving a request for starting the engine included in the vehicle C, and is provided on a console inside the vehicle. The door lock switch 112 is a request switch for receiving a request for locking and unlocking the vehicle door, and is provided on a key cylinder, a door handle or the like provided on the vehicle door for the driver's seat. Note that these request switches may be mechanical switches, or may be switches equipped with a sensor that detects the operation of the occupant in a contact system or non-contact system.

  The output unit 104 includes an interface that connects the engine starter 121, the door lock mechanism 122, and the like.

  The engine starter 121 is a starting device for starting the engine of the vehicle C. The door lock mechanism 122 includes a mechanical mechanism for locking and unlocking each vehicle door of the vehicle C, an actuator for electrically operating the mechanical mechanism, and the like.

  The in-vehicle communication unit 105 includes, for example, a CAN communication interface (CAN: Controller Area Network), and is connected to another ECU of the vehicle C via a CAN bus. The in-vehicle communication unit 105 exchanges data with another ECU (not shown) in accordance with the CAN protocol.

  The LF transmission unit 106 includes a signal generation circuit that generates an LF signal based on the signal output from the control unit 101, an amplification circuit that amplifies the generated signal, and the like. The amplified signal is transmitted to the LF transmission antennas 106a to 106e. Send to more outside. The LF transmission unit 106 transmits a detection signal (LF signal) for detecting, for example, the portable device 200 through the LF transmission antennas 106 a to 106 e according to an instruction from the control unit 101. Here, the authentication information stored in the storage unit 102 is added to the LF signal transmitted from the LF transmission unit 106.

  The RF receiving unit 107 is connected to the RF receiving antenna 107a, and includes a receiving circuit that receives an RF signal through the RF receiving antenna 107a. In the present embodiment, the RF receiving unit 107 transmits the RF signal received through the RF receiving antenna 107 a to the control unit 101. The received RF signal includes the authentication information added by the transmission source (for example, the portable device 200), and it can be determined whether or not to authenticate the transmission source using this authentication information.

  The control unit 101 of the in-vehicle control device 100 receives the operation of the engine start switch 111 through the input unit 103, receives an RF signal as a response to the LF signal transmitted from the LF transmission unit 106, and receives the RF signal When the transmission source (portable device 200) is authenticated based on the authentication information included in the above, the control signal is output to the engine starter 121 through the output unit 104 to perform control to start the engine of the vehicle C. Further, the control unit 101 receives the operation of the door lock switch 112 through the input unit 103, receives an RF signal as a response to the LF signal transmitted from the LF transmission unit 106, and is included in the received RF signal. When the transmission source (portable device 200) is authenticated based on the authentication information, a control signal is output to the door lock mechanism 122 through the output unit 104 to perform control to unlock the lock of the vehicle door.

  In the present embodiment, the on-vehicle control device 100 controls the start of the engine. However, when the vehicle C incorporates a drive battery system instead of the engine as a drive source, the drive battery system is started. It may be configured to control. Further, in the present embodiment, for the sake of simplification, the on-vehicle control device 100 is configured to execute control related to starting of the engine and locking and unlocking of the vehicle door. However, control related to starting of the engine is performed. The engine ECU and a door lock ECU that performs control related to locking and unlocking of the vehicle door may be connected to the in-vehicle communication unit 105, and control of these may be performed through the engine ECU and the door lock ECU.

  FIG. 3 is a block diagram for explaining the internal configuration of the portable device 200. As shown in FIG. The portable device 200 includes a control unit 201, a storage unit 202, an operation unit 203, an LF reception unit 204, an RF transmission unit 205, and a notification unit 206.

  The control unit 201 includes, for example, a CPU, a ROM, and the like. The CPU in the control unit 201 controls the operation of each hardware provided in the portable device 200 by executing the control program stored in the ROM, and causes the entire device to function as the portable device of the present application. The control unit 201 may have a function such as a timer that measures an elapsed time from giving a measurement start instruction to giving a measurement end instruction, a counter that counts the number, and the like.

  The storage unit 202 is configured by a non-volatile memory such as an EEPROM and stores various types of information. Here, the various information stored in the storage unit 202 includes, for example, the ID of the portable device 200, the ID of the vehicle C equipped with the on-vehicle control device 100 as the communication partner, and authentication information such as key information used for encryption processing. Be

  The operation unit 203 includes an interface for receiving an operation by a passenger. In the present embodiment, the operation unit 203 includes an unlock button 203a operated when unlocking the door of the vehicle C and a lock button 203b operated when locking the door of the vehicle C. When the unlock button 203a (or the lock button 203b) is operated by the passenger, the operation unit 203 outputs a signal indicating that the unlock button 203a (or the lock button 203b) is operated to the control unit 201. When the control unit 201 receives a signal indicating that the unlock button 203a (or the lock button 203b) has been operated, the control unit 201 sends, to the RF transmission unit 205, a control signal instructing unlocking (or locking) of the door of the vehicle C. Do.

  The LF reception unit 204 is connected to the LF reception antenna 204a, receives the LF signal through the LF reception antenna 204a, measures the signal strength of the received signal, and obtains the RSSI (Received Signal Strength Indicator). It has a circuit etc. When receiving the detection signal transmitted from the in-vehicle control device 100, the LF reception unit 204 acquires the RSSI of the received detection signal, and sends the received detection signal and the acquired RSSI to the control unit 201. When acquiring the detection signal and the RSSI, the control unit 201 executes processing for authenticating the on-vehicle control device 100 of the transmission source, and when it is a detection signal from the on-vehicle control device 100, it transmits RF as a response. A process of transmitting an RF signal from the unit 205 is performed. At this time, the control unit 201 outputs the RSSI and the authentication information to the RF transmission unit 205 in order to add the RSSI of the detection signal and the authentication information of the portable device 200 to the RF signal to be transmitted to the RF transmission unit 205. Do the process.

  The RF transmission unit 205 includes a signal generation circuit that generates an RF signal including RSSI and authentication information based on an instruction from the control unit 201, an amplification circuit that amplifies the generated signal, and the like. It transmits outside from the RF transmission antenna 205a.

  The notification unit 206 includes, for example, an LED (Light Emitting Diode), and emits light in response to a signal transmitted from the in-vehicle control device 100 to notify information notified from the in-vehicle control device 100. Further, the notification unit 206 includes, for example, a vibration element, and is configured to notify the information notified from the on-vehicle control device 100 by vibrating the portable device 200 according to a signal transmitted from the on-vehicle control device 100. It is also good. Furthermore, the notification unit 206 may be configured to include a display unit that displays character information.

Hereinafter, the procedure of the process performed by the in-vehicle control device 100 will be described.
FIG. 4 is a flow chart for explaining the procedure of processing executed by the on-vehicle control device 100 according to the first embodiment. The on-vehicle control device 100 executes the following processing, for example, at regular timing. First, the control unit 101 determines whether a keyless request has been received (step S101). For example, the control unit 101 is keyless by determining whether or not the RF signal transmitted from the RF transmission unit 205 is received when the unlock button 203a is pressed on the operation unit 203 of the portable device 200. Determine if the request has been accepted. When the keyless request is received (S101: YES), the control unit 101 executes a process (for example, unlocking of the vehicle door) corresponding to the keyless request (step S102), and ends the process according to this flowchart.

  If it is determined that the keyless request has not been received (S101: NO), the control unit 101 determines whether the portable device 200 present in the vicinity of the vehicle C has been detected (step S103). At this time, the control unit 101 transmits a detection signal for detecting the portable device 200 from the LF transmission unit 106, and when a response signal to the detection signal is received by the RF reception unit 107, the control signal exists in the vicinity of the vehicle C. It can be determined that the portable device 200 is detected.

  When it is determined that the portable device 200 present in the vicinity of the vehicle C is not detected (S103: NO), the control unit 101 determines whether the request switch operation has been received through the input unit 103 (step S104) . Here, the control unit 101 determines whether the request switch operation has been received by determining whether the engine start switch 111 or the door lock switch 112 has been operated based on the information input through the input unit 103. to decide. If the operation has not been received (S104: NO), the control unit 101 returns the process to step S101.

  If it is determined that the request switch operation has been received (S104: YES), the control unit 101 determines that a relay attack has occurred because there is a possibility that an operation by a third party who has not followed the normal procedure has been received. (Step S105), the smart function is stopped (step S106). In the smart function, when the request switch is operated by a regular passenger, the LF transmission unit 106 transmits an LF signal (response request signal), and when the portable device is authenticated based on the response signal transmitted from the portable device, the engine Start up, unlock the vehicle door, etc. In step S106, the smart function is stopped by, for example, stopping the transmission of the LF signal (response request signal).

  In this embodiment, the smart function is stopped by stopping the transmission of the LF signal (response request signal). However, the LF signal (response request signal) is transmitted each time the request switch is operated. You may In the configuration that transmits the LF signal (response request signal) every time the request switch is operated, the smart function is stopped by ignoring the received response signal and prohibiting engine start, vehicle door lock release, etc. May be

  Next, the control unit 101 determines whether a keyless request has been received (step S107). When the keyless request has not been received (S107: NO), the control unit 101 waits until the keyless request is received. When a keyless request is received (S107: YES), the control unit 101 executes a process (for example, unlocking of a vehicle door) corresponding to the keyless request (step S108), and ends the process of this flowchart.

  When it is determined in step S103 that the portable device 200 is detected (S103: YES), the control unit 101 operates the built-in timer to measure the elapsed time since the detection of the portable device 200, and the input unit It is determined whether the request switch operation has been accepted through 103 (step S109). Also, when it is determined that the portable device 200 is detected in step S103, the control unit 101 may turn on a not-shown interior light to execute a so-called welcome function.

  If it is determined that the request switch operation has been received (S109: YES), there is a high possibility that an operation by a regular passenger who has followed a regular procedure is received, so the control unit 101 performs processing according to the keyless request (for example, vehicle The door is unlocked (step S110), and the process according to this flowchart ends.

  If it is determined that the request switch operation has not been received (S109: NO), the control unit 101 determines whether the set time has elapsed since detecting the portable device 200 (step S111). If the control unit 101 determines that the set time has not elapsed (S111: NO), the process returns to step S109, and if it is determined that the set time has elapsed (S111: YES), the process returns to step S101. .

  As described above, in the first embodiment, when detecting the operation of the request switch by a third party who does not follow the normal procedure, it is determined that there is a possibility that a relay attack has occurred, and the portable device 200 is selected. The transmission of the response request signal requesting the response signal is stopped. With such a configuration, it is possible to prevent the relay attack from starting the engine and unlocking the vehicle door.

Second Embodiment
Although the smart function is stopped when the relay attack is detected in the first embodiment, the stop of the smart function may be canceled when an instruction from a passenger is received.
In the second embodiment, a configuration will be described in which the stop of the smart function is canceled when an instruction from an occupant is received. In addition, since the whole structure of a vehicle communication system and the internal structure of the vehicle-mounted control apparatus 100 and the portable device 200 are the same as that of Embodiment 1, suppose that the description is abbreviate | omitted.

  FIG. 5 is a flowchart for explaining the procedure of processing performed by the on-vehicle control device 100 according to the second embodiment. The in-vehicle control device 100 determines whether the smart function has been stopped according to the same procedure as in the first embodiment (step S201). When the smart function is not stopped (S201: NO), the control unit 101 ends the process of this flowchart without executing the following process.

  If it is determined that the smart function has stopped, the control unit 101 notifies the portable device 200 of information indicating that the smart function has stopped (step S202). The portable device 200 that has received the notification notifies the occupant of the information that the smart function has stopped from the notification unit 206. If communication connection can be established between the in-vehicle control device 100 and a portable terminal such as a mobile phone or a smart phone possessed by a valid passenger, the portable terminal of the passenger is notified that the smart function has stopped. It is also good.

  Next, the control unit 101 determines whether an instruction to release the stop of the smart function has been received (step S203). For example, when the unlocking of the vehicle door is restricted by stopping the smart function, an RF signal indicating that the unlock button 203a has been pressed by the operation unit 203 of the portable device 200 is sent to the RF receiving unit 107. When receiving the keyless request, that is, when receiving the keyless request, it can be determined that the instruction to cancel the stop of the smart function has been received.

  If it is determined that the instruction to cancel the stop of the smart function has been received (S203: YES), the control unit 101 cancels the stop of the smart function (step S204), and ends the process of this flowchart.

  If it is determined that the instruction to cancel the stop of the smart function has not been received (S203: NO), the control unit 101 determines whether the set time has elapsed since the smart function was stopped (step S205). Here, the set time is an appropriate standby time set in advance to release the stop of the smart function.

  If it is determined that the set time has not elapsed (S205: NO), the control unit 101 returns the process to step S203. On the other hand, when it is determined that the set time has elapsed (S205: YES), the control unit 101 cancels the stop of the smart function (step S204), and ends the processing of this flowchart.

  As described above, in the second embodiment, it is possible to notify the portable device 200 carried by a valid occupant that the smart function has stopped. In addition, even when the smart function is stopped in the in-vehicle control device 100, the stop of the smart function can be canceled by the operation of a valid occupant or the elapse of the setting time.

Third Embodiment
In the first and second embodiments, when detecting the operation of the request switch by a third party who has not followed the formal procedure, it is determined that there is a possibility that a relay attack has occurred, and the on-vehicle control device 100 Although transmission of a response request signal for requesting a response signal to the device 200 is stopped, transmission of the response signal may be stopped on the portable device 200 side.
In the third embodiment, a configuration will be described in which transmission of the response signal is stopped on the portable device 200 side. In addition, since the whole structure of a vehicle communication system and the internal structure of the vehicle-mounted control apparatus 100 and the portable device 200 are the same as that of Embodiment 1, suppose that the description is abbreviate | omitted.

  FIG. 6 is a flowchart for explaining the procedure of processing executed by the portable device 200 according to the third embodiment. In the present embodiment, when the presence of the portable device 200 existing in the vicinity of the vehicle C is detected, the on-vehicle control device 100 notifies the portable device 200 that the presence of the portable device 200 has been detected. . The portable device 200 executes the following processing, for example, at regular timing.

  The control unit 201 determines whether the own device (portable device 200) present in the vicinity of the vehicle C is detected by the on-vehicle control device 100 (step S301). That is, when the control unit 201 receives a notification that the portable device 200 has been detected from the in-vehicle control device 100, the control unit 201 determines that the own device (the portable device 200) is detected by the in-vehicle control device 100.

  When it is determined that the own device is not detected by the on-board control device 100 (S301: NO), the control unit 201 transmits a response request transmitted when the request switch operation is accepted through the input unit 103 of the on-vehicle control device 100. It is determined whether a signal has been received (step S302). When the response request signal has not been received (S302: NO), the control unit 201 returns the process to step S301.

  If it is determined that the response request signal has been received (S302: YES), the control unit 201 may have received a relay attack because the on-vehicle control device 100 may have received an operation by a third party who has not taken the normal procedure. Is determined to have occurred (step S303), and transmission of the response signal is stopped (step S304). In the smart function, when the request switch is operated by a regular passenger, the LF transmission unit 106 transmits an LF signal (response request signal), and when the portable device is authenticated based on the response signal transmitted from the portable device, the engine Start up, unlock the vehicle door, etc. In step S304, the smart function is stopped by stopping transmission of the response signal to the response request signal from the on-vehicle control device 100.

  Next, the control unit 201 determines whether a keyless operation has been received (step S305). Here, the keyless operation refers to the operation of the unlock button 203 a or the like provided on the operation unit 203 of the portable device 200. If the keyless operation has not been received (S305: NO), the control unit 201 waits until the keyless operation is received. When the keyless operation is received (S305: YES), the control unit 201 transmits an operation signal (for example, a signal requesting the unlocking of the vehicle door) corresponding to the keyless operation to the on-vehicle control device 100 (step S306) , End the processing according to this flowchart. The on-vehicle control device 100 having received the operation signal from the valid portable device 200 executes a process (for example, unlocking of the vehicle door) according to the operation signal.

  If it is determined in step S301 that the own vehicle has been detected by the in-vehicle control device 100 (S301: YES), the control unit 201 transmits a response when the request switch operation is accepted through the input unit 103 of the in-vehicle control device 100. It is determined whether a request signal has been received (step S307). When the response request signal has not been received (S307: NO), the control unit 201 returns the process to step S301.

  When the response request signal is received (S307: YES), the control unit 201 transmits a response signal to the response request signal to the on-vehicle control device 100 (step S308), and ends the processing according to this flowchart.

  As described above, in the third embodiment, when there is a possibility that the on-board controller 100 receives an operation by a third party who does not follow the formal procedure, a response signal from the portable device 200 to the on-board controller 100 Stop sending With such a configuration, it is possible to prevent the relay attack from starting the engine and unlocking the vehicle door.

  It should be understood that the embodiment disclosed herein is illustrative in all respects and not restrictive. The scope of the present invention is indicated not by the meaning described above but by the claims, and is intended to include all modifications within the meaning and scope equivalent to the claims.

Reference Signs List 100 in-vehicle control device 101 control unit 102 storage unit 103 input unit 104 output unit 105 in-vehicle communication unit 106 LF transmission unit 106a to 106e LF transmission antenna 107 RF reception unit 107a RF reception antenna 111 engine start switch 112 door lock switch 121 engine starter 122 Door lock mechanism 200 portable unit 201 control unit 202 storage unit 203 operation unit 204 LF reception unit 204a LF reception antenna 205 RF transmission unit 205a RF transmission antenna

Claims (10)

An operation unit for receiving an operation relating to a start request of an accessory mounted on a vehicle; and a transmission unit for transmitting a response request signal for requesting a response to the portable device when the operation is received by the operation unit. The on-vehicle control device is configured to start the accessory when the portable device is authenticated based on a response signal from the portable device to the response request signal.
A detection unit that detects the presence of the portable device;
And a transmission stop unit for stopping transmission of the response request signal when the operation unit receives the operation without detecting the presence of the portable device by the detection unit. The on-vehicle control device according to claim 1, further comprising: a release unit that releases the transmission stop of the response request signal when an instruction to release the transmission stop of the response request signal is received from the portable device. The on-vehicle control device according to claim 1, further comprising: a release unit that cancels the transmission stop of the response request signal when a set time has elapsed after stopping the transmission of the response request signal. The notification unit according to any one of claims 1 to 3, further comprising: a notification unit notifying that the transmission of the response request signal is stopped when the transmission stop unit stops the transmission of the response request signal. In-vehicle controller. The on-vehicle control device according to any one of claims 1 to 4, further comprising: a lighting control unit configured to turn on an in-vehicle light when the detection unit detects the presence of the portable device. The in-vehicle control device according to any one of claims 1 to 5, wherein the accessory is an engine or a battery system for driving included in the vehicle, or a door lock mechanism that locks or unlocks a door of the vehicle. . An operation unit for receiving an operation relating to a start request of an accessory mounted on a vehicle; and a transmission unit for transmitting a response request signal for requesting a response to the portable device when the operation is received by the operation unit. And a portable unit for transmitting a response signal when the response request signal from the on-vehicle control unit is received, and the portable unit is determined based on the response signal from the portable unit in response to the response request signal. An on-vehicle control system that starts up the equipment when it is certified.
The on-board controller is
A detection unit that detects the presence of the portable device;
And a transmission stop unit for stopping transmission of the response request signal when the operation unit receives the operation without detecting the presence of the portable device by the detection unit. An operation unit for receiving an operation relating to a start request of an accessory mounted on a vehicle; and a transmission unit for transmitting a response request signal for requesting a response to the portable device when the operation is received by the operation unit. And a portable unit for transmitting a response signal when the response request signal from the on-vehicle control unit is received, and the portable unit is determined based on the response signal from the portable unit in response to the response request signal. An on-vehicle control system that starts up the equipment when it is certified.
The on-board controller is
A detection unit that detects the presence of the portable device;
The portable device is
An acquisition unit for acquiring a detection result by the detection unit from the on-vehicle control device;
And a transmission stop unit for stopping transmission of the response signal when the response request signal is received without the presence of the portable device being detected by the detection unit. When an operation relating to the start request of the equipment mounted on the vehicle is received, a response request signal for requesting a response to the portable device is transmitted, and the above-mentioned response request signal is transmitted based on the response signal from the portable device. An on-vehicle control method for starting up the equipment when a portable device is authenticated,
Detect the presence of the portable device,
When the operation is accepted without detecting the presence of the portable device, the transmission of the response request signal is stopped. When an operation relating to the start request of the equipment mounted on the vehicle is received, a response request signal for requesting a response to the portable device is transmitted, and the above-mentioned response request signal is transmitted based on the response signal from the portable device. It is a program for starting the equipment when the portable device is certified,
Detect the presence of the portable device,
A computer program for causing a computer to execute processing of stopping transmission of the response request signal when the operation is accepted without detecting the presence of the portable device.

Images