WO2019116924A1

WO2019116924A1 - In-vehicle control device, in-vehicle control method, and computer program

Info

Publication number: WO2019116924A1
Application number: PCT/JP2018/044114
Authority: WO
Inventors: 宇佐美　彰規
Original assignee: 株式会社オートネットワーク技術研究所; 住友電装株式会社; 住友電気工業株式会社
Priority date: 2017-12-15
Filing date: 2018-11-30
Publication date: 2019-06-20
Also published as: JP2019108682A

Abstract

Provided are an in-vehicle control device, an in-vehicle control method, and a computer program. The in-vehicle control device is provided with: an operation unit which receives an operation on a start-up request for an accessory mounted in a vehicle; and a transmission unit which transmits a detection signal for detecting a portable apparatus, wherein when the operation is received and the portable apparatus is authenticated on the basis of a response signal to the detection signal from the portable apparatus, the in-vehicle control device starts the accessory. The in-vehicle control device is provided with: a clocking unit which clocks a time interval in which the operation is received; and a transmission stop unit which stops the transmission of the detection signal when the time interval clocked by the clocking unit is shorter than a set time.

Description

In-vehicle control device, in-vehicle control method, and computer program

The present invention relates to an in-vehicle control device, an in-vehicle control method, and a computer program.
This application claims the priority based on Japanese Patent Application No. 2017-240815 filed on Dec. 15, 2017, and incorporates all the contents described in the Japanese application.

A vehicle communication system for locking and unlocking a vehicle door without using a mechanical key has been put to practical use. Specifically, a keyless entry system that locks or unlocks a vehicle door by wireless remote control using a portable device carried by the user, a user carrying the portable device approaches the vehicle, or only holds the door handle The smart entry (registered trademark) system and the like for unlocking the vehicle door has been put to practical use (see, for example, Patent Document 1). A vehicle communication system for starting a vehicle engine without using a mechanical key is also in practical use. Specifically, a push-start system has been put into practical use, in which a user carrying a portable device starts an engine simply by pressing an engine start button. Furthermore, when a user carrying a portable device approaches a vehicle, a welcome light system has been put to practical use, which turns on the interior light or the exterior light.

In the above-described vehicle communication system, the in-vehicle control device performs wireless communication with the portable device. In the wireless communication, various signals are transmitted from the transmission antenna of the on-vehicle control device to the portable device using radio waves in the LF (low frequency) band, and the portable device receiving the signals uses the radio waves in the RF (radio frequency) band And by transmitting a response signal. The on-vehicle control device performs control of unlocking, locking, engine start, welcome light lighting, etc. after authentication and position confirmation of the portable device.

JP, 2015-101908, A

The signal transmitted from the on-vehicle control device is a signal of the LF band, and the transmission range of the signal is limited to a predetermined range around the vehicle. For this reason, the portable device receives the signal of the LF band transmitted from the in-vehicle control device, and the signal of the RF band is returned from the portable device as a response. It is limited to the case where the occupant is inside or around the vehicle.

However, by using a relay that relays the signal of the LF band transmitted from the in-vehicle controller to the portable device and the signal of the RF band transmitted from the portable device to the in-vehicle controller, the occupant carrying the portable device Even when the vehicle is away from the vehicle, communication can be performed between the on-vehicle control device and the portable device. When an unauthorized access to the in-vehicle control device occurs due to the relay attack using such a relay machine, there is a possibility that a malicious third party may execute the door lock release, the engine start, the power transition, and the like.

The present invention has been made in view of such circumstances, and it is an object of the present invention to provide an on-vehicle control device, an on-vehicle control method, and a computer program that can suppress unauthorized access due to relay attack.

An on-vehicle control device according to an aspect of the present application includes an operation unit that receives an operation related to a request for starting an accessory mounted on a vehicle, and a transmission unit that transmits a detection signal for detecting a portable device. An on-vehicle control device for starting the accessory when the portable device is authenticated based on a response signal from the portable device to the detection signal, and the time counting time interval at which the operation is received And a transmission stop unit for stopping transmission of the detection signal when the time interval measured by the timer unit is shorter than the set time.

An on-vehicle control device according to an aspect of the present invention includes an operation unit that receives an operation related to a start request of an accessory mounted on a vehicle, and a transmission that transmits a detection signal for detecting a portable device when the operation is received. An on-vehicle control device for starting the accessory when the portable device is authenticated based on a response signal from the portable device to the detection signal, and measuring a time interval at which the operation is received The timer includes: a timer; and a start inhibiting unit which prohibits the start of the accessory based on the received response signal when the time interval counted by the timer is shorter than the set time.

An on-vehicle control method according to an aspect of the present invention receives an operation related to a start request of an accessory mounted on a vehicle and transmits a detection signal for detecting a portable device to a response signal transmitted from the portable device. It is an on-vehicle control method of starting the accessory when the portable device is authenticated based on the time interval when the operation is received, and the measured time interval is shorter than the set time, the detection signal Stop sending.

A computer program according to an aspect of the present application receives an operation related to a request for starting equipment mounted on a vehicle, and transmits a detection signal for detecting a portable device based on a response signal transmitted from the portable device. When the portable device is authenticated, it is a program for starting the accessory, measuring the time interval at which the operation is received, and transmitting the detection signal when the measured time interval is shorter than the set time Is a computer program for causing a computer to execute a process of stopping the

According to the present application, it is possible to suppress unauthorized access due to a relay attack.

FIG. 1 is a schematic view illustrating a schematic configuration of an in-vehicle control system according to a first embodiment. It is a block diagram explaining an internal configuration of an in-vehicle control device. It is a block diagram explaining an internal configuration of a portable machine. It is a flowchart explaining the procedure of the process which the vehicle-mounted control apparatus which concerns on Embodiment 1 performs. It is a flowchart explaining the procedure of the process which the vehicle-mounted control apparatus which concerns on Embodiment 2 performs. It is a flowchart explaining the procedure of the process which the vehicle-mounted control apparatus which concerns on Embodiment 3 performs.

Embodiments of the present invention will be listed and described. In addition, at least part of the embodiments described below may be arbitrarily combined.

In the above aspect, when the operation relating to the start request of the accessory is performed multiple times at time intervals shorter than the set time, it is determined that communication due to relay attack may occur, and the detection signal By stopping the transmission, it is possible to prevent the start of the engine, the unlocking of the vehicle door, and the like.

The on-vehicle control device according to an aspect of the present invention further includes a notification unit that notifies that the transmission of the detection signal is stopped when the transmission stop unit stops the transmission of the detection signal.

In the above one aspect, since the notification that the transmission of the detection signal has stopped is made, it is possible to notify the occupant of the occurrence of the unauthorized access due to the relay attack.

The on-vehicle control device according to an aspect of the present invention further includes a release unit that releases the transmission stop of the detection signal when an instruction to release the transmission stop of the detection signal is received.

In the above aspect, even when transmission of the detection signal is stopped by the in-vehicle control device, the stop can be canceled by the operation of a proper occupant.

In the above aspect, when receiving the operation relating to the start request of the accessory at a time interval shorter than the set time, ignoring the response signal even when the response signal from the portable device is received. Since the start of the accessory is prohibited by this, it is possible to prevent the start of the engine due to unauthorized access, the unlocking of the vehicle door and the like.

The on-vehicle control device according to an aspect of the present invention further includes a notification unit that notifies that the start of the accessory has been prohibited when the start of the accessory is prohibited by the start prohibition unit.

In the above one aspect, since notification that the start of the accessory has been prohibited is made, it is possible to notify the occupant of the occurrence of unauthorized access due to the relay attack.

The on-vehicle control device according to an aspect of the present invention further includes a release unit that releases the start prohibition of the accessory when an instruction to release the start prohibition of the accessory is received.

In the above aspect, even if the vehicle control device prohibits the start of the accessory, the stop can be canceled by the operation of the appropriate occupant.

In the in-vehicle control device according to one aspect of the present application, the accessory is an engine or a battery system for driving provided in the vehicle, or a door lock mechanism that locks or unlocks a door of the vehicle.

In the above aspect, when it is determined that an unauthorized access may occur due to a relay attack, it is possible to prevent the start of the engine or drive battery system provided in the vehicle and the unlocking of the vehicle door.

Hereinafter, the present invention will be specifically described based on the drawings showing the embodiments thereof.
Embodiment 1
FIG. 1 is a schematic view illustrating a schematic configuration of the on-vehicle control system according to the first embodiment. The on-vehicle control system according to the first embodiment includes, for example, an on-vehicle control device 100 mounted on a vehicle C, and a portable device 200 carried by an occupant.

The in-vehicle control device 100 is, for example, an ECU (Electronic Controller Unit), and integrally performs control related to the operation of the engine provided in the vehicle C, control related to locking and unlocking of the vehicle door, and the like.

The on-vehicle control device 100 includes a plurality of LF transmission antennas 106a to 106e and an RF reception antenna 107a in order to perform wireless communication with the portable device 200. The LF transmission antennas 106a to 106e are antennas provided, for example, in the vicinity of each vehicle door provided in the vehicle C and in each tire house, and transmit a signal having a frequency of the LF band (hereinafter also referred to as an LF signal). The LF transmission antennas 106a to 106e are provided, for example, around the vehicle door for the driver's seat, the passenger seat, the right rear seat, the left rear seat, and the rear door and in each tire house. The RF receiving antenna 107a is, for example, an antenna incorporated in the on-vehicle control device 100, and receives a signal having a frequency of an RF band (hereinafter also referred to as an RF signal).

The portable device 200 includes an LF reception antenna 204a and an RF transmission antenna 205a to perform wireless communication with the on-vehicle control device 100 mounted on the vehicle C (see FIG. 3). The LF receiving antenna 204 a is an antenna incorporated in the portable device 200, and receives an LF signal transmitted from the on-vehicle control device 100. Further, the RF transmission antenna 205a is an antenna built in the portable device 200, and for example, when receiving an LF signal transmitted from the in-vehicle control device 100, transmits an RF signal as the response signal to the in-vehicle control device 100.

In such a vehicle communication system between the on-vehicle control device 100 and the portable device 200, the communication range of wireless communication using an RF signal is about several tens of meters, but the communication range of wireless communication using an LF signal Is about several meters. Therefore, if the portable device 200 receives the LF signal transmitted from the on-vehicle control device 100 and transmits the RF signal as the response signal from the portable device 200, the portable device 200 should be properly possessed. It is limited to the case where the vehicle occupant is present inside or around the vehicle C.

However, by using a relay that relays the LF signal transmitted from the on-board controller 100 to the portable device 200 and the RF signal transmitted from the portable device 200 to the on-vehicle controller 100, the passenger carrying the portable device 200 can Even in the case of being separated from the vehicle C, communication between the on-vehicle control device 100 and the portable device 200 can be achieved. If an unauthorized access to the in-vehicle control device 100 occurs, there is a possibility that a malicious third party may execute door lock release, engine start, power transition, and the like.

On the other hand, in the present embodiment, the operation time interval is measured with respect to the operation requesting start of the engine or the operation requesting the unlocking of the door, and it is determined that the measured operation time interval is shorter than the set time. By preventing the door from being unlocked, starting the engine, changing power, etc., unauthorized access due to relay attack is suppressed.

FIG. 2 is a block diagram for explaining the internal configuration of the on-vehicle control device 100. As shown in FIG. The on-vehicle control device 100 includes a control unit 101, a storage unit 102, an input unit 103, an output unit 104, an in-vehicle communication unit 105, an LF transmission unit 106, and an RF reception unit 107.

The control unit 101 includes, for example, a central processing unit (CPU), a read only memory (ROM), and a random access memory (RAM). The CPU in the control unit 101 executes the control program stored in the ROM to control the operation of the hardware included in the in-vehicle control device 100, and causes the entire device to function as the in-vehicle device of the present application. The RAM in the control unit 101 stores various data generated during execution of the control program.

The control unit 101 is not limited to the above configuration, and may be one or more processing circuits including a single core CPU, a multi-core CPU, a microcomputer, a volatile or non-volatile memory, and the like. Further, the control unit 101 may have functions such as a clock for outputting date and time information, a timer for measuring an elapsed time from giving a measurement start instruction to giving a measurement end instruction, and a counter for counting the number.

The storage unit 102 is formed of, for example, a nonvolatile memory such as an EEPROM (Electronically Erasable Programmable Read Only Memory), and stores various information. Here, various information stored in the storage unit 102 includes, for example, the ID (Identifier) of the vehicle C on which the on-vehicle control device 100 is mounted, the ID of the portable device 200 serving as the communication partner, and authentication of key information used for encryption processing. Information is included.

The input unit 103 includes an interface for connecting request switches such as the engine start switch 111 and the door lock switch 112.

The engine start switch 111 is a request switch for receiving a request for starting the engine included in the vehicle C, and is provided on a console inside the vehicle. The door lock switch 112 is a request switch for receiving a request for locking and unlocking the vehicle door, and is provided on a key cylinder, a door handle or the like provided on the vehicle door for the driver's seat. Note that these request switches may be mechanical switches, or may be switches equipped with a sensor that detects the operation of the occupant in a contact system or non-contact system.

The output unit 104 includes an interface that connects the engine starter 121, the door lock mechanism 122, and the like.

The engine starter 121 is a starting device for starting the engine of the vehicle C. The door lock mechanism 122 includes a mechanical mechanism for locking and unlocking each vehicle door of the vehicle C, an actuator for electrically operating the mechanical mechanism, and the like.

The in-vehicle communication unit 105 includes, for example, a CAN communication interface (CAN: Controller Area Network), and is connected to another ECU of the vehicle C via a CAN bus. The in-vehicle communication unit 105 exchanges data with another ECU (not shown) in accordance with the CAN protocol.

The LF transmission unit 106 includes a signal generation circuit that generates an LF signal based on the signal output from the control unit 101, an amplification circuit that amplifies the generated signal, and the like. The amplified signal is transmitted to the LF transmission antennas 106a to 106e. Send to more outside. In response to an instruction from the control unit 101, the LF transmission unit 106 transmits, for example, a detection signal (LF signal) for detecting the portable device 200 through the LF transmission antennas 106a to 106e. Here, the authentication information stored in the storage unit 102 is added to the LF signal transmitted from the LF transmission unit 106.

The RF receiving unit 107 is connected to the RF receiving antenna 107a, and includes a receiving circuit that receives an RF signal through the RF receiving antenna 107a. In the present embodiment, the RF receiving unit 107 transmits the RF signal received through the RF receiving antenna 107 a to the control unit 101. The received RF signal includes the authentication information added by the transmission source (for example, the portable device 200), and it can be determined whether or not to authenticate the transmission source using this authentication information.

The control unit 101 of the in-vehicle control device 100 receives the operation of the engine start switch 111 through the input unit 103, receives an RF signal as a response to the LF signal transmitted from the LF transmission unit 106, and receives the RF signal When the transmission source (portable device 200) is authenticated based on the authentication information included in the above, the control signal is output to the engine starter 121 through the output unit 104 to perform control to start the engine of the vehicle C. Further, the control unit 101 receives the operation of the door lock switch 112 through the input unit 103, receives an RF signal as a response to the LF signal transmitted from the LF transmission unit 106, and is included in the received RF signal. When the transmission source (portable device 200) is authenticated based on the authentication information, a control signal is output to the door lock mechanism 122 through the output unit 104 to perform control to unlock the lock of the vehicle door.

In the present embodiment, the on-vehicle control device 100 controls the start of the engine. However, when the vehicle C incorporates a drive battery system instead of the engine as a drive source, the drive battery system is started. It may be configured to control. Further, in the present embodiment, for the sake of simplification, the on-vehicle control device 100 is configured to execute control related to starting of the engine and locking and unlocking of the vehicle door. However, control related to starting of the engine is performed. The engine ECU and a door lock ECU that performs control related to locking and unlocking of the vehicle door may be connected to the in-vehicle communication unit 105, and control of these may be performed through the engine ECU and the door lock ECU.

FIG. 3 is a block diagram for explaining the internal configuration of the portable device 200. As shown in FIG. The portable device 200 includes a control unit 201, a storage unit 202, an operation unit 203, an LF reception unit 204, an RF transmission unit 205, and a notification unit 206.

The control unit 201 includes, for example, a CPU, a ROM, and the like. The CPU in the control unit 201 controls the operation of each hardware provided in the portable device 200 by executing the control program stored in the ROM, and causes the entire device to function as the portable device of the present application. The control unit 201 may have a function such as a timer that measures an elapsed time from giving a measurement start instruction to giving a measurement end instruction, a counter that counts the number, and the like.

The storage unit 202 is configured by a non-volatile memory such as an EEPROM and stores various types of information. Here, the various information stored in the storage unit 202 includes, for example, the ID of the portable device 200, the ID of the vehicle C equipped with the on-vehicle control device 100 as the communication partner, and authentication information such as key information used for encryption processing. Be

The operation unit 203 includes an interface for receiving an operation by a passenger. In the present embodiment, the operation unit 203 includes an unlock button 203a operated when unlocking the door of the vehicle C and a lock button 203b operated when locking the door of the vehicle C. When the unlock button 203a (or the lock button 203b) is operated by the passenger, the operation unit 203 outputs a signal indicating that the unlock button 203a (or the lock button 203b) is operated to the control unit 201. When the control unit 201 receives a signal indicating that the unlock button 203a (or the lock button 203b) has been operated, the control unit 201 sends, to the RF transmission unit 205, a control signal instructing unlocking (or locking) of the door of the vehicle C. Do.

The LF reception unit 204 is connected to the LF reception antenna 204a, receives the LF signal through the LF reception antenna 204a, measures the signal strength of the received signal, and obtains the RSSI (Received Signal Strength Indicator). It has a circuit etc. When receiving the detection signal transmitted from the in-vehicle control device 100, the LF reception unit 204 acquires the RSSI of the received detection signal, and sends the received detection signal and the acquired RSSI to the control unit 201. When acquiring the detection signal and the RSSI, the control unit 201 executes processing for authenticating the on-vehicle control device 100 of the transmission source, and when it is a detection signal from the on-vehicle control device 100, it transmits RF as a response. A process of transmitting an RF signal from the unit 205 is performed. At this time, the control unit 201 outputs the RSSI and the authentication information to the RF transmission unit 205 in order to add the RSSI of the detection signal and the authentication information of the portable device 200 to the RF signal to be transmitted to the RF transmission unit 205. Do the process.

The RF transmission unit 205 includes a signal generation circuit that generates an RF signal including RSSI and authentication information based on an instruction from the control unit 201, an amplification circuit that amplifies the generated signal, and the like. It transmits outside from the RF transmission antenna 205a.

The notification unit 206 includes, for example, an LED (Light Emitting Diode), and emits light in response to a signal transmitted from the in-vehicle control device 100 to notify information notified from the in-vehicle control device 100. Further, the notification unit 206 includes, for example, a vibration element, and is configured to notify the information notified from the on-vehicle control device 100 by vibrating the portable device 200 according to a signal transmitted from the on-vehicle control device 100. It is also good. Furthermore, the notification unit 206 may be configured to include a display unit that displays character information.

Hereinafter, the procedure of the process performed by the in-vehicle control device 100 will be described.
FIG. 4 is a flow chart for explaining the procedure of processing executed by the on-vehicle control device 100 according to the first embodiment. The on-vehicle control device 100 executes the following processing, for example, at regular timing. The control unit 101 clears the time measurement information of the built-in timer (step S101), and determines whether or not the request switch operation has been received through the input unit 103 (step S102). Here, the control unit 101 determines whether the request switch operation has been received by determining whether the engine start switch 111 or the door lock switch 112 has been operated based on the information input through the input unit 103. to decide. If the operation has not been received (S102: NO), the control unit 101 waits until the request switch operation is received.

If it is determined that the request switch operation has been received (S102: YES), the control unit 101 operates the built-in timer to start clocking (step S103).

Next, the control unit 101 determines whether the operation time interval of the request switch is shorter than the set time (step S104). Here, it is a threshold for the operation time interval of the request switch, and an appropriate time interval is set and stored in the storage unit 102.

When it is determined that the operation time interval of the request switch is shorter than the set time (S104: YES), the control unit 101 stops the smart function (step S105). Specifically, the control unit 101 stops the transmission of the LF signal for detecting the portable device 200 from the LF transmission unit 106. In the normal system, communication is established between the on-vehicle control device 100 and the portable device 200 even when the request switch is operated only once. On the other hand, if communication is to be performed between the on-vehicle control device 100 and the portable device 200 via the relay, the arrangement relationship between the LF transmission antennas 106a to 106e of the vehicle C and the reception antennas of the relay, And, due to the arrangement relationship between the transmitting antenna of the relay and the LF receiving antenna 204a of the portable device 200, communication is often not established unless the LF signal is transmitted a plurality of times from the vehicle side. Therefore, when the operation time interval of the request switch is shorter than the set time, it can be determined that communication via the relay may be performed, so in the present embodiment, the LF for detecting the portable device 200 By stopping the transmission of the signal, it is avoided that the engine is started or the door is unlocked.

The control unit 101 counts an elapsed time after stopping the elapsed time after stopping the smart function, and determines whether or not the first time has elapsed (step S106). Here, the first time is an appropriate standby time set in advance to release the stop of the smart function. If it is determined that the first time has not elapsed (S106: NO), the control unit 101 returns the process to step S105 and maintains the stop of the smart function. On the other hand, when it is determined that the first time has elapsed (S106: YES), the control unit 101 cancels the stop of the smart function, and then returns the process to step S101.

If it is determined in step S104 that the relationship of operation time interval <setting time is not satisfied (S104: NO), the control unit 101 receives a response (RF signal) from the portable device 200 through the RF receiving unit 107 It is determined (step S107). In step S104, it is determined that the relationship of the operation time interval <the set time is not satisfied even when the request switch operation is accepted only once.

If it is determined that the response (RF signal) from the portable device 200 is received (S107: YES), the control unit 101 determines whether or not authentication is possible based on the authentication information of the portable device 200 included in the RF signal (step S108). ). For example, when the ID of the portable device 200 included as the authentication information matches the ID of the valid portable device 200 registered in advance, the control unit 101 determines that the portable device 200 can be authenticated.

When it is determined that the portable device 200 can be authenticated (S108: YES), the control unit 101 executes control to start the engine or control to unlock the vehicle door according to the request by the request switch operation (Steps S109). On the other hand, when it is determined that the portable device 200 can not be authenticated (S108: NO), the control unit 101 clears the time measurement information by the built-in timer (step S112), and returns the process to step S102.

When it is determined in step S107 that there is no response from the portable device 200 (S107: NO), the control unit 101 determines whether an operation of the request switch has been received through the input unit 103 (step S110). Here, the control unit 101 determines whether the request switch operation has been received by determining whether the engine start switch 111 or the door lock switch 112 has been operated based on the information input through the input unit 103. to decide.

If an operation has been received (S110: YES), the control unit 101 returns the process to step S104. When the operation is not received (S110: NO), the control unit 101 counts an elapsed time after determining that the operation is not received, and determines whether the second time has elapsed (step S111). Here, the second time is a standby time from the reception of the request switch operation to the reception of the response signal from the portable device 200, and it is assumed that an appropriate value is set in advance. When the second time has not elapsed (S111: NO), the control unit 101 returns the process to step S107. When the second time has elapsed (S111: YES), the control unit 101 clears the time measurement information by the built-in timer (step S112), and returns the process to step S102.

As described above, in the first embodiment, when the request switch is operated multiple times at time intervals shorter than the set time, it is determined that communication due to relay attack may occur, and transmission of the LF signal is stopped. By doing this, it is possible to prevent the start of the engine and the unlocking of the vehicle door.

Second Embodiment
In the first embodiment, although the configuration is such that the stop of the smart function is automatically canceled when the first time has elapsed since the stop of the smart function, the instruction from the passenger is received. In this case, the stop of the smart function may be canceled.
In the second embodiment, a configuration will be described in which the stop of the smart function is canceled when an instruction from an occupant is received. In addition, since the whole structure of a vehicle communication system and the internal structure of the vehicle-mounted control apparatus 100 and the portable device 200 are the same as that of Embodiment 1, suppose that the description is abbreviate | omitted.

FIG. 5 is a flowchart for explaining the procedure of processing performed by the on-vehicle control device 100 according to the second embodiment. The in-vehicle control device 100 determines whether the smart function has been stopped according to the same procedure as in the first embodiment (step S201). When the smart function is not stopped (S201: NO), the control unit 101 ends the process of this flowchart without executing the following process.

If it is determined that the smart function has stopped, the control unit 101 notifies the portable device 200 of information indicating that the smart function has stopped (step S202). Specifically, the information is notified to the portable device 200 by transmitting a signal for operating the notification unit 206 included in the portable device 200 from the LF transmission unit 106. If communication connection is possible between the in-vehicle control device 100 and a portable terminal such as a mobile phone or a smart phone possessed by a valid occupant, the connection is established between the two, and the smart function is stopped. The terminal may be notified.

Next, the control unit 101 determines whether an instruction to release the stop of the smart function has been received (step S203). For example, when the unlocking of the vehicle door is restricted by stopping the smart function, an RF signal indicating that the unlock button 203a has been pressed by the operation unit 203 of the portable device 200 is sent to the RF receiving unit 107. When it is received, it can be determined that an instruction to cancel the stop of the smart function has been received.

If it is determined that the instruction to cancel the stop of the smart function has been received (S203: YES), the control unit 101 cancels the stop of the smart function (step S204), and ends the process of this flowchart.

When it is determined that the instruction to cancel the stop of the smart function is not received (S203: NO), the control unit 101 determines whether the first time has elapsed since the stop of the smart function (step S205). . Here, the first time is an appropriate standby time set in advance to release the stop of the smart function.

If it is determined that the first time has not elapsed (S205: NO), the control unit 101 returns the process to step S203. On the other hand, when it is determined that the first time has elapsed (S205: YES), the control unit 101 cancels the stop of the smart function (step S204), and ends the process of this flowchart.

As described above, in the second embodiment, it is possible to notify the portable device 200 carried by a valid occupant that the smart function has stopped. In addition, even when the smart function is stopped in the in-vehicle control device 100, the stop of the smart function can be canceled by the operation of a valid passenger.

Third Embodiment
In the first embodiment, when the request switch operation is accepted at an operation time interval shorter than the set time, the smart function is not used to start the engine and unlock the vehicle door, but the relay device is used. If it can be determined that the received response signal has been received, the response signal may be ignored to prohibit engine start and vehicle door lock release.
In the third embodiment, when it can be determined that a response signal via a repeater has been received, a configuration will be described in which the start of the engine and the unlocking of the vehicle door are prohibited by ignoring the response signal. In addition, since the whole structure of a vehicle communication system and the internal structure of the vehicle-mounted control apparatus 100 and the portable device 200 are the same as that of Embodiment 1, suppose that the description is abbreviate | omitted.

FIG. 6 is a flow chart for explaining the procedure of processing executed by the on-vehicle control device 100 according to the third embodiment. The on-vehicle control device 100 executes the following processing, for example, at regular timing. The control unit 101 clears time information of the built-in timer (step S301), and determines whether an operation of the request switch has been received through the input unit 103 (step S302). Here, the control unit 101 determines whether the request switch operation has been received by determining whether the engine start switch 111 or the door lock switch 112 has been operated based on the information input through the input unit 103. to decide. If the operation has not been received (S302: NO), the control unit 101 waits until the request switch operation is received.

When it is determined that the request switch operation has been received (S302: YES), the control unit 101 transmits an LF signal for detecting the portable device 200 through the LF transmission unit 106 and operates the built-in timer to measure time. It is started (step S303).

Next, the control unit 101 determines whether the operation time interval of the request switch is shorter than the set time (step S304). Here, it is a threshold for the operation time interval of the request switch, and an appropriate time interval is set and stored in the storage unit 102.

If it is determined that the operation time interval of the request switch is shorter than the set time (S304: YES), the control unit 101 determines whether the response (RF signal) from the portable device 200 has been received through the RF receiving unit 107. It judges (step S305).

If it is determined that the response from the portable device 200 has been received (YES in S305), the control unit 101 inhibits the start of the engine and the unlocking of the vehicle door by ignoring the response (S306).

If it is determined in step S305 that there is no response from the portable device 200 (S305: NO), or if the response of the portable device 200 is ignored in step S306, the control unit 101 performs the operation time interval shorter than the set time. After determining that the request switch operation has been received, it is determined whether the first time has elapsed (step S307). Here, the first time is an appropriate standby time set in advance to return to the normal smart function. If it is determined that the first time has not elapsed (S307: NO), the control unit 101 returns the process to step S305. On the other hand, when it is determined that the first time has elapsed (S307: YES), the control unit 101 cancels the stop of the smart function and then returns the process to step S301.

If it is determined in step S304 that the relationship of the operation time interval <the setting time is not satisfied (S304: NO), the control unit 101 receives the response (RF signal) from the portable device 200 through the RF receiving unit 107 It is determined (step S308). In step S304, it is determined that the relationship of the operation time interval <the set time is not satisfied even when the request switch operation is accepted only once.

If it is determined that the response (RF signal) from the portable device 200 is received (S308: YES), the control unit 101 determines whether or not authentication is possible based on the authentication information of the portable device 200 included in the RF signal (step S309). ). For example, when the ID of the portable device 200 included as the authentication information matches the ID of the valid portable device 200 registered in advance, the control unit 101 determines that the portable device 200 can be authenticated.

When it is determined that the portable device 200 can be authenticated (S309: YES), the control unit 101 executes control to start the engine or control to unlock the vehicle door according to the request by the request switch operation (step S310). On the other hand, when it is determined that the portable device 200 can not be authenticated (S309: NO), the control unit 101 clears the time measurement information by the built-in timer (step S313), and returns the process to step S302.

When it is determined in step S308 that there is no response from the portable device 200 (S308: NO), the control unit 101 determines whether an operation of the request switch has been received through the input unit 103 (step S311). Here, the control unit 101 determines whether the request switch operation has been received by determining whether the engine start switch 111 or the door lock switch 112 has been operated based on the information input through the input unit 103. to decide.

If an operation has been received (S311: YES), the control unit 101 returns the process to step S304. In addition, when the operation is not received (S311: NO), the control unit 101 counts an elapsed time after determining that the operation is not received, and determines whether or not the second time has elapsed (step S312). Here, the second time is a standby time from the reception of the request switch operation to the reception of the response signal from the portable device 200, and it is assumed that an appropriate value is set in advance. When the second time has not elapsed (S312: NO), the control unit 101 returns the process to step S308. When the second time has elapsed (S312: YES), the control unit 101 clears the time measurement information by the built-in timer (step S313), and returns the process to step S302.

As described above, in the third embodiment, even when the request switch is operated a plurality of times at time intervals shorter than the set time, the LF signal is transmitted each time, but the response from the portable device 200 By ignoring, the start of the engine and the unlocking of the vehicle door are prohibited. Therefore, although communication by relay attack is normally carried out, engine start and unlocking of the vehicle door are avoided, so that the third party understands the cause of unsuccessful access by relay attack. Is difficult.

In the third embodiment, when the request switch operation is received at an operation time interval shorter than the set time, the unlocking of the engine and the vehicle door is prohibited by the same method as the second embodiment. May be notified to the portable device 200, and the prohibition may be canceled by an instruction from the portable device 200.

It should be understood that the embodiment disclosed herein is illustrative in all respects and not restrictive. The scope of the present invention is indicated not by the meaning described above but by the scope of the claims, and is intended to include all modifications within the scope and meaning equivalent to the scope of the claims.

Reference Signs List 100 in-vehicle control device 101 control unit 102 storage unit 103 input unit 104 output unit 105 in-vehicle communication unit 106 LF transmission unit 106a to 106e LF transmission antenna 107 RF reception unit 107a RF reception antenna 111 engine start switch 112 door lock switch 121 engine starter 122 Door lock mechanism 200 portable unit 201 control unit 202 storage unit 203 operation unit 204 LF reception unit 204a LF reception antenna 205 RF transmission unit 205a RF transmission antenna

Claims

The portable device includes an operation unit that receives an operation related to a request for starting an accessory mounted on a vehicle, and a transmission unit that transmits a detection signal for detecting a portable device. The portable device receives the operation and receives the operation signal. An on-vehicle control device for starting the accessory when the portable device is authenticated based on a response signal from the device;
A clock unit that clocks a time interval at which the operation is received;
And a transmission stop unit for stopping transmission of the detection signal when the time interval measured by the clock unit is shorter than a set time.
The in-vehicle control device according to claim 1, further comprising: a notification unit that notifies that the transmission of the detection signal is stopped when the transmission stop unit stops transmission of the detection signal.
The on-vehicle control device according to claim 1, further comprising: a release unit that releases the transmission stop of the detection signal when an instruction to release the transmission stop of the detection signal is received.
An operation unit for receiving an operation relating to a request for starting an accessory mounted on a vehicle, and a transmission unit for transmitting a detection signal for detecting a portable device when the operation is received, and the portable signal corresponding to the detection signal is transmitted. An on-vehicle control device for starting the accessory when the portable device is authenticated based on a response signal from the device;
A clock unit that clocks a time interval at which the operation is received;
And a start prohibition unit which prohibits the start of the accessory based on the received response signal when the time interval counted by the clock unit is shorter than the set time.
The in-vehicle control device according to claim 4, further comprising: a notification unit that notifies that the start of the accessory is prohibited when the start of the accessory is prohibited in the start prohibition unit.
The on-vehicle control device according to claim 4 or 5, further comprising: a release unit that releases the start prohibition of the accessory when receiving an instruction to release the start prohibition of the accessory.
The on-vehicle control device according to any one of claims 1 to 6, wherein the accessory is an engine or a battery system for driving included in the vehicle, or a door lock mechanism that locks or unlocks a door of the vehicle. .
When the portable device is authenticated based on the response signal transmitted from the portable device when an operation relating to the start request of the equipment mounted on the vehicle is received and the detection signal for detecting the portable device is transmitted, An on-board control method for starting the accessory,
Clocking the time interval at which the operation was received,
The on-vehicle control method for stopping transmission of the detection signal when the measured time interval is shorter than a set time.
When the portable device is authenticated based on the response signal transmitted from the portable device when an operation relating to the start request of the equipment mounted on the vehicle is received and the detection signal for detecting the portable device is transmitted, A program to start the equipment,
Clocking the time interval at which the operation was received,
A computer program for causing a computer to execute a process of stopping transmission of the detection signal if the time interval measured is shorter than a set time.