JP2023003574A - Control device, control method, and control program - Google Patents

Abstract

To provide a control device which enables control from an external device over a vehicle with its security being guaranteed.SOLUTION: A control device 10 includes: a confirmation unit 101 which confirms a secure state; an acceptance unit 102 which accepts a control request from an external device; and a control unit 103 which, when the acceptance unit 102 has accepted the control request, performs at least any of the control to start or close an in-vehicle network and the control to turn on or off the ignition on the basis of the control request, provided that the secure state is confirmed by the confirmation unit 101.SELECTED DRAWING: Figure 3

Description

The present invention relates to a control device, control method and control program.

Patent Literature 1 discloses a keyless entry system that aims to realize a configuration related to an engine start operation in an emergency at low cost without lowering the degree of freedom in the layout of the vehicle interior. Thus, there is a technique for turning the ignition on and off by operating a button provided in the vehicle. Such a technique is used, for example, when a worker inspects a vehicle or rewrites software in a vehicle factory where vehicles are maintained. A worker pushes a button provided on the vehicle to turn on the ignition, and pushes the button to turn off the ignition when interrupting the work or when the work is completed.

JP 2006-273025 A

Repeated control of the vehicle, such as turning the ignition on and off with a button, increases the takt time of the process. In addition, if the line stops while the vehicle is suspended, the worker cannot get into the vehicle, making it difficult to control the vehicle. On the other hand, it is not appropriate to allow the vehicle to be easily controlled from the outside, assuming attacks from malicious third parties.

An object of the present invention is to provide a control device, a control method, and a control program that enable control of a vehicle from an external device while ensuring security.

A control device according to a first aspect of the present invention includes a confirmation unit that confirms a secure state, a reception unit that receives a control request from an external device, and when the reception unit receives the control request, the a control unit that performs at least one of control to activate or terminate an in-vehicle network and control to turn on or off an ignition based on the control request, provided that the confirmation unit is in a secure state. .

The control device according to the first aspect confirms that the confirmation unit is in a secure state, the reception unit receives a control request from the external device, and when the control request is received, it is in a secure state. , the control unit performs at least one of control to activate or terminate the in-vehicle network and control to turn on or off the ignition based on the control request. According to the control device according to the first aspect, since control is performed based on the control request on the condition that the vehicle is in a secure state, it is possible to control the vehicle from an external device while ensuring security.

A control device according to a second aspect of the present invention is the control device according to the first aspect, wherein the confirmation unit is in a secure state if it is located at a specified location. According to the control device according to the second aspect, it is possible to control the vehicle from an external device, assuming that security is ensured at a specific location.

A control device according to a third aspect of the present invention is the control device according to the second aspect, wherein the confirmation unit is in a secure state if connected to the network environment of the specific location. According to the control device according to the third aspect, it is possible to control the vehicle from an external device, assuming that security is ensured if the device is connected to a network environment at a specific location.

A control device according to a fourth aspect of the present invention is the control device according to any one of the first to third aspects, wherein the control unit responds to the control request on the condition that the vehicle is not in a locked state. control based on According to the control device according to the fourth aspect, it is possible to control the vehicle from the external device if the vehicle is not in the locked state.

A control device according to a fifth aspect of the present invention is the control device according to any one of the first to fourth aspects, wherein the control unit, when performing control to activate an in-vehicle network, performs the control. It shifts to a state in which it operates with lower power consumption than the case. According to the control device according to the fifth aspect, power consumption can be suppressed after the in-vehicle network is activated.

A control device according to a sixth aspect of the present invention is the control device according to any one of the first to fifth aspects, wherein the control unit further turns on or off the engine based on the control request. control.

In a control method according to a seventh aspect of the present invention, the processor confirms that it is in a secure state, accepts a control request from an external device, and if it accepts the control request, it assumes that it is in a secure state. As such, at least one of control to activate or terminate the in-vehicle network and control to turn on or off the ignition is performed based on the control request. According to the control method according to the sixth aspect, the control is performed based on the control request on the condition that the vehicle is in a secure state. Therefore, it is possible to control the vehicle from an external device while ensuring security.

The control program according to the eighth aspect of the present invention confirms that the computer is in a secure state, accepts a control request from an external device, and, if the control request is accepted, confirms that the computer is in a secure state. , a process of performing at least one of control to activate or terminate an in-vehicle network and control to turn on or off an ignition based on the control request is executed. According to the control program according to the seventh aspect, the control is performed based on the control request on the condition that the vehicle is in a secure state. Therefore, it is possible to control the vehicle from an external device while ensuring security.

According to the present invention, it is possible to provide a control device, a control method, and a control program that enable control of a vehicle from an external device while ensuring security.

1 is a diagram showing a schematic configuration of an in-vehicle system according to an embodiment of the invention; FIG. It is a block diagram which shows the hardware constitutions of a control apparatus. It is a block diagram which shows the example of a functional structure of a control apparatus. 4 is a flowchart showing the flow of control processing by a control device; 4 is a flowchart showing the flow of control processing by a control device;

An example of an embodiment of the present invention will be described below with reference to the drawings. In each drawing, the same or equivalent components and portions are given the same reference numerals. Also, the dimensional ratios in the drawings are exaggerated for convenience of explanation, and may differ from the actual ratios.

FIG. 1 is a diagram showing a schematic configuration of an in-vehicle system according to this embodiment.

The in-vehicle system shown in FIG. 1 includes a control device 10, an ignition switch 20, a communication unit 30, an engine ECU 40, an engine 50, and a verification ECU 55. The control device 10 , the ignition switch 20 , the communication unit 30 , the engine ECU 40 and the verification ECU 55 are connected via a CAN bus 60 .

The control device 10 controls each part included in the in-vehicle system based on a control request from an external device 100 outside the in-vehicle system. The external device 100 is connected to the control device 10 via a DLC (Data Link Connector). The control device 10 is, for example, a central gateway ECU (Electronic Control Unit). In the present embodiment, the ignition switch 20, the communication unit 30, and the engine ECU 40 are shown as the objects controlled by the control device 10, but the objects controlled by the control device 10 are not limited to such examples.

The ignition switch 20 is a switch for starting the engine of the vehicle in which the in-vehicle system is mounted and for controlling other electrical systems. The ignition switch 20 controls ON/OFF of the ignition and other electrical systems in response to a control request from the control device 10 .

The communication unit 30 controls an in-vehicle network in which communication between each part of the in-vehicle system takes place. The communication unit 30 controls on/off of the in-vehicle network according to a control request from the control device 10 .

The engine ECU 40 is an ECU that controls driving of the engine 50 . The engine ECU 40 controls on/off of the engine 50 in response to control requests from the control device 10 .

1 is installed in a hybrid vehicle, an HEV (Hybrid Electric Vehicle) ECU is provided in place of the engine ECU 40, and a hybrid system is provided in place of the engine 50. FIG. In this case, the HEV ECU controls ON/OFF of READY (a state in which the vehicle can be driven by the hybrid system) instead of ON/OFF of the engine.

1 is installed in a plug-in hybrid vehicle, the engine ECU 40 is replaced with a PHEV (Plug-in Hybrid Electric Vehicle) ECU, and the engine 50 is replaced with a plug-in hybrid system. . In this case, the PHEV ECU controls ON/OFF of READY (a state in which the vehicle can be driven by the plug-in hybrid system) instead of ON/OFF of the engine.

1 is installed in a fuel cell vehicle, an FCEV (Fuel Cell Electric Vehicle) ECU is provided in place of the engine ECU 40, and a vehicle drive system is provided in place of the engine 50. FIG. In this case, the FCEV ECU controls ON/OFF of READY (a state in which the vehicle can be driven by the vehicle drive system) instead of ON/OFF of the engine.

1, a BEV (Battery Cell Electric Vehicle) ECU is provided in place of the engine ECU 40, and a vehicle drive system is provided in place of the engine 50. FIG. In this case, the BEV ECU controls ON/OFF of READY (state in which the vehicle can be driven by the vehicle drive system) instead of ON/OFF of the engine.

The collation ECU 55 performs predetermined collation processing by communicating with a smart key (not shown), and when the collation is successful, transmits a signal permitting control to the ignition switch 20, the communication unit 30, and the engine ECU 40. The predetermined verification process includes device verification, key verification, biometric authentication, etc., and one or more verification processes are performed. Through the collation process, the control device 10 can control the ignition ON/OFF on the condition that these predetermined collation is successful in addition to the various conditions described later.

The control device 10 according to the present embodiment controls each unit included in the in-vehicle system based on a control request from the external device 100 on condition that the vehicle equipped with the in-vehicle system is in a secure state. The control device 10 controls each unit included in the in-vehicle system under the condition that the vehicle equipped with the in-vehicle system is in a secure state, thereby ensuring security and enabling control of the vehicle from an external device. becomes.

FIG. 2 is a block diagram showing the hardware configuration of the control device 10. As shown in FIG.

As shown in FIG. 2, the control device 10 includes a CPU (Central Processing Unit) 11, a ROM (Read Only Memory) 12, a RAM (Random Access Memory) 13, a storage 14, an input unit 15, a display unit 16, and a communication interface ( I/F) 17. Each component is communicatively connected to each other via a bus 19 .

The CPU 11 is a central processing unit that executes various programs and controls each section. That is, the CPU 11 reads a program from the ROM 12 or the storage 14 and executes the program using the RAM 13 as a work area. The CPU 11 performs control of the above components and various arithmetic processing according to programs recorded in the ROM 12 or the storage 14 . In this embodiment, the ROM 12 or storage 14 stores a control program for controlling the in-vehicle system.

The ROM 12 stores various programs and various data. RAM 13 temporarily stores programs or data as a work area. The storage 14 is configured by a storage device such as a HDD (Hard Disk Drive), SSD (Solid State Drive), or flash memory, and stores various programs including an operating system and various data.

The input unit 15 includes a pointing device such as a mouse and a keyboard, and is used for various inputs.

The display unit 16 is, for example, a liquid crystal display, and displays various information. The display unit 16 may employ a touch panel system and function as the input unit 15 .

The communication interface 17 is an interface for communicating with other devices such as the ignition switch 20, the communication unit 30, and the engine ECU 40. For example, Ethernet (registered trademark), FDDI, Wi-Fi (registered trademark), CAN (Controller Area Network) and other standards are used.

When executing the above control program, the control device 10 uses the above hardware resources to implement various functions. A functional configuration realized by the control device 10 will be described.

Next, the functional configuration of the control device 10 will be described.

FIG. 3 is a block diagram showing an example of the functional configuration of the control device 10. As shown in FIG.

As shown in FIG. 3, the control device 10 has a confirmation unit 101, a reception unit 102, and a control unit 103 as functional configurations. Each functional configuration is realized by the CPU 11 reading and executing a control program stored in the ROM 12 or the storage 14 .

Confirmation unit 101 confirms whether the in-vehicle system is in a secure state. The confirmation unit 101 may assume that the in-vehicle system is in a secure state if the in-vehicle system is in a predetermined specific location such as a vehicle factory. The confirmation unit 101 may assume that the in-vehicle system is located at a predetermined specific location on the condition that it is connected to a predetermined network. For example, the confirmation unit 101 may identify whether or not the device is connected to a predetermined network using an encrypted Wi-Fi SSID or Ethernet MAC address.

Further, the confirmation unit 101 may assume that the in-vehicle system is in a secure state when an operation is performed by an operator who has the authority to maintain the vehicle. The confirmation unit 101 identifies a terminal equipped with biometric authentication or a personal authentication function (personal authentication by encrypted communication using an encryption key given to a specific worker) to determine whether the worker has authority. may

Confirmation unit 101 validates the determination flag only when the vehicle is in a predetermined specific location such as a vehicle factory. The determination flag can be stored in a secure area (Hardware Security Module, HSM) within the control device 10 so as not to be tampered with from the outside. The determination flag may be set to be invalid at the time of shipment from the vehicle factory, and may be an irreversible setting that cannot be changed from invalid to valid.

The reception unit 102 receives a control request for the in-vehicle system from the external device 100 . The control request to the in-vehicle system is, for example, a control request to at least one of the ignition switch 20, the communication unit 30, and the engine ECU 40.

When the reception unit 102 receives a control request from the external device 100, the control unit 103 causes the confirmation unit 101 to control the in-vehicle system based on the received control request on the condition that the in-vehicle system is in a secure state. conduct. The control unit 103 controls at least one of the ignition switch 20 , the communication unit 30 and the engine ECU 40 .

Further, the control unit 103 may control the in-vehicle system based on the received control request on condition that the in-vehicle system is in the unlocked state. The unlocked state means that the control device 10 is in the security unlocked state. Specifically, control unit 103 refers to the state of a lock flag stored in a secure area (secure memory) in control device 10 to determine whether the in-vehicle system is in an unlocked state. good. The lock flag may be an irreversible setting that is set from the unlocked state to the locked state when the vehicle is shipped from the vehicle factory, and cannot be changed from the locked state to the unlocked state.

By having the functional configuration shown in FIG. 3, the control device 10 is included in the in-vehicle system based on a control request from the external device 100 on the condition that the vehicle equipped with the in-vehicle system is in a secure state. Each part can be controlled. By having the functional configuration shown in FIG. 3, the control device 10 can control the vehicle from an external device while ensuring security.

Next, operation of the control device 10 will be described.

FIG. 4 is a flowchart showing the flow of control processing by the control device 10. As shown in FIG. Control processing is performed by the CPU 11 reading the control program from the ROM 12 or the storage 14, developing it in the RAM 13, and executing it.

The CPU 11 first sets the state of the control device 10 to the normal control mode (step S101). The normal control mode is a mode in which control requests from the external device 100 are not accepted.

After step S101, the CPU 11 determines whether the in-vehicle system is in a specific secure state (step S102). The CPU 11 may assume that the in-vehicle system is in a secure state if the in-vehicle system is in a predetermined specific location such as a vehicle factory, as described above for the confirmation unit 101 .

As a result of the determination in step S102, when it is determined that the in-vehicle system is not in the specific secure state (step S102; No), the CPU 11 returns to the normal control mode in step S101.

On the other hand, when it is determined that the in-vehicle system is in a specific secure state as a result of the determination in step S102 (step S102; Yes), the CPU 11 confirms the security lock state of the in-vehicle system (step S103).

As a result of the confirmation in step S103, when it is confirmed that the in-vehicle system is in the locked state (step S103; No), the CPU 11 returns to the normal control mode in step S101.

On the other hand, when it is confirmed that the in-vehicle system is in the unlocked state as a result of the confirmation in step S103 (step S103; Yes), the CPU 11 sets the state of the control device 10 to the vehicle state control mode (step S104). The vehicle state control mode is a mode for accepting control requests from the external device 100 .

Following step S104, the CPU 11 determines whether or not a predetermined period of time has elapsed after shifting to the vehicle state control mode (step S105).

As a result of the determination in step S105, if a predetermined time has elapsed after shifting to the vehicle state control mode (step S105; Yes), the CPU 11 returns to the normal control mode in step S101.

On the other hand, as a result of the determination in step S105, if the predetermined time has not passed since the mode was shifted to the vehicle state control mode (step S105; No), the CPU 11 determines whether or not there is a control request from the external device 100. (Step S106).

As a result of the determination in step S106, when there is no control request from the external device 100 (step S106; No), the CPU 11 returns to the vehicle state control mode in step S104.

On the other hand, as a result of the determination in step S106, if there is a control request from the external device 100 (step S106; Yes), the CPU 11 determines the control target according to the control request from the external device 100 (step S107).

If the object to be controlled by the control request from the external device 100 is the in-vehicle network, the CPU 11 controls the communication unit 30 to turn on or off the in-vehicle network (step S108).

If the object to be controlled by the control request from the external device 100 is the ignition switch, the CPU 11 controls the ignition switch 20 to turn on or off the ignition switch 20 (step S109).

By executing the series of operations shown in FIG. 4, the control device 10 controls the in-vehicle system based on a control request from the external device 100 on the condition that the vehicle equipped with the in-vehicle system is in a secure state. Control of each part included can be performed. By executing the series of operations shown in FIG. 4, the control device 10 can control the vehicle from an external device while ensuring security.

In the control process shown in FIG. 4, the CPU 11 checks the lock state of the vehicle system (the security lock state of the control device 10) after determining whether the vehicle system is in a specific secure state. The invention is not limited to such examples. The CPU 11 may check the locked state of the in-vehicle system, and if the in-vehicle system is in the unlocked state, may determine whether the in-vehicle system is in a specific secure state. The processing load on the control device 10 can be reduced by first performing the lock state confirmation processing, which has a relatively light processing load compared to the processing for determining whether the state is a specific secure state.

FIG. 5 is a flowchart showing the flow of control processing by the control device 10. As shown in FIG. Control processing is performed by the CPU 11 reading the control program from the ROM 12 or the storage 14, developing it in the RAM 13, and executing it.

FIG. 5 shows the flow of control processing by the control device 10 when ON/OFF control of the engine is performed in addition to ON/OFF control of the in-vehicle network and ignition switch.

The control process up to step S106 is the same as the control process shown in FIG.

As a result of the determination in step S106, if there is a control request from the external device 100 (step S106; Yes), the CPU 11 determines a control target according to the control request from the external device 100 (step S107).

If the object to be controlled by the control request from the external device 100 is the in-vehicle network, the CPU 11 controls the communication unit 30 to turn on or off the in-vehicle network (step S108).

If the object to be controlled by the control request from the external device 100 is the ignition switch, the CPU 11 first performs control to hold or release the vehicle stop (step S111). Subsequently, the CPU 11 controls the ignition switch 20 to turn on or off the ignition switch 20 (step S109).

If the object to be controlled by the control request from the external device 100 is the engine, the CPU 11 first performs control to hold or release the vehicle stop (step S112). Subsequently, the CPU 11 controls the engine ECU 40 to turn on or off the engine 50 (step S113).

If the object to be controlled by the control request from the external device 100 is another object, the CPU 11 controls the other object (step S114).

4 and 5, the CPU 11 may return to the normal control mode instead of the vehicle state control mode after performing the control to activate the in-vehicle network.

In addition, in the control processing of FIGS. 4 and 5, the CPU 11 may shift to the sleep mode instead of the vehicle state control mode after performing the control to terminate the in-vehicle network. The sleep mode is a mode that consumes less power than the vehicle state control mode and the normal control mode.

The trigger for shifting from the sleep mode to the normal control mode and starting to check whether the in-vehicle system is in a specific secure state shown in step S101 and to check the locked state shown in step S102 is as follows. Street. As a premise, it is assumed that the capacity of the battery in which the in-vehicle system is mounted remains.

The control device 10 may shift from the sleep mode to the normal control mode, for example, when it recognizes that the ignition switch 20 is turned on or an accessory of the vehicle is turned on by operating a button on the vehicle or the like.

Further, the control device 10 may shift from the sleep mode to the normal control mode, for example, when it detects that an ECU or the like connected to the control device 10 via the CAN bus 60 has started transmitting a CAN message. . In this case, the normal control mode is entered while the ignition switch 20 is kept off. Note that in this case, if there is communication from the DLC, the control device 10 does not shift to the normal control mode. The reason for excluding the DLC is to avoid the occurrence of dead battery due to the control device 10 being unable to shift to the sleep mode due to communication or noise from outside the vehicle.

Further, the control device 10 may shift from the sleep mode to the normal control mode, for example, when a dominant (voltage change) occurs in the CAN bus 60 connected to the control device 10 . In this case, the normal control mode is entered while the ignition switch 20 is kept off. Note that in this case, if there is a dominant DLC, the control device 10 does not shift to the normal control mode. The reason for excluding the DLC is to avoid the occurrence of dead battery due to the control device 10 being unable to shift to the sleep mode due to communication or noise from outside the vehicle.

The control device 10 may shift to the normal control mode even when the DLC is dominant only in the vehicle state control mode. Thereby, even when the control device 10 is in the sleep state, the communication unit 30 can be turned on from the outside of the vehicle through the control device 10 to bring the vehicle into a communicable state.

Note that the control processing executed by the CPU reading the software (program) in each of the above embodiments may be executed by various processors other than the CPU. The processor in this case is a PLD (Programmable Logic Device) whose circuit configuration can be changed after manufacturing such as an FPGA (Field-Programmable Gate Array), and an ASIC (Application Specific Integrated Circuit) for executing specific processing. A dedicated electric circuit or the like, which is a processor having a specially designed circuit configuration, is exemplified. Also, the control processing may be executed by one of these various processors, or a combination of two or more processors of the same or different type (for example, a plurality of FPGAs, a combination of a CPU and an FPGA, etc.). ) can be run. More specifically, the hardware structure of these various processors is an electric circuit in which circuit elements such as semiconductor elements are combined.

Further, in each of the above-described embodiments, a mode in which the control processing program is stored (installed) in advance in the ROM or storage has been described, but the present invention is not limited to this. The program is recorded on a non-transitory recording medium such as CD-ROM (Compact Disk Read Only Memory), DVD-ROM (Digital Versatile Disk Read Only Memory), and USB (Universal Serial Bus) memory. may be provided in the form Also, the program may be downloaded from an external device via a network.

10 control device 20 ignition switch 30 communication unit 40 engine ECU
50 engine 60 CAN bus

Claims (8)

a confirmation unit for confirming that it is in a secure state;
a reception unit that receives a control request from an external device;
When the reception unit receives the control request, the verification unit controls to activate or terminate an in-vehicle network and turns on or off the ignition based on the control request on the condition that it is in a secure state. a control unit that performs at least one of control;
A controller. 2. The control device according to claim 1, wherein said confirmation unit is in a secure state if it is in a specified specific location. 3. The control device according to claim 2, wherein said confirmation unit is in a secure state if it is connected to the network environment of said specific location. The control device according to any one of claims 1 to 3, wherein said control unit performs control based on said control request on condition that said vehicle is not in a locked state. The control device according to any one of claims 1 to 4, wherein when performing control to activate an in-vehicle network, the control unit shifts to a state of operating with lower power consumption than when performing the control. . 6. The control device according to any one of claims 1 to 5, wherein said control unit further performs control to turn on or off the engine based on said control request. by the processor
Make sure it's secure and
Accepts control requests from external devices,
When the control request is received, on the condition that the control request is in a secure state, at least one of control to activate or terminate the in-vehicle network and control to turn on or off the ignition is performed based on the control request.
control method. to the computer,
Make sure it's secure and
Accepts control requests from external devices,
When the control request is received, on the condition that the control request is in a secure state, at least one of control to activate or terminate the in-vehicle network and control to turn on or off the ignition is performed based on the control request.
A control program that executes a process.

Images