JP2020093627A - On-vehicle control device, on-vehicle control method, and computer program - Google Patents

Abstract

To provide an on-vehicle control device, an on-vehicle control method, and a computer program.SOLUTION: An on-vehicle control device includes: a transmission section which transmits a response request signal for requesting a response to a portable machine according to an operation to instruct start of a driving source for traveling a vehicle; and an authentication section which authenticates the portable machine on the basis of a response signal from the portable machine to the response request signal. The on-vehicle control device performs start control of the driving source according to success or failure of the authentication by the authentication section. The on-vehicle control device further includes: a specification section which specifies the position of the portable machine; a determination section which determines the presence or absence of illegal authentication to the authentication section; a start prohibition section which prohibits the start of the driving source when the determination section determines the presence of the illegal authentication to the authentication section; and a start permission section which permits the start of the driving source regardless of the determination by the determination section when the position of the portable machine specified by the specification section is a registered position.SELECTED DRAWING: Figure 5

Description

The present invention relates to an in-vehicle control device, an in-vehicle control method, and a computer program.

A vehicle communication system for locking and unlocking a vehicle door without using a mechanical key has been put into practical use. Specifically, a keyless entry system that locks or unlocks the vehicle door by wireless remote control using a portable device owned by the user, a user possessing the portable device approaches the vehicle, or only grasps the door handle. A smart entry (registered trademark) system or the like for unlocking a vehicle door has been put into practical use (see Patent Document 1, for example). Also, a vehicle communication system for starting the engine of a vehicle without using a mechanical key has been put into practical use. Specifically, a push start system has been put into practical use in which a user carrying a portable device simply starts the engine by pressing an engine start button. Further, a welcome light system has been put into practical use, which lights an interior light or an exterior light when a user carrying a portable device approaches a vehicle.

In the vehicle communication system described above, the in-vehicle control device performs wireless communication with the portable device. In the wireless communication, various signals are transmitted from the transmission antenna of the vehicle-mounted control device to the mobile device using radio waves in the LF (Low Frequency) band, and the mobile device receiving the signals uses radio waves in the RF (Radio Frequency) band. By sending a response signal. The in-vehicle control device performs controls such as unlocking, locking, starting the engine, and lighting the welcome light after performing the authentication and the position confirmation of the portable device.

JP, 2005-101908, A

By the way, the signal transmitted from the vehicle-mounted control device is an LF band signal, and the transmission range of the signal is limited to a predetermined range around the vehicle. For this reason, the situation where the portable device receives the signal in the LF band transmitted from the vehicle-mounted control device and returns the signal in the RF band as a response from the portable device should be a proper portable device. Only when the occupant is inside or around the vehicle.

However, by using a relay device that relays an LF band signal transmitted from the vehicle-mounted control device to the mobile device and an RF band signal transmitted from the mobile device to the vehicle-mounted control device, an occupant carrying the mobile device can Even when the vehicle is away from the vehicle, it is possible to execute communication between the vehicle-mounted control device and the portable device. When an unauthorized authentication to the vehicle-mounted control device occurs due to a relay attack using such a repeater, even if a legal occupant does not exist inside or around the vehicle, the engine, which is the drive source of the vehicle, etc. It may be started.

For this reason, an in-vehicle control device has been proposed that determines the presence or absence of unauthorized authentication using a relay device, and prohibits the start of the drive source when it is determined that unauthorized authentication has occurred.

In such an on-vehicle control device, it is necessary to accurately determine the signal transmitted from the portable device and the signal transmitted via the relay device. However, since the discrimination accuracy depends on the number and arrangement of the LF antennas, the vehicle-mounted control device may erroneously discriminate the signal from the legitimate portable device from the signal from the relay device. In this case, there is a possibility that the drive source of the vehicle cannot be started even if a valid occupant gets inside the vehicle.

The present invention has been made in view of such circumstances, and an object of the present invention is to provide an in-vehicle control device, an in-vehicle control method, and a computer program that can reduce the possibility that a legitimate occupant cannot start the drive source of the vehicle. ..

An in-vehicle control device according to an aspect of the present application includes a transmitting unit that transmits a response request signal requesting a response to a portable device in response to an operation for instructing a start of a drive source that drives a vehicle, and the response request signal. An in-vehicle control device for authenticating the portable device on the basis of a response signal from the portable device to the in-vehicle device, and performing start control of the drive source according to success or failure of the authentication by the authenticating unit. An identification unit that identifies the position of the machine, a determination unit that determines whether or not there is unauthorized authentication for the authentication unit, and a startup of the drive source is prohibited if the determination unit determines that there is unauthorized authentication for the authentication unit. A start prohibition unit and a start permission unit that permits the start of the drive source regardless of the determination of the determination unit when the position of the portable device identified by the identification unit is a registered position ..

An in-vehicle control method according to an aspect of the present application transmits a response request signal requesting a response to a portable device in response to an operation for instructing a start of a drive source that drives a vehicle, and the portable device responds to the response request signal. An in-vehicle control method for executing an authentication process for authenticating the portable device based on a response signal from the device, and performing start control of the drive source according to success or failure of the authentication by the authentication process. When determining that there is unauthorized authentication for the authentication process and determining that there is unauthorized authentication for the authentication process, the start of the drive source is prohibited, and the specified position of the portable device is registered. In the case of, the start of the drive source is permitted regardless of the determination of the presence or absence of the unauthorized authentication.

A computer program according to an aspect of the present application transmits a response request signal requesting a response to a portable device in response to an operation for instructing a start of a drive source that drives a vehicle, and the portable device for the response request signal. A computer program for executing an authentication process for authenticating the portable device based on a response signal from the computer, and for causing a computer to execute a process for starting the drive source according to the success or failure of the authentication by the authentication process. , Specifying the position of the portable device, determining the presence or absence of unauthorized authentication for the authentication process, if it is determined that there is unauthorized authentication for the authentication process, prohibiting the start of the drive source, When the position is the registered position, the computer program causes the computer to execute the process of permitting the start of the drive source regardless of the determination of the presence or absence of the unauthorized authentication.

According to the present application, it is possible to reduce the possibility that a valid occupant cannot start the drive source of the vehicle.

It is a schematic diagram explaining the schematic structure of the vehicle-mounted control system which concerns on Embodiment 1. It is a block diagram explaining an internal configuration of an in-vehicle control device. It is a block diagram explaining an internal configuration of a portable device. It is a conceptual diagram which shows an example of a false detection map. 5 is a flowchart illustrating a procedure of processing executed by the vehicle-mounted control device according to the first embodiment. 7 is a flowchart illustrating a procedure of processing executed by the vehicle-mounted control device according to the second embodiment. 9 is a flowchart illustrating a procedure of processing executed by the vehicle-mounted control device according to the third embodiment. 10 is a flowchart illustrating a procedure of processing executed by the vehicle-mounted control device according to the fourth embodiment.

The embodiments of the present invention will be listed and described. Further, at least a part of the embodiments described below may be arbitrarily combined.

An in-vehicle control device according to an aspect of the present application includes a transmitting unit that transmits a response request signal requesting a response to a portable device in response to an operation for instructing a start of a drive source that drives a vehicle, and the response request signal. An in-vehicle control device for authenticating the portable device on the basis of a response signal from the portable device to the in-vehicle device, and performing start control of the drive source according to success or failure of the authentication by the authenticating unit. An identification unit that identifies the position of the machine, a determination unit that determines whether or not there is unauthorized authentication for the authentication unit, and a startup of the drive source is prohibited if the determination unit determines that there is unauthorized authentication for the authentication unit. A start prohibition unit and a start permission unit that permits the start of the drive source regardless of the determination of the determination unit when the position of the portable device identified by the identification unit is a registered position ..

In the above aspect, communication for authenticating the portable device is performed according to an operation for instructing the start of the drive source, and when the authentication of the portable device is successful, control for starting the drive source is performed. On the other hand, when there is an unauthorized authentication such as a relay attack, the control for prohibiting the start of the drive source is performed. Further, when performing the start control of the drive source, if the specified position of the portable device is the registered position, the start of the drive source is permitted regardless of whether or not there is unauthorized authentication. It is possible to avoid prohibition of starting the drive source due to erroneous detection.

An in-vehicle control device according to an aspect of the present application has map information in which information of a position where misidentification of a portable device may occur is registered, and the start permission unit is a position of the portable device specified by the specifying unit. And the position registered in the map information are compared to determine whether the position of the portable device is the registered position.

In the above aspect, it is possible to determine whether or not there is a possibility of erroneous detection, by having map information in which information of a position where erroneous authentication of the portable device may occur is registered.

In the vehicle-mounted control device according to the aspect of the present application, when the start permission unit determines that the position of the portable device is the registered position, the determination unit does not perform the determination of the presence or absence of the unauthorized authentication. I am doing it.

In the above aspect, when the specified position of the portable device is the registered position, the presence or absence of unauthorized authentication is not determined, and therefore the prohibition of starting the drive source due to the false detection of the portable device is avoided. ..

In the vehicle-mounted control device according to an aspect of the present application, when the start permission unit determines that the position of the portable device is the registered position, the start permission unit determines that the determination unit has unauthorized authentication. Even when the determination result is obtained, the start of the drive source is permitted.

In the above-mentioned one aspect, when the specified position of the portable device is the registered position, the start of the drive source is permitted even if the determination result that there is the unauthorized authentication is obtained, It is possible to avoid prohibition of starting the drive source due to erroneous detection of the portable device.

An on-vehicle control device according to an aspect of the present application generates the map information based on an authentication result by the authentication unit and a position of the portable device specified by the specifying unit until a set period elapses. It further comprises a generation unit for performing.

In the above one aspect, for example, a certain period after the vehicle is delivered can be assigned as the period for generating the map information.

The on-vehicle control device according to an aspect of the present application further includes an update unit that updates the map information when a set operation is accepted after the start of the drive source is prohibited.

In the above aspect, even if the start control is performed from the portable device carried by the legitimate user, if the start of the drive source is prohibited, the map information is updated at any time by performing the set operation. be able to.

An on-vehicle control method according to an aspect of the present application transmits a response request signal requesting a response to a portable device in response to an operation for instructing a start of a drive source that drives a vehicle, and the portable device responds to the response request signal. An on-vehicle control method for executing an authentication process for authenticating the portable device based on a response signal from the device, and performing start control of the drive source according to success or failure of the authentication by the authentication process, the position of the portable device. When determining that there is unauthorized authentication for the authentication process and determining that there is unauthorized authentication for the authentication process, the start of the drive source is prohibited, and the specified position of the portable device is registered. In the case of, the start of the drive source is permitted regardless of the determination of the presence or absence of the unauthorized authentication.

In the above aspect, communication for authenticating the portable device is performed according to an operation for instructing the start of the drive source, and when the authentication of the portable device is successful, control for starting the drive source is performed. On the other hand, when there is an unauthorized authentication such as a relay attack, the control for prohibiting the start of the drive source is performed. Further, when performing the start control of the drive source, if the specified position of the portable device is the registered position, the start of the drive source is permitted regardless of whether or not there is unauthorized authentication. It is possible to avoid prohibition of starting the drive source due to erroneous detection.

A computer program according to an aspect of the present application transmits a response request signal requesting a response to a portable device in response to an operation for instructing a start of a drive source that drives a vehicle, and the portable device for the response request signal. A computer program for executing an authentication process for authenticating the portable device based on a response signal from the computer, and for causing a computer to execute a process for starting the drive source according to the success or failure of the authentication by the authentication process. , Specifying the position of the portable device, determining the presence or absence of unauthorized authentication for the authentication process, if it is determined that there is unauthorized authentication for the authentication process, prohibiting the start of the drive source, When the position is the registered position, the computer program causes the computer to execute the process of permitting the start of the drive source regardless of the determination of the presence or absence of the unauthorized authentication.

In the above aspect, communication for authenticating the portable device is performed according to an operation for instructing the start of the drive source, and when the authentication of the portable device is successful, control for starting the drive source is performed. On the other hand, when there is an unauthorized authentication such as a relay attack, the control for prohibiting the start of the drive source is performed. Further, when performing the start control of the drive source, if the specified position of the portable device is the registered position, the start of the drive source is permitted regardless of whether or not there is unauthorized authentication. It is possible to avoid prohibition of starting the drive source due to erroneous detection.

Hereinafter, the present invention will be specifically described based on the drawings showing the embodiments.
(Embodiment 1)
FIG. 1 is a schematic diagram illustrating a schematic configuration of the vehicle-mounted control system according to the first embodiment. The in-vehicle control system according to the first embodiment includes, for example, an in-vehicle control device 100 mounted on the vehicle C and a portable device 200 carried by an occupant.

The vehicle-mounted control device 100 is, for example, an ECU (Electronic Controller Unit), and integrally controls the operation of the engine of the vehicle C, the control of locking and unlocking the vehicle door, and the like.

The vehicle-mounted control device 100 includes a plurality of LF transmission antennas 106a to 106f and an RF reception antenna 107a in order to perform wireless communication with the portable device 200. The LF transmission antennas 106a to 106f are antennas provided, for example, around each vehicle door provided in the vehicle C or in each tire house, and transmit a signal having an LF band frequency (hereinafter, also referred to as an LF signal). The LF transmission antennas 106a to 106f are provided, for example, around the vehicle doors for the driver's seat, passenger seat, right rear seat, left rear seat, around the rear door, and inside the vehicle. The ranges in which the signals transmitted from the LF transmission antennas 106a to 106f reach the portable device 200 are shown in FIG. 1 as communication ranges Ra to Rf, respectively. The RF receiving antenna 107a is, for example, an antenna built in the in-vehicle control device 100, and receives a signal having a frequency in the RF band (hereinafter, also referred to as an RF signal).

The portable device 200 includes an LF reception antenna 204a and an RF transmission antenna 205a in order to perform wireless communication with the vehicle-mounted control device 100 mounted on the vehicle C (see FIG. 3). The LF receiving antenna 204a is an antenna built in the portable device 200, and receives the LF signal transmitted from the vehicle-mounted control device 100. The RF transmission antenna 205a is an antenna built in the portable device 200, and when receiving the LF signal transmitted from the vehicle-mounted control device 100, for example, transmits the RF signal to the vehicle-mounted control device 100 as a response signal.

In such a vehicle communication system between the vehicle-mounted control device 100 and the portable device 200, the communication range of the wireless communication using the RF signal is about several tens of meters, whereas the communication range of the wireless communication using the LF signal. Is about several meters. Therefore, the situation in which the portable device 200 receives the LF signal transmitted from the vehicle-mounted control device 100 and transmits the RF signal as a response signal from the portable device 200 is normally possessed by the valid portable device 200. It is limited to the case where the occupant who exists in the vehicle C or in the vicinity thereof.

However, an occupant carrying the portable device 200 can be provided by using a relay device that relays the LF signal transmitted from the in-vehicle control device 100 to the portable device 200 and the RF signal transmitted from the portable device 200 to the in-vehicle control device 100. Even when the vehicle C is distant from the vehicle C, it becomes possible to communicate between the vehicle-mounted control device 100 and the portable device 200. Due to such a relay attack, communication for illegally authenticating the portable device 200 to the in-vehicle control device 100 occurs, and when the portable device 200 is illegally authenticated, a malicious third party can start the engine. There is a nature.

Therefore, the in-vehicle control device 100 according to the present embodiment determines the presence/absence of unauthorized authentication based on, for example, the signal strength of the RF signal received by the RF receiving antenna 107a. Then, when the on-vehicle control device 100 determines that there is unauthorized authentication, it prohibits the engine from starting, thereby preventing the engine from being started by a malicious third party.

On the other hand, when the vehicle-mounted control device 100 makes an erroneous detection when receiving the RF signal transmitted from the portable device 200 carried by the legitimate occupant of the vehicle C, it is determined that the portable device 200 is authenticated according to the legitimate procedure. Also, it is determined that there is unauthorized authentication, and engine start is prohibited. Therefore, in the present embodiment, a map (erroneous detection map MP described with reference to FIG. 4) in which information on positions where erroneous detection may occur is prepared in advance, and the specified position of the portable device 200 is When it is determined that the position is registered in the false detection map MP, one of the features is that the engine start is permitted regardless of the determination regarding the presence or absence of unauthorized authentication.

FIG. 2 is a block diagram illustrating an internal configuration of the vehicle-mounted control device 100. The vehicle-mounted control device 100 includes a control unit 101, a storage unit 102, an input unit 103, an output unit 104, an in-vehicle communication unit 105, an LF transmission unit 106, and an RF reception unit 107.

The control unit 101 includes, for example, a CPU (Central Processing Unit), a ROM (Read Only Memory), a RAM (Random Access Memory), and the like. By executing the control program stored in the ROM, the CPU in the control unit 101 controls the operation of the above hardware included in the in-vehicle control device 100, and causes the entire device to function as the in-vehicle control device of the present application. The RAM in the control unit 101 stores various data generated during execution of the control program.

The control unit 101 is not limited to the above configuration, and may be one or a plurality of processing circuits including a single-core CPU, a multi-core CPU, a microcomputer, a volatile or non-volatile memory, or the like. The control unit 101 may also have functions such as a clock that outputs date and time information, a timer that measures the elapsed time from when a measurement start instruction is given until a measurement end instruction is given, a counter that counts the number, and the like.

The storage unit 102 is configured by a non-volatile memory such as an EEPROM (Electronically Erasable Programmable Read Only Memory), and stores various kinds of information. Here, the various information stored in the storage unit 102 includes, for example, the ID (Identifier) of the vehicle C equipped with the in-vehicle control device 100, the ID of the portable device 200 that is a communication partner, the key information used for the encryption process, and the like. Information is included. Further, it is assumed that the storage unit 102 stores an erroneous detection map MP. A specific example of the false detection map MP will be described in detail later.

The input unit 103 includes an interface for connecting request switches such as an engine start switch 111 and a door lock switch 112.

The engine start switch 111 is a request switch that receives an operation for instructing the start of the engine of the vehicle C, and is provided on the console inside the vehicle. The door lock switch 112 is a request switch that receives instructions for locking and unlocking the vehicle door, and is provided on a key cylinder, a door handle, and the like provided on the vehicle door for the driver's seat. It should be noted that these request switches may be mechanical switches, or may be switches equipped with a sensor that detects an operation of an occupant in a contact system or a non-contact system.

The output unit 104 includes an interface that connects the engine starter 121, the door lock mechanism 122, and the like.

The engine starter 121 is a starting device for starting the engine of the vehicle C. The door lock mechanism 122 includes a mechanical mechanism for locking and unlocking each vehicle door of the vehicle C, an actuator for electrically operating the mechanical mechanism, and the like.

The in-vehicle communication unit 105 includes, for example, a CAN communication interface (CAN: Controller Area Network), and is connected to another ECU included in the vehicle C via a CAN bus. The in-vehicle communication unit 105 transmits/receives data to/from another ECU (not shown) according to the CAN protocol.

The LF transmission unit 106 includes a signal generation circuit that generates an LF signal based on a signal output from the control unit 101, an amplification circuit that amplifies the generated signal, and the like, and outputs the amplified signal to the LF transmission antennas 106a to 106f. Send to outside. In response to an instruction from the control unit 101, the LF transmission unit 106 transmits, for example, a detection signal (LF signal) for detecting the portable device 200 through the LF transmission antennas 106a to 106f. Here, it is assumed that the authentication information stored in the storage unit 102 is added to the LF signal transmitted from the LF transmission unit 106.

The RF receiving unit 107 is connected to the RF receiving antenna 107a and includes a receiving circuit or the like that receives an RF signal through the RF receiving antenna 107a. In the present embodiment, the RF receiving unit 107 sends the RF signal received through the RF receiving antenna 107a to the control unit 101. The received RF signal includes the authentication information added by the transmission source (for example, the portable device 200), and it is possible to determine whether or not to authenticate the transmission source using this authentication information.

When accepting the operation of the engine start switch 111 through the input unit 103, the control unit 101 of the in-vehicle control device 100 outputs a signal (response request signal) requesting a response to the portable device 200 from the LF transmission unit 106, The LF signal is transmitted to the outside from the LF transmitting antennas 106a to 106f. When the control unit 101 of the vehicle-mounted control device 100 receives an RF signal (response signal) as a response to the response request signal through the RF reception antenna 107a, the transmission unit (the portable device 200) is based on the authentication information included in the RF signal. To authenticate. When the portable device 200 is authenticated, the control unit 101 outputs a control signal to the engine starter 121 through the output unit 104 to control the engine of the vehicle C to start. Similarly, the control unit 101 receives the operation of the door lock switch 112 through the input unit 103, receives the RF signal as a response to the LF signal transmitted from the LF transmission unit 106, and includes the RF signal in the received RF signal. When the transmission source (portable device 200) is authenticated based on the authentication information provided, a control signal is output to the door lock mechanism 122 through the output unit 104 to unlock the vehicle door.

In the present embodiment, the vehicle-mounted control device 100 is configured to control the start of the engine. However, when the vehicle C is equipped with a drive battery system instead of the engine as a drive source, the drive battery system is started. It may be configured to control. Further, in the present embodiment, for the sake of simplification, the vehicle-mounted control device 100 is configured to execute the control for starting the engine and the locking and unlocking of the vehicle door. However, the control for starting the engine is performed. An engine ECU and a door lock ECU that controls the locking and unlocking of the vehicle door may be connected to the in-vehicle communication unit 105, and these controls may be executed through the engine ECU and the door lock ECU.

FIG. 3 is a block diagram illustrating the internal configuration of the portable device 200. The portable device 200 includes a control unit 201, a storage unit 202, an operation unit 203, an LF reception unit 204, an RF transmission unit 205, and a notification unit 206.

The control unit 201 includes, for example, a CPU and a ROM. The CPU in the control unit 201 controls the operation of each hardware included in the portable device 200 by executing the control program stored in the ROM, and causes the entire device to function as the portable device of the present application. The control unit 201 may be provided with functions such as a timer that measures the elapsed time from when the measurement start instruction is given until the measurement end instruction is given, and a counter that counts the number of times.

The storage unit 202 is composed of a nonvolatile memory such as an EEPROM and stores various information. Here, the various information stored in the storage unit 202 includes, for example, the ID of the portable device 200, the ID of the vehicle C equipped with the on-vehicle control device 100 that is a communication partner, and the authentication information such as the key information used for the encryption process. Be done.

The operation unit 203 includes an interface for accepting an operation by an occupant. In the present embodiment, the operation unit 203 includes an unlock button 203a that is operated when unlocking the door of the vehicle C, and a lock button 203b that is operated when locking the door of the vehicle C. When the occupant operates the unlock button 203a (or the lock button 203b), the operation unit 203 outputs a signal indicating that the unlock button 203a (or the lock button 203b) has been operated to the control unit 201. When the control unit 201 receives a signal indicating that the unlock button 203a (or the lock button 203b) has been operated, the control unit 201 sends a control signal for instructing unlocking (or locking) of the door of the vehicle C to the RF transmitting unit 205. Then, it is transmitted to the outside through the RF transmission unit 205.

The LF receiving unit 204 is connected to the LF receiving antenna 204a, a receiving circuit that receives the LF signal through the LF receiving antenna 204a, a signal strength of the received signal is measured, and a measurement to obtain RSSI (Received Signal Strength Indicator). It has a circuit and so on. When receiving the detection signal transmitted from the vehicle-mounted control device 100, the LF reception unit 204 acquires the RSSI of the received detection signal and sends the received detection signal and the acquired RSSI to the control unit 201. When the control unit 201 acquires the detection signal and the RSSI, the control unit 201 executes the process of authenticating the on-vehicle control device 100 that is the transmission source, and when the detection signal is from the legitimate on-vehicle control device 100, the control unit 201 transmits RF transmission as a response. Processing for causing the unit 205 to transmit an RF signal is performed. At this time, the control unit 201 outputs the RSSI and the authentication information to the RF transmission unit 205 in order to add the RSSI of the detection signal and the authentication information of the portable device 200 to the RF signal transmitted by the RF transmission unit 205. Perform processing to

The RF transmission unit 205 includes a signal generation circuit that generates an RF signal including RSSI and authentication information based on an instruction from the control unit 201, an amplification circuit that amplifies the generated signal, and the like. The data is transmitted from the RF transmission antenna 205a to the outside.

The notification unit 206 includes, for example, an LED (Light Emitting Diode), and emits light in response to a signal transmitted from the in-vehicle control device 100 to notify the information notified from the in-vehicle control device 100. In addition, the notification unit 206 includes, for example, a vibration element, and is configured to notify the information notified from the in-vehicle control device 100 by vibrating the portable device 200 in accordance with a signal transmitted from the in-vehicle control device 100. Good. Furthermore, the notification unit 206 may be configured to include a display unit that displays character information.

FIG. 4 is a conceptual diagram showing an example of the false detection map MP. The erroneous detection map MP shown in FIG. 4 is position information of a position (erroneous detection position) where erroneous detection of the portable device 200 may occur and position information of a place where erroneous detection does not occur (non-erroneous detection position) in the vehicle interior. And are the registered maps. In the example of FIG. 4, the hatched squares show the locations registered as false detection positions. One square represents a 20 cm square area, for example. In the example of FIG. 4, it is shown that erroneous detection positions are registered in the area on the rear side of the driver's seat and the area near the vehicle door on the passenger side.

In addition, in the example of FIG. 4, the false detection map MP in the two-dimensional plane at a specific height (for example, the seat surface position) from the floor of the vehicle compartment is shown, but a plurality of heights (for example, the floor position, The false detection map MP may be prepared at each of the seat surface position and the occupant's chest pocket position). Further, the false detection map does not have to be a two-dimensional map and may be a three-dimensional map having three-dimensional position information.

Hereinafter, a procedure of processing executed by the vehicle-mounted control device 100 will be described.
FIG. 5 is a flowchart illustrating a procedure of processing executed by vehicle-mounted control device 100 according to the first embodiment. The in-vehicle control device 100 executes the following processing, for example, at regular timing. The control unit 101 first determines whether or not there is an engine start operation (step S101). Specifically, the control unit 101 determines whether or not a signal indicating that the engine start switch 111 has been operated has been input from the input unit 103. When there is no engine start operation (S101: NO), the control unit 101 ends the processing according to this flowchart.

When the engine start operation is performed (S101: YES), the control unit 101 performs smart communication (step S102). Specifically, the control unit 101 outputs a response request signal requesting a response to the portable device 200 from the LF transmission unit 106, and transmits it as an LF signal from the LF transmission antennas 106a to 106f to the outside of the vehicle C. Further, the control unit 101 receives the response signal (RF signal) transmitted from the portable device 200 that has received the response request signal, through the RF receiving unit 107. Since the response signal transmitted from the portable device 200 includes the authentication information and the information such as the signal strength of the LF signal received by the portable device 200, the control unit 101 determines the portable device 200 based on the authentication information. While authenticating, the position of the portable device 200 can be specified based on information such as the signal strength of the LF signal.

Next, the control unit 101 compares the position of the portable device 200 identified by the smart communication in step S102 with the position registered in the false detection map MP, and determines whether the position of the portable device 200 corresponds to the false detected position. It is determined whether or not (step S103).

When it is determined that it does not correspond to the erroneously detected position (S103: NO), the control unit 101 determines whether there is unauthorized authentication in smart communication (step S104). Here, the control unit 101 uses a known method to determine the presence/absence of unauthorized authentication of the portable device 200 using the relay attack. For example, the control unit 101 may determine the presence/absence of unauthorized authentication based on the difference between the signal strength of the RF signal directly received from the portable device 200 and the signal strength of the RF signal received via the relay device. it can.

When it is determined that there is unauthorized authentication (S104: YES), the control unit 101 prohibits starting the engine (step S105). In this case, the control unit 101 does not output the control signal for controlling the operation of the engine starter 121, and ends the process according to this flowchart.

On the other hand, when it is determined in step S104 that there is no unauthorized authentication (S104: NO), the control unit 101 permits the engine to be started (step S106). In this case, the control unit 101 outputs a control signal for controlling the operation of the engine starter 121 from the output unit 104 to start the engine of the vehicle C.

If it is determined in step S103 that the position of the portable device 200 corresponds to the erroneously detected position (S103: YES), the control unit 101 permits the engine to be started (step S106). That is, the control unit 101 outputs a control signal for controlling the operation of the engine starter 121 from the output unit 104 to start the engine of the vehicle C.

As described above, in the present embodiment, if the position of the portable device 200 specified in the smart communication corresponds to the false detection position registered in the false detection map MP, the presence or absence of the unauthorized authentication is not determined. , Prohibition of engine start due to erroneous detection is avoided.

(Embodiment 2)
In the second embodiment, a configuration will be described in which, when it is determined that the position of the portable device 200 corresponds to an erroneously detected position, the engine start is permitted regardless of the determination result of the presence or absence of unauthorized authentication.
The overall configuration of the vehicle-mounted control system according to the second embodiment and the internal configurations of the vehicle-mounted control device 100 and the portable device 200 are the same as those of the first embodiment, and thus the description thereof will be omitted.

FIG. 6 is a flowchart illustrating a procedure of processing executed by the vehicle-mounted control device 100 according to the second embodiment. The in-vehicle control device 100 executes the following processing, for example, at regular timing. The control unit 101 first determines whether or not there is an engine start operation (step S201). Specifically, the control unit 101 determines whether or not a signal indicating that the engine start switch 111 has been operated has been input from the input unit 103. When there is no engine start operation (S201: NO), the control unit 101 ends the process according to this flowchart.

When the engine start operation is performed (S201: YES), the control unit 101 performs smart communication (step S202). In this smart communication, the control unit 101 determines the authentication of the portable device 200 and specifies the position of the portable device 200.

Next, the control unit 101 determines whether or not there is unauthorized authentication in smart communication (step S203). Here, the control unit 101 uses a known method to determine the presence/absence of unauthorized authentication of the portable device 200 using the relay attack. For example, the control unit 101 may determine the presence/absence of unauthorized authentication based on the difference between the signal strength of the RF signal directly received from the portable device 200 and the signal strength of the RF signal received via the relay device. it can.

When it is determined in step S203 that there is no unauthorized authentication (S203: NO), the control unit 101 permits the engine to be started (step S204). In this case, the control unit 101 outputs a control signal for controlling the operation of the engine starter 121 from the output unit 104 to start the engine of the vehicle C.

When it is determined that there is unauthorized authentication in step S203 (S203: YES), the control unit 101 compares the position of the mobile device 200 identified by the smart communication in step S202 with the position registered in the false detection map MP. Then, it is determined whether or not the position of the portable device 200 corresponds to an erroneously detected position (step S205).

When it does not correspond to the erroneously detected position (S205: NO), the control unit 101 prohibits the engine start (step S206). In this case, the control unit 101 does not output the control signal for controlling the operation of the engine starter 121, and ends the process according to this flowchart.

On the other hand, if it is determined in step S205 that the detected position corresponds to the erroneous detection position (S205: YES), the control unit 101 permits the engine to be started (step S204). That is, the control unit 101 outputs a control signal for controlling the operation of the engine starter 121 from the output unit 104 to start the engine of the vehicle C.

As described above, in the present embodiment, even if the unauthorized authentication is detected, if the position of the portable device 200 corresponds to the erroneous detection position, the engine start is permitted, and therefore the erroneous detection is not detected. The accompanying prohibition of engine starting is avoided.

(Embodiment 3)
In the third embodiment, a procedure for generating the false detection map MP will be described.
The overall configuration of the vehicle-mounted control system and the internal configurations of the vehicle-mounted control device 100 and the portable device 200 according to the third embodiment are the same as those of the first embodiment, and thus the description thereof will be omitted.

FIG. 7 is a flowchart illustrating a procedure of processing executed by the vehicle-mounted control device 100 according to the third embodiment. The on-vehicle control device 100 executes the following processing at regular timings during a predetermined learning period. The learning period is, for example, a period from the delivery of the vehicle C until a set period (for example, one week) elapses, until the smart communication is performed a set number of times (for example, 1000 times) after the vehicle C is delivered. It is set as a period such as the period. The learning period is used as a period for generating the erroneous detection map MP without making a determination as to the presence or absence of unauthorized authentication.

The control unit 101 determines whether or not there is an engine start operation (step S301). Specifically, the control unit 101 determines whether or not a signal indicating that the engine start switch 111 has been operated has been input from the input unit 103. When there is no engine start operation (S301: NO), the control unit 101 ends the processing according to this flowchart.

When the engine start operation is performed (S301: YES), the control unit 101 performs smart communication (step S302). Specifically, the control unit 101 outputs a response request signal requesting a response to the portable device 200 from the LF transmission unit 106, and transmits it as an LF signal from the LF transmission antennas 106a to 106f to the outside of the vehicle C. The control unit 101 also receives a response signal (RF signal) transmitted from the portable device 200 that has received the response request signal, through the RF reception unit 107. Since the response signal transmitted from the portable device 200 includes the authentication information and the information such as the signal strength of the LF signal received by the portable device 200, the control unit 101 determines the portable device 200 based on the authentication information. While authenticating, the position of the portable device 200 can be specified based on information such as the signal strength of the LF signal.

Next, the control unit 101 determines whether or not the authentication of the portable device 200 has been successful in the smart communication of step S302 (step S303). When it is determined that the authentication is successful (S303: YES), the control unit 101 registers the position specified in the smart communication as a non-erroneous detection position in the false detection map MP (step S304). On the other hand, when it is determined that the authentication has failed (S303: NO), the response signal transmitted from the mobile device 200 may not be normally received, or the response signal transmitted from the legitimate mobile device 200 may be received. Since there is a possibility that the authentication will also fail, the control unit 101 registers the position identified in the smart communication in step S302 in the false detection map MP as the false detection position (step S305). The control unit 101 performs control to start the engine of the vehicle C after registering the non-erroneous detection position or the false detection position in the false detection map MP in step S304 or step S305.

As described above, in the present embodiment, the false detection map MP can be generated during the predetermined learning period.

In the present embodiment, the position of the portable device 200 that has failed authentication is registered in the false detection map MP as a false detection position. However, the number of times authentication fails at each position is counted and counted. When the number of times is equal to or larger than a threshold value (for example, 5 times), the false detection position may be registered in the false detection map MP.

(Embodiment 4)
In the fourth embodiment, a procedure for updating the false detection map MP will be described.
The overall configuration of the vehicle-mounted control system and the internal configurations of the vehicle-mounted control device 100 and the portable device 200 according to the fourth embodiment are the same as those of the first embodiment, and thus the description thereof will be omitted.

In the first and second embodiments, when the position of the portable device 200 specified in the smart communication corresponds to the erroneous detection position registered in the erroneous detection map MP, the engine start is permitted regardless of the determination of the unauthorized authentication. It was composed. On the other hand, if the position of the mobile device 200 specified in the smart communication does not correspond to the false detection position registered in the false detection map MP, it is determined whether or not there is unauthorized authentication. Engine starting may be prohibited despite the presence of occupants. Therefore, when the predetermined operation is accepted after the engine start is prohibited, the information of the false detection map MP may be updated.

FIG. 8 is a flowchart illustrating a procedure of processing executed by the vehicle-mounted control device 100 according to the fourth embodiment. The in-vehicle controller 100 executes the following processing after prohibiting the engine start. The control unit 101 determines whether or not a predetermined operation is received (step S401). When the control unit 101 receives an RF signal indicating that the portable device 200 has received a predetermined operation (for example, a long press operation of the unlock button 203a), the control unit 101 may determine that the predetermined operation has been received. Further, when a signal indicating that a predetermined operation has been received from a device connected thereto via the input unit 103 or the in-vehicle communication unit 105, it may be determined that the predetermined operation has been received. When the predetermined operation has not been received (S401: NO), the control unit 101 ends the processing according to this flowchart.

When it is determined that the predetermined operation is accepted (S401: YES), the control unit 101 updates the false detection map MP (step S402). At this time, the control unit 101 updates the false detection map MP by rewriting the information of the position corresponding to the position of the portable device 200 identified by the smart communication in step S102 or step S202 from the non-false detection position to the false detection position. To do.

As described above, in the present embodiment, the information of the position that may be erroneously detected can be registered in the erroneous detection map MP at any time, so that it is possible to reduce the possibility that the engine start is prohibited due to the erroneous detection.

The embodiments disclosed this time are to be considered as illustrative in all points and not restrictive. The scope of the present invention is defined not by the meanings described above but by the claims, and is intended to include meanings equivalent to the claims and all modifications within the scope.

100 In-vehicle control device 101 Control part 102 Storage part 103 Input part 104 Output part 105 In-vehicle communication part 106 LF transmitting part 106a-106f LF transmitting antenna 107 RF receiving part 107a RF receiving antenna 111 Engine start switch 112 Door lock switch 121 Engine starter 122 Door lock mechanism 200 Portable device 201 Control unit 202 Storage unit 203 Operation unit 204 LF receiving unit 204a LF receiving antenna 205 RF transmitting unit 205a RF transmitting antenna

Claims (8)

In response to an operation for instructing the start of a drive source that drives the vehicle, a transmitter that transmits a response request signal requesting a response to the portable device, and a response signal from the portable device for the response request signal, An in-vehicle control device comprising: an authentication unit for authenticating the portable device, and performing start control of the drive source according to success or failure of authentication by the authentication unit,
A specifying unit for specifying the position of the portable device,
A determination unit for determining whether there is unauthorized authentication for the authentication unit,
When the determination unit determines that there is unauthorized authentication for the authentication unit, a start prohibition unit that prohibits start of the drive source,
When the position of the portable device specified by the specifying unit is a registered position, a start permission unit that permits the start of the drive source regardless of the determination of the determination unit. It has map information that registers information on the location where misidentification of the portable device can occur,
The start permission unit collates the position of the portable device specified by the specifying unit with the position registered in the map information to determine whether the position of the portable device is the registered position. The vehicle-mounted control device according to claim 1. The determination unit does not determine the presence or absence of the unauthorized authentication when the start permission unit determines that the position of the portable device is the registered position. In-vehicle control device described. When the start permitting unit determines that the position of the portable device is the registered position, the start permitting unit may determine that the determining unit obtains the result of unauthorized authentication. The vehicle-mounted control device according to claim 1, wherein the start of the drive source is permitted. The generation unit that further generates the map information based on the authentication result by the authentication unit and the position of the portable device specified by the specifying unit until the set period elapses. In-vehicle controller. The vehicle-mounted control device according to claim 2, further comprising: an updating unit that updates the map information when a set operation is accepted after the start of the drive source is prohibited. A response request signal for requesting a response to the portable device is transmitted in response to an operation for instructing the start of a drive source for running the vehicle, and the portable device is based on the response signal from the portable device to the response request signal. Is a vehicle-mounted control method for performing start-up control of the drive source according to success or failure of authentication by the authentication process.
Specify the location of the portable device,
Determine whether there is unauthorized authentication for the authentication process,
If it is determined that there is unauthorized authentication for the authentication process, the start of the drive source is prohibited,
An in-vehicle control method, wherein when the specified position of the portable device is a registered position, starting of the drive source is permitted regardless of whether or not the unauthorized authentication is performed. A response request signal for requesting a response to the portable device is transmitted in response to an operation for instructing the start of a drive source for running the vehicle, and the portable device is based on the response signal from the portable device to the response request signal. A computer program for executing an authentication process for authenticating, and causing a computer to execute a process of performing start control of the drive source according to success or failure of the authentication by the authentication process,
Specify the location of the portable device,
Determine whether there is unauthorized authentication for the authentication process,
If it is determined that there is unauthorized authentication for the authentication process, the start of the drive source is prohibited,
A computer program for causing the computer to execute a process of permitting the start of the drive source regardless of whether or not the unauthorized authentication is performed when the specified position of the portable device is a registered position.

Images