JP2019190044A - User access determination system - Google Patents

Abstract

To provide a user access determination system which can reduce the risk of a relay attack with a simple control content.SOLUTION: In a user access determination system which includes an on-vehicle device 100A and a portable device 100B and which conducts wireless communication between the on-vehicle device and the portable device, an on-vehicle control unit 120 measures a first time t1 during which a received signal intensity reaches the maximum value to the minimum value when a user moves away from the vehicle, and a second time t2 during which the received signal intensity reaches the minimum value to the maximum value when the user approaches the vehicle again, on the basis of the change of the received signal intensity with respect to the passage of time, which is grasped by at least one of an on-vehicle communication unit 110 and a portable communication unit 140. When the user approaches the vehicle and is within a predetermined distance of the vehicle, and concurrently when the difference between the first time and the second time is smaller than a predetermined value α, the on-vehicle control unit unlocks the vehicle door and permits starting the vehicle engine.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a user access determination system that reduces the risk of relay attack in a smart entry system.

  As a conventional smart entry system, for example, one described in Patent Document 1 is known. That is, the smart entry system (vehicle wireless communication system) of Patent Document 1 receives the request signal, the on-board device that transmits the first measurement signal, the request signal from the on-vehicle device, and the first measurement signal. In this case, the mobile device includes a portable device that transmits a first response signal including information related to the transmission strength of the second measurement signal to the vehicle-mounted device according to the reception strength.

  The on-vehicle device transmits a second measurement signal in which the transmission strength is set based on the information regarding the transmission strength included in the received first response signal to the portable device. The portable device transmits the second response signal to the vehicle-mounted device when the reception strength of the received second measurement signal corresponds to the information related to the transmission strength included in the first response signal. And the onboard equipment will unlock | release a door lock mechanism, if the response signal of the 2nd time is received. As a result, the risk of relay attack can be reduced.

JP 2017-106255 A

  However, in the smart entry system of Patent Document 1, in order to reduce the risk of relay attack, a request signal, a first measurement signal, a first response signal, 2 It is necessary to exchange the measurement signal for the second time and the response signal for the second time, which requires extremely complicated control.

  In view of the above problems, an object of the present invention is to provide a user access determination system capable of reducing the risk of relay attack with simple control contents.

  In order to achieve the above object, the present invention employs the following technical means.

In the present invention, the vehicle-mounted device (100A) mounted on the vehicle,
In a user access determination system comprising a portable device (100B) carried by a user of a vehicle and performing wireless communication between the on-vehicle device and the portable device,
The vehicle-mounted device periodically transmits an interrogation signal to the portable device and receives a response signal responded from the portable communication unit (140) of the portable device according to the interrogation signal. And a vehicle-mounted control unit (120) that performs the authentication on the response signal, and when the authentication is established, locks and unlocks the vehicle door and gives a start / fail instruction to the vehicle engine,
The in-vehicle control unit
From the change over time of the received signal strength grasped by at least one of the in-vehicle communication unit and the mobile communication unit,
When the user moves away from the communication range from the vehicle, the first time (t1) until the received signal strength reaches the minimum value from the maximum value,
Again, when the user enters the vehicle communication range and approaches the vehicle, the second time (t2) until the received signal strength reaches the maximum value from the minimum value is measured,
When the user approaches the vehicle and is within a predetermined distance of the vehicle, and the difference between the first time and the second time is smaller than a predetermined value (α), the vehicle door is unlocked and the vehicle engine is permitted to start. It is characterized by performing.

  In a relay attack using a repeater, the repeater is generally disposed near a vehicle and near a user's house (near a portable device (100B)) and performs a wireless communication operation. The received signal strength of the response signal received by the communication unit (110) hardly changes with time, and suddenly occurs (rises) with the start of the relay attack. That is, the time corresponding to the second time (t2) is extremely short (FIG. 5B).

  On the other hand, the user usually moves away from the vehicle after using the vehicle, and approaches the vehicle when using the vehicle. Therefore, the received signal strength when the user moves away from the vehicle gradually decreases with time, and the received signal strength when the user approaches the vehicle gradually increases with time (FIG. 5). (A)).

  In the present embodiment, as described above, normally, under the conditions used by the user, the first time (t1) until the received signal strength reaches the minimum value from the maximum value and the received signal strength from the minimum value to the maximum value. If the difference from the second time (t2) until the time is reached is smaller than the predetermined value (α), that is, if the first time (t1) and the second time (t2) are equal, the user's original movement Can be determined. However, if there is a relay attack, the difference between the first time (t1) and the second time (t2) is clearly greater than the predetermined value (α), and it can be determined that there is a risk of relay attack. Since the vehicle door is unlocked and the vehicle engine is permitted to start with this determination, the risk of relay attack can be reduced with simple control contents.

  In order to grasp the change in the received signal strength, the proximity time (t) until the received signal strength reaches the maximum value when the user approaches the vehicle, and a predetermined time (t0) set in advance. A similar effect can be obtained.

  In addition, the code | symbol in the bracket | parenthesis of each said means shows a corresponding relationship with the specific means of embodiment description mentioned later.

It is a block diagram which shows the structure of the user access determination system of this embodiment. It is a flowchart which shows the control content which the vehicle-mounted control part in 1st Embodiment performs. It is a flowchart which shows the control content which the portable control part in 1st Embodiment performs. It is explanatory drawing which shows the time when the received signal strength changes in 1st Embodiment. It is explanatory drawing which shows the received signal strength in the case of a relay attack. It is a flowchart which shows the control content which the vehicle-mounted control part in 2nd Embodiment performs. It is a flowchart which shows the control content which the portable control part in 2nd Embodiment performs. It is explanatory drawing which shows the change time of the received signal strength in 2nd Embodiment. It is explanatory drawing which shows the change time of the received signal strength in 3rd Embodiment.

  A plurality of modes for carrying out the present invention will be described below with reference to the drawings. In each embodiment, parts corresponding to the matters described in the preceding embodiment may be denoted by the same reference numerals, and redundant description may be omitted. When only a part of the configuration is described in each mode, the other modes described above can be applied to the other parts of the configuration. Not only combinations of parts that clearly indicate that the combination is possible in each embodiment, but also a combination of the embodiments even if they are not clearly specified unless there is a problem with the combination. It is also possible.

(First embodiment)
A user access determination system 100 according to the first embodiment will be described with reference to FIGS. The user access determination system 100 according to the first embodiment locks (locks) a vehicle door when getting off and unlocks (unlocks) the vehicle when getting on without directly inserting a key into the key cylinder of the vehicle door. Lock).

  In the vehicle to which the user access determination system 100 is applied, when the vehicle door is unlocked, for example, a light, head ride, or indoor lighting provided on the door mirror is lit. Can have a function.

  As shown in FIG. 1, the user access determination system 100 includes an in-vehicle device 100A mounted on a vehicle and a portable device 100B carried by the user. The vehicle-mounted device 100A and the portable device 100B perform wireless communication with each other.

  The vehicle-mounted device 100A is provided in the vicinity of a vehicle door knob, and includes a vehicle-mounted communication unit 110, a vehicle-mounted control unit 120, a lock switch 131, an unlock switch 132, a door lock motor 133, a door open / closed state detection sensor 134, and an engine switch 135. Etc.

  The in-vehicle communication unit 110 includes a transmission unit 111 and a reception unit 112. The transmission unit 111 uses, for example, an LF (low frequency) wave as a long wave, and transmits an interrogation signal (LF transmission) from the LF transmission antenna provided in the transmission unit 111 to the portable device 100B outside the vehicle by wireless communication. Signal). The interrogation signal is transmitted by a polling method. The polling method does not require an external trigger, and continues to transmit an interrogation signal from the transmission unit 111 periodically (for example, at a predetermined transmission interval such as 250 ms).

  The interrogation signal is a signal that reaches a predetermined distance range outside the vehicle from the transmission unit 111. The predetermined distance range is, for example, a distance range of about 2 m in the case of an LF wave.

  The receiving unit 112 receives a response signal (RF reception signal) by a high frequency, for example, an RF (Radio Frequency) wave transmitted from the portable device 100B, via an RF receiving antenna provided in the receiving unit 112. ing. The receiving unit 112 outputs the received response signal to the in-vehicle control unit 120 as an RF reception signal.

  The in-vehicle control unit 120 outputs an interrogation signal command to the transmission unit 111 of the in-vehicle communication unit 110, and when the reception unit 112 receives the response signal from the portable device 100B, the response signal verification (authentication) is performed. And a control unit (Micro Processing Unit) for instructing whether the vehicle door is locked and unlocked and the vehicle engine is started or not based on the result of the verification (when authentication is established).

  In order to avoid the danger caused by the relay attack, the in-vehicle controller 120 changes the reception signal strength change time (first time t1 and second time) of the interrogation signal received by the portable device 100B in order to avoid the danger caused by the relay attack. Based on time t2), the vehicle door is unlocked and the vehicle engine is allowed to start (details will be described later).

  The lock switch 131 is a switch that locks the vehicle door according to a command from the in-vehicle control unit 120. The unlock switch 132 is a switch that unlocks the vehicle door according to a command from the in-vehicle control unit 120. When the lock switch 131 is turned on, the door lock motor 133 activates and locks the vehicle door lock mechanism, and when the unlock switch 132 is turned on, the door lock motor 133 activates the vehicle door lock mechanism and unlocks it. It is a motor to lock.

  The door open / closed state detection sensor 134 is a sensor that detects the locked / unlocked state of the vehicle door. The engine switch 135 is a switch for starting and stopping the vehicle engine.

  On the other hand, the portable device 100B is a portable key carried by the user, and includes a portable communication unit 140, a portable control unit 150, a remote operation switch 161, a sensor 162, and the like.

  The mobile communication unit 140 includes a reception unit 141 and a transmission unit 142. The reception unit 141 receives the interrogation signal transmitted from the transmission unit 111 of the in-vehicle communication unit 110 by the LF reception antenna provided in the reception unit 141, and grasps the received signal strength when the interrogation signal is received. And output to the portable control unit 150.

  The transmission unit 142 transmits a response signal with a high frequency such as an RF (Radio Frequency) wave output from the portable control unit 150 to the vehicle-mounted device 100A via the RF transmission antenna provided in the transmission unit 142. It has become.

  The portable control unit 150 is a control unit that outputs a response signal required for collation to the transmission unit 142 based on the interrogation signal input from the reception unit 141. In addition, the mobile control unit 150 places the received signal strength grasped by the receiving unit 141 on the response signal and outputs the response signal to the transmitting unit 142.

  The remote operation switch 161 is a switch for locking and unlocking each door of the vehicle by a user's operation regardless of a call signal, for example, a lock switch, an unlock switch, and a trunk switch. Etc. When the user depresses the remote operation switch 161 near the vehicle, a request signal for each door is generated and output to the portable control unit 150, and further transmitted to the vehicle-mounted device 100A to lock the vehicle door, Unlocking, vehicle trunk door locking, etc. can be performed.

  The sensor 162 is an acceleration sensor, for example, and detects a vibration signal generated in accordance with the user's movement when the user is carrying the portable device 100B and outputs the vibration signal to the portable control unit 150. Yes. The portable control unit 150 stops the reception operation in the portable communication unit 140 on the assumption that the user is not using the portable device 100B under a predetermined vibration condition (for example, when vibration is not recognized). The power consumption in the portable device 100B is suppressed.

  Next, the operation of the user access determination system 100 configured as described above will be described with reference to FIGS. FIG. 2 is a flowchart showing the control content performed by the vehicle-mounted device 100A (vehicle-mounted control unit 120), and FIG. 3 is a flowchart showing the control content performed by the portable device 100B (portable control unit 150).

  In the user access determination system 100, when the user gets out of the vehicle and touches a predetermined part of the closed vehicle door (for example, a switch part of the door knob), a trigger signal is generated and the vehicle door is locked. Is called. Hereinafter, the operation when the user moves away from the vehicle and when the user gets on the vehicle again (when the vehicle door is unlocked) will be described.

  2 and 3, first, in step S <b> 100 of FIG. 2, the in-vehicle control unit 120 transmits an interrogation signal from the in-vehicle communication unit 110 to the portable communication unit 140. As shown in FIG. 4, the interrogation signal is periodically transmitted by a polling method. Then, in step S <b> 200 of FIG. 3, the portable control unit 150 receives the challenge signal by the portable communication unit 140. The received signal is sequentially obtained so as to be synchronized with the periodic interrogation signal.

  Next, in step S210, the mobile communication unit 140 measures (understands) the strength of the received signal (hereinafter, received signal strength). As shown in FIG. 4, when the user gets off and moves away from the communication range from the vehicle, the distance between the vehicle and the user gradually increases, and the received signal strength is the distance that the interrogation signal can reach In the range, it gradually decreases from the maximum value to the minimum value. In addition, when the user enters the communication range to get on and approaches the vehicle, the distance between the vehicle and the user gradually decreases, and the received signal strength is minimum in the range where the interrogation signal can reach. It gradually increases to reach the maximum value. The degree of change in received signal strength is proportional to the movement (walking) speed of the user.

  In step S220, the portable control unit 150 creates a response signal including ID information for verification (authentication ID) and the like, and further places the received signal strength data measured above on the response signal. The data is transmitted from the communication unit 140 to the in-vehicle communication unit 110. As shown in FIG. 4, the response signal is transmitted every time a challenge signal transmitted periodically is received.

  Returning to FIG. 2, when the in-vehicle control unit 120 determines in step S110 that the response signal has been received by the in-vehicle communication unit 110, in step S120, the user is away from the received signal strength data in the response signal. Or if it is approaching. The in-vehicle control unit 120 determines that the user is moving away (when getting off) when the received signal strength data gradually decreases with time, and conversely, the received signal strength data is When it becomes a case where it becomes large sequentially with progress, it determines with the user approaching (at the time of boarding).

  If it is determined in step S120 that the user is moving away, the in-vehicle controller 120 determines in step S130 the time from the maximum value to the minimum value of the received signal strength data as the first time t1 (FIG. 4). Is measured and stored in the storage unit. Then, the process returns to step S100.

  On the other hand, if it is determined in step S120 that the user is approaching, in step S140, the in-vehicle control unit 120 determines whether the first time t1 in step S130 is already stored in the storage unit, and a negative determination is made. Then, the process returns to step S100.

  However, if an affirmative determination is made in step S140, the process proceeds to step S150, and the in-vehicle controller 120 measures the time until the received signal strength data reaches the maximum value from the minimum value as the second time t2 (FIG. 4).

  In step S160, the vehicle-mounted control unit 120 is within a predetermined distance when the user approaches the vehicle, and the absolute value of the difference between the first time t1 and the second time t2 is smaller than a predetermined value α. Determine whether. The predetermined value α is a value determined as a variation value in a range where the first time t1 and the second time t2 can be regarded as equivalent.

  When an affirmative determination is made in step S160 and the user touches a predetermined part (for example, a door knob) of the vehicle door, the in-vehicle control unit 120 changes the received signal intensity when the user moves away when getting off (change time). Assuming that t1) is equivalent to the change in received signal strength when the user approaches when boarding (change time t2), in step S170, the vehicle door is unlocked, and a start permission signal for the vehicle engine Is output to the engine switch 135.

  On the other hand, if a negative determination is made in step S160, the in-vehicle control unit 120 assumes that there is no movement of the user when getting off and getting on, even if the user touches a predetermined part (for example, a door knob) of the vehicle door, step S180. Thus, the locked state of the vehicle door is maintained and the start permission signal for the vehicle engine is not output.

  Here, in the relay attack using the repeater, the repeater is generally arranged near the vehicle and near the user's house (near the portable device 100B) to perform a wireless communication operation. Therefore, for example, the received signal strength of the response signal received by the in-vehicle communication unit 110 is abruptly generated with the start of the relay attack, as shown in FIG. Stand up). That is, the time corresponding to the second time t2 is extremely short.

  On the other hand, as shown in FIG. 5A, the user usually moves away from the vehicle after using the vehicle, and approaches the vehicle when using the vehicle. Therefore, the received signal strength when the user moves away from the vehicle gradually decreases with time, and the received signal strength when the user approaches the vehicle gradually increases with time.

  In the present embodiment, as described above, normally, under the conditions used by the user, the first time t1 until the received signal strength reaches the minimum value from the maximum value, and the received signal strength reaches the maximum value from the minimum value. If the difference from the second time t2 is smaller than the predetermined value α, that is, if the first time t1 and the second time t2 are equal, it can be determined that the user's original movement is accompanied. However, if there is a relay attack, the difference between the first time t1 and the second time t2 is clearly greater than the predetermined value α, and it can be determined that there is a risk of relay attack. Since the vehicle door is unlocked and the vehicle engine is permitted to start with this determination, the risk of relay attack can be reduced with simple control contents.

(Second Embodiment)
A second embodiment is shown in FIGS. In the second embodiment, the basic configuration of the user access determination system 100 is the same as that in the first embodiment, and the received signal strength is measured (understood) by the in-vehicle communication unit 110 instead of the mobile communication unit 140. It is a thing.

  The flowchart executed by the in-vehicle control unit 120 shown in FIG. 6 is obtained by adding steps S125 and S145 of the received signal strength measurement performed by the in-vehicle communication unit 110 to the flowchart described in FIG.

  Further, in the flowchart executed by the portable control unit 150 shown in FIG. 7, step S210 is deleted and step S220 is changed to step S221 with respect to the flowchart described in FIG. Here, it is assumed that a response signal including ID information for verification is simply created and transmitted from the mobile communication unit 140 to the in-vehicle communication unit 110 without putting the received signal strength data on the response signal (see FIG. 8).

  Also in the present embodiment, as in the first embodiment, the first time t1 and the second time t2 can be compared to determine whether or not there is a possibility of relay attack. Since the start of the vehicle engine is permitted, the risk of relay attack can be reduced with simple control contents.

(Third embodiment)
A third embodiment is shown in FIG. In the third embodiment, the basic configuration of the user access determination system 100 is the same as that in the first embodiment, and the received signal strength is measured (understood) as in the first embodiment and the second embodiment. This is performed by both the communication unit 140 and the in-vehicle communication unit 110.

  As a result, if the relays (two) on the vehicle side and the portable device 100B side are moved in the same way as the user's movement during the relay attack, the received signal strength is the same as the normal use of the user. There is a possibility that a time change can be obtained. However, in the relay attack, it is difficult to make the received signal strength measured by the mobile communication unit 140 and the received signal strength measured by the in-vehicle communication unit 110 have the same change. By comparing t1 with the second time t2, it is possible to determine whether or not there is a possibility of relay attack, and with this determination, the vehicle door is unlocked and the vehicle engine is allowed to start. The risk of relay attack can be reduced.

(Fourth embodiment)
In contrast to the first to third embodiments, the first time t1 is defined as the proximity time t when the user approaches the vehicle, and the proximity time t is compared with a predetermined time t0. Also good. The predetermined time t0 corresponds to a time required for the user to move at a normal moving speed until the received signal strength changes from the maximum value (minimum value) to the minimum value (maximum value). Also in this case, the same effect as the first to third embodiments can be obtained.

(Other embodiments)
In the first to fourth embodiments, the LF wave is used as the interrogation signal. However, the present invention is not limited to this, and other radio waves may be used. For example, instead of the LF wave, a signal based on Bluetooth Low Energy (hereinafter, BLE) may be used. When a BLE signal is used, the distance that can be reached from the vehicle-mounted device 100A to the portable device 100B can be increased, for example, to about 50 m, and the received signal strength can be increased by expanding the reach of radio waves. The measurement accuracy of the time during which the time changes (first time t1, second time t2, proximity time t, etc.) can be increased.

  In the fourth embodiment, as a case of using a vehicle, a different parking lot may be used, for example, when the vehicle is stopped at a parking lot at home or when the vehicle is stopped at a parking lot at work. Therefore, the predetermined time t0 corresponding to each parking lot may be set by the user's input operation according to the parking position selected by the user.

  Further, in the fourth embodiment, there may be a case where the user stops with the vehicle when the distance that the radio wave reaches is relatively long like the signal by the BLE. When measuring, you may make it exclude the temporary stagnation time when approaching a vehicle. Thereby, the proximity time t during movement which is substantially approaching the vehicle can be accurately measured.

DESCRIPTION OF SYMBOLS 100 User access determination system 100A Onboard equipment 110 In-vehicle communication part 120 In-vehicle control part 100B Portable machine 140 Portable communication part 150 Portable control part

Claims (7)

An in-vehicle device (100A) mounted on the vehicle;
In a user access determination system comprising a portable device (100B) carried by the user of the vehicle, and performing wireless communication between the on-vehicle device and the portable device,
The in-vehicle device periodically transmits an interrogation signal to the portable device and receives a response signal responded from the portable communication unit (140) of the portable device according to the interrogation signal. And a vehicle-mounted control unit (120) that performs authentication for the response signal, and when the authentication is established, locks and unlocks the vehicle door and gives a start / fail instruction to the vehicle engine. And
The in-vehicle controller is
From the change over time of the received signal strength grasped by at least one of the in-vehicle communication unit and the mobile communication unit,
When the user moves away from the communication range from the vehicle, a first time (t1) until the received signal strength reaches a minimum value from a maximum value;
Again, when the user enters the vehicle communication range and approaches the vehicle, a second time (t2) until the received signal strength reaches the maximum value from the minimum value is measured,
Unlocking the vehicle door when the user approaches the vehicle and is within a predetermined distance of the vehicle and a difference between the first time and the second time is less than a predetermined value (α); And a user access determination system for permitting start of the vehicle engine.   The user access determination system according to claim 1, wherein the received signal strength is grasped by the mobile communication unit, and data transmitted to the in-vehicle communication unit together with the response signal is used.   The user access determination system according to claim 1, wherein the received signal strength is grasped by the in-vehicle communication unit.   The received signal strength is grasped by the mobile communication unit, and both data transmitted to the in-vehicle communication unit together with the response signal and data grasped by the in-vehicle communication unit are used. The user access determination system described in 1. An in-vehicle device (100A) mounted on the vehicle;
In a user access determination system comprising a portable device (100B) carried by the user of the vehicle, and performing wireless communication between the on-vehicle device and the portable device,
The in-vehicle device periodically transmits an interrogation signal to the portable device and receives a response signal responded from the portable communication unit (140) of the portable device according to the interrogation signal. And a vehicle-mounted control unit (120) that performs authentication for the response signal, and when the authentication is established, locks and unlocks the vehicle door and gives a start / fail instruction to the vehicle engine. And
The in-vehicle controller is
From the change over time of the received signal strength grasped by at least one of the in-vehicle communication unit and the mobile communication unit,
When the user enters the communication range of the vehicle and approaches the vehicle, the proximity time (t) until the received signal intensity reaches the maximum value from the minimum value is measured,
When the user approaches the vehicle and is within a predetermined distance of the vehicle, and the difference between the predetermined time (t0) and the proximity time is smaller than a predetermined value (α), A user access determination system for unlocking and permitting start of the vehicle engine. As the interrogation signal, a signal by Bluetooth Low Energy is used,
The said vehicle-mounted control part is a user access determination system of Claim 5 which each sets the said predetermined time according to the parking position of the said vehicle which the said user selects. As the interrogation signal, a signal by Bluetooth Low Energy is used,
The user access determination system according to claim 5, wherein the on-vehicle control unit excludes a temporary stagnation time when the user approaches the vehicle when measuring the proximity time.

Images