Vehicular authentication system, vehicular authentication method, and vehicular authentication program

Abstract

To provide a vehicular authentication system, a vehicular authentication method, and a vehicular authentication program which can perform alternative authentication even under an offline environment.SOLUTION: A DCU authenticates whether to execute a charging system function through an internet communication section. As a result of disconnection with a vehicle exterior management server (YES in S12), the DCU performs alternative authentication when failing in determination of whether to execute the charging system function through the internet communication section by an authentication section (S13, S14).SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present invention relates to a vehicle authentication system, a vehicle authentication method, and a vehicle authentication program. [Background technology]

[0002] For example, various vehicle devices (e.g., vehicle audio devices) are installed in a vehicle, and a subscription service that is applicable to the vehicle devices may be provided. Such a subscription service is a service based on a fee-based function, and is provided based on a predetermined contract. At this time, authentication is required to determine whether or not a contract has been concluded. Patent Document 1 proposes an authentication function for functions related to a moving body.

[0003] The function described in Patent Document 1 is an authentication method that assumes that the vehicle is connected to a network. When a vehicle travels, it may travel in places where radio waves are difficult to reach, such as tunnels or deep in the mountains, and therefore even if the vehicle's onboard equipment performs communication, there is a possibility that a network connection failure will occur and the vehicle will go offline. If authentication cannot be performed in an offline environment, it may cause anxiety to the passengers or cause problems in driving. For this reason, there is room for consideration of an alternative authentication method in an offline environment. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Special Publication No. 2018-536352 (Patent No. 6602475) Summary of the Invention [Problem to be solved by the invention]

[0005] An object of the present disclosure is to provide a vehicle authentication system, a vehicle authentication method, and a vehicle authentication program that enable alternative authentication in an offline environment. [Means for solving the problem]

[0006] The vehicle authentication system according to claim 1 includes an internet communication unit, an authentication unit, and an alternative authentication unit. The internet communication unit communicates with a server that stores information about chargeable functions that can be performed by a vehicle occupant via a network. The authentication unit authenticates whether or not the chargeable functions can be performed through the internet communication unit.

[0007] The alternative authentication unit substitutes for the authentication of the authentication unit when it is not possible to connect to the server through the network communication unit. The alternative authentication unit substitutes for the authentication of the authentication unit when the connection with the server is cut off and the authentication unit fails to determine whether or not to implement the billing function through the network communication unit, so that alternative authentication can be performed even in an offline environment. [Brief description of the drawings]

[0008] [Figure 1A] Block diagram of a vehicle authentication system according to a first embodiment. [Figure 1B] Flowchart 1 outlining the process [Diagram 2] Flowchart 2 outlining the process [Diagram 3] Flowchart 3 outlining the process [Figure 4] Flowchart 4 outlining the process [Diagram 5] Flowchart 5 outlining the process [Figure 6A] Flowchart 6 outlining the process [Figure 6B] Flowchart 7 outlining the process [Figure 7A] Flowchart 8 outlining the process [Figure 7B] Flowchart 9 outlining the process [Figure 8] Block diagram of a vehicle authentication system according to a second embodiment. [Figure 9] Flowchart 1 outlining the process [Figure 10A] Flowchart 2 outlining the process [Figure 10B] Flowchart 3 outlining the process [Figure 10C] Flowchart 4 outlining the process [Figure 11A] Flowchart 1 outlining the processing steps in the third embodiment [Figure 11B] Flowchart 2 outlining the process [Figure 11C] Display screen example diagram 1 [Figure 11D] Flowchart 3 outlining the process [Figure 11E] Display screen example diagram 2 [Figure 11F] Display screen example diagram 3 [Figure 12] Flowchart 4 outlining the process [Figure 13A] Flowchart 5 outlining the process [Figure 13B] Flowchart 6 outlining the process DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Hereinafter, several embodiments of a vehicle authentication system and a vehicle control system will be described with reference to the drawings. In each embodiment described below, components that perform the same or similar operations are denoted by the same or similar reference numerals, and descriptions thereof will be omitted as necessary.

[0010] (First embodiment) The first embodiment will be described with reference to Fig. 1A to Fig. 7B. The vehicle system 1 shown in Fig. 1A includes an HCU 3, a DCU 4, and other ECUs (not shown) installed inside a vehicle 2 and connected via a network, and also includes an external management server 8 outside the vehicle 2 as a server. A user may have a mobile terminal 9 such as a smartphone, tablet, or laptop computer in or near the vehicle 2, and this mobile terminal 9 also constitutes the vehicle system 1. The vehicle system 1 is used as a vehicle authentication system and a vehicle control system.

[0011] The HCU 3, DCU 4, external management server 8, and mobile terminal 9 are communicatively connectable through a network 7, thereby configuring the vehicle system 1. HCU is an abbreviation for Human Machine Interface Control Unit. DCU is an abbreviation for Domain Control Unit. The network 7 may be a wired communication network, a wireless communication network, or the like.

[0012] <HCU3について> The HCU3 constitutes a display system ECU. ECU is an abbreviation of Electronics Control Unit and is an electronic control device. The HCU3 is equipped with a processor, a memory unit 3a, an I / O, and a bus connecting these, and functions as a control unit that executes various controls by executing programs stored in the memory unit 3a. The memory unit 3a indicates a non-transitory tangible storage medium that non-temporarily stores computer-readable programs and data. The non-transitory tangible storage medium is realized by a semiconductor memory or the like. A short-range wireless communication unit 5 is connected to the HCU3, and the short-range wireless communication unit 5 enables communication with the short-range wireless communication unit 9b of the mobile terminal 9.

[0013] The HCU3 executes application programs (hereinafter, apps) stored in the storage unit 3a to realize various functions, such as a billing function 3b, a local function 3c, and a notification control unit 3d. A display device 11 is connected to the HCU3. The display device 11 is configured with a liquid crystal display or an organic EL display, etc., and is configured to be able to display content in monochrome or full graphics. The display device 11 is a center information display or the like. An operation input unit 12 is connected to the HCU3. The operation input unit 12 is configured with a touch panel configured on the surface of the display device 11 or a mechanical switch configured beside the display device 11, and receives operation input from a user and outputs an operation signal to the HCU3. The HCU3 is capable of executing various functions based on the operation signal from the operation input unit 12. A vehicle device 10 is connected to the HCU3 or the DCU4.

[0014] The functions of the application that can be realized by the HCU3 can be divided into a charging function 3b and a local function 3c. The charging function 3b here indicates a function executed based on contract information of the charging function contracted with the user of the vehicle 2. When the HCU3 obtains a match of the contract information of the charging function of the vehicle device 10, it becomes an execution unit that executes the contracted charging function 3b. The local function 3c indicates a function executed by an application that is pre-installed in the storage unit 3a without charge, and indicates a function that can be executed without a contract for the above-mentioned charging function.

[0015] <DCU4について> The DCU 4 is a centralized cockpit electronic system built on an integrated software and hardware platform, and is configured with a storage unit 4d in which a database 4e is built. DCU 4 is an abbreviation for Domain Control Unit.

[0016] The DCU 4 is configured by connecting an external environment acquisition unit 6. The external environment acquisition unit 6 acquires environmental information outside the vehicle 2. A detection unit 6a is connected to the external environment acquisition unit 6. The detection unit 6a is configured using sensors for acquiring environmental information outside the vehicle 2. For example, a temperature sensor that detects the outside air temperature of the vehicle 2, an illuminance sensor that detects the sunlight illuminance outside the vehicle 2, a front view camera, a side view camera, a corner view camera, a back view camera, an electronic mirror, a laser radar using LiDaR, a surrounding monitoring sensor that monitors the surroundings of the vehicle 2 using a millimeter wave radar, etc. can be mentioned.

[0017] The detection unit 6a can also detect the state of the user by using an occupant monitor. The occupant monitor detects the state of the occupant in the vehicle 2 or the operation state of various operating devices. The occupant monitor includes a camera that captures the state of the occupant in the driver's seat, passenger seat, or rear seat using an image sensor, detects the state of the occupant, and outputs an image signal. The driver's occupant status monitor is called DSM. DSM is an abbreviation for Driver Status Monitor. The DCU 4 has a function as a personal recognition unit that identifies the user in the vehicle 2 based on the detection result of the occupant monitor.

[0018] The DCU 4 is communicatively connected to devices such as the HCU 3 and other ECUs (not shown), and can transmit and receive various information to and from each other. The electronic control device including the DCU 4, the HCU 3, and other devices has functions such as a driving control unit that controls driving of the vehicle 2, a surroundings monitoring unit that monitors the surroundings of the vehicle 2, and a display unit that presents information to the user through the display device 11.

[0019] The driving control system unit controls the driving by manual driving or automatic driving using a gasoline engine, diesel engine, electric motor, etc. The driving control system unit realizes a manual driving control mode by manual driving, or an automatic driving mode according to various stages of automatic driving levels. In the automatic driving mode, the driving control system ECU for automatic driving executes a corresponding predetermined level of driving assistance and automatic driving by driving the driving actuator.

[0020] For example, in level I driving assistance, automatic braking to avoid collision with obstacles, following driving to follow a preceding vehicle, or lane deviation prevention driving to control the vehicle not to deviate from the lanes on either side can be performed. In level II autonomous driving, a combination of level I driving assistance or autonomous driving under specific conditions, for example, an autonomous driving mode that automatically overtakes a slow vehicle 2 on a highway or automatically merges into a highway, can be performed. Note that in level II autonomous driving, the driver is required to monitor. In level III or higher autonomous driving, the driving control system performs all driving tasks while monitoring with a surrounding monitoring system in the vehicle 2, but detailed explanations are omitted. This allows driving control in each driving mode, manual driving or autonomous driving.

[0021] The DCU 4 is configured to be connectable to a network 7 outside the vehicle through a network communication unit 4a. The network communication unit 4a represents a block for communicating with devices inside and outside the vehicle 2. The network communication unit 4a communicates through the network 7 with an outside-vehicle management server 8 that stores information on pay-based functions that can be implemented by users who are passengers of the vehicle 2.

[0022] The DCU 4 executes applications stored in the storage unit 4d to realize various functions, such as the functions of an authentication unit 4b and an alternative authentication unit 4c described below. The storage unit 4d represents a non-transitory tangible storage medium that non-temporarily stores computer-readable programs and data. The non-transitory tangible storage medium is realized by a semiconductor memory or the like.

[0023] A database 4e is built in the storage unit 4d. The database 4e is used as an authentication history information storage unit that stores authentication history information indicating the result (success / failure) of authentication by the authentication unit 4b together with the date and time of authentication. The database 4e also stores and holds contract information for billing functions.

[0024] The authentication unit 4b has a function of authenticating whether or not a billing function can be implemented through the network communication unit 4a. The alternative authentication unit 4c has a function of substituting the authentication of the authentication unit 4b when it is not possible to connect to the external management server 8 through the network communication unit 4a.

[0025] <About the contract for mobile device 9 and billing functions> A user who boards the vehicle 2 carries a mobile terminal 9. The mobile terminal 9 is a terminal that can be brought into the vehicle cabin and includes an interface for operation input, a display, etc. The mobile terminal 9 is a terminal that can perform various operation inputs and notification processes.

[0026] The mobile terminal 9 is configured to include a processor, a memory, and an I / O (none of which are shown in the figure). The mobile terminal 9 is equipped with a wireless communication unit 9a for wirelessly communicating with the external vehicle management server 8 and the like via the network 7. The mobile terminal 9 is equipped with a short-range wireless communication unit 9b for short-range communication with the short-range wireless communication unit 5 using a wireless LAN such as WiFi (registered trademark) or a short-range communication technology such as Bluetooth (registered trademark).

[0027] An application for the vehicle 2 is installed in the memory of the mobile terminal 9, and the mobile terminal 9 executes the vehicle application, allowing the user to issue control commands for the vehicle 2 and to obtain information about the vehicle 2 from the HCU 3 or DCU 4 on the side of the vehicle 2. At this time, the user can set setting information for the vehicle device 10 by operating the mobile terminal 9. The vehicle device 10 referred to here corresponds to an air conditioner (air conditioning device), a vehicle audiovisual device, etc., but is not limited to these.

[0028] The user operates the operation input unit 12 or the mobile terminal 9 to purchase or lease a subscription service related to the vehicle equipment 10. Hereinafter, the subscription service will be abbreviated as "subscription." The user inputs predetermined identification information as a new ID into a form provided by a management provider of a predetermined exterior management server 8 via the network 7 from the operation input unit 12 or the mobile terminal 9. Then, by accepting the contract terms, the user concludes a purchase contract or rental contract for the subscription service with the subscription provider using the legitimate new ID. Such subscription services may have an expiration date or may be indefinite.

[0029] Then, the contract information of the fee-charging function related to the subscription service is registered in the database 8a of the external management server 8 in association with the user. The external management server 8 stores the contract information of the fee-charging function in the database 8a. The contract information of the fee-charging function is also registered in the database 4e of the DCU 4.

[0030] The contract information for the charged function is information indicating the purchase status of subscription services for each user of the vehicle 2, such as an individual, a corporation, or an organization. The contract information for the charged function includes purchase information indicating the purchase or rental information of various functions by the user, user identification information, charging information for a certain period or per use, expiration date information indicating the period for which the subscription service is provided, etc. The database 8a stores contract information for the charged function for a large number of users, linked to, for example, their names or their identification numbers.

[0031] Examples of subscription services for paid functions include a music distribution subscription service for vehicle audio equipment and a video distribution subscription service that enables display on the display device 11. Other examples include subscription services for comfort functions such as seat heaters for a comfortable stay in the vehicle cabin, and a drive mode subscription service that enables change of the manual driving or autonomous driving performance of the vehicle 2. Other examples include subscription services for functions of each level of driving assistance or autonomous driving in the autonomous driving mode, and a subscription service for lighting up the interior of the vehicle 2.

[0032] The internal processing of the vehicle 2 after the power is turned on will now be described. <When the connection with the external management server 8 is good> When the driver turns on the power switch using the ignition switch or power button, power is supplied to the HCU3, DCU4, etc. The network communication unit 4a of the DCU4 establishes a connection with the external management server 8 through the network 7 and establishes a session with the external management server 8. As long as the network communication unit 4a of the DCU4 is not disconnected from the external management server 8, the DCU4 determines that the communication conditions through the network 7 are good. At this time, the network communication unit 4a becomes able to communicate with the external management server 8.

[0033] The DCU 4 performs authentication by comparing the contract information for the charging function stored in the database 4e with the contract information for the charging function in the database 8a stored in the external management server 8 by the authentication unit 4b.

[0034] When the authentication unit 4b is able to authenticate whether or not the billing function can be implemented as a result of communication processing between the DCU 4 and the external management server 8 via the network 7 from the network communication unit 4a, authentication history information indicating successful authentication is stored in the database 4e. In addition, when the DCU 4 determines that the billing function can be implemented, the confirmation date and the like of the contract information of the billing function indicating that the function can be implemented is updated as necessary in the database 4e.

[0035] As a result, the contract information of the charge system function stored in the database 8a by the external management server 8 and the contract information of the charge system function stored in the database 4e of the DCU 4 inside the vehicle 2 are updated as needed. This contract information of the charge system function is updated periodically, for example, every few days or every month.

[0036] 1B, the authentication operation by the authentication unit 4b to determine whether or not a fee-charging function can be implemented will be described. When the vehicle 2 is started in S121, the DCU 3 performs online authentication by the authentication unit 4b in S122. Similarly, when there is a command to change the occupant of the vehicle 2, when a command to turn on the function is received in S122, the authentication unit 4b performs online authentication.

[0037] Login information is required for online authentication with the external vehicle management server 8. If the login information of the occupant (user) has already been registered in the database 4e of the DCU 4, or if the identification information of the vehicle 2 has already been registered as login information in the database 4e of the DCU 4, the process proceeds to S127.

[0038] If it is determined in S124 that the occupant (user) is not a registered occupant and the identification number is not a registered vehicle 2, then in S125 the DCU 4 notifies the occupant of the vehicle 2 of a login request to log in. As a result of being notified of the login request, the occupant attempts to log in. Methods for authenticating the occupant's ID include authentication of the vehicle 2's identification information (such as the vehicle number), personal authentication using the occupant monitor of the detection unit 6a described above, and authentication by inputting an individual password. If the occupant succeeds in logging in, the process returns to S124 and YES is determined in S124.

[0039] The DCU 4 refers to the contract information of the paid function of the logged-in occupant in the database 4e, and determines in S127 whether the paid function is within its expiration date. If it is within its expiration date, the DCU 4 activates the paid function in S128. Conversely, if it is not within its expiration date, a notification is issued in S129 to suggest renewal of the contract of the paid function. For example, it is advisable to notify the occupant of information such as "The subscription contract expired on XX / XX. Would you like to renew it?" and to encourage renewal. If the renewal is approved, the DCU 4 communicates with the external management server 8, updates the contract information stored in the database 4e or 8a, and extends the expiration date.

[0040] In addition, when it is determined in S124 that the information has not been registered in the database 4e of the DCU4, communication may be performed with the external management server 8 to compare and update the contract information for the fee-based function registered in the database 8a of the external management server 8.

[0041] <When vehicle 2 cannot connect to external management server 8, for example, while vehicle 2 is traveling> 2 to 6B, the processing operation while the vehicle 2 is traveling will be described below. In S11 of Fig. 2, while the vehicle 2 is traveling on a road, the network communication unit 4a periodically determines whether or not the connection with the external management server 8 via the network 7 can be maintained in S12.

[0042] If the network communication unit 4a performs communication processing with the external management server 8 via the network 7 and the network connection is interrupted due to a weak radio wave reception environment or other reasons, the authentication unit 4b cannot authenticate whether or not the billing function can be implemented in S13 and determines that the authentication has failed. In this case, the DCU 4 stores authentication history information indicating that the authentication has failed in the database 4e.

[0043] When the DCU 4 fails to determine whether or not the billing function can be implemented by the authentication unit 4b via the network communication unit 4a as a result of the disconnection of the network 7 in S14 (function of the alternative authentication unit 4c), the DCU 4 performs alternative authentication based on information stored in the storage unit 4d or storage unit 3a provided on the vehicle 2 side (function of the alternative authentication unit 4c). Furthermore, when the DCU 4 determines whether or not the billing function can be implemented by the alternative authentication in S14a, it is preferable that the notification control unit 3d controls to notify the occupant of the determination result by the alternative authentication unit 4c as to whether or not the billing function can be implemented. This allows the occupant to know the result of the implementation of the alternative authentication.

[0044] If the DCU 4 suddenly stops the pay-per-use function when the authentication by the authentication unit 4b fails, the driver may be surprised and may be unable to drive. To solve this problem, if the pay-per-use function is related to the safety and security of the passengers, the pay-per-use function may be allowed to continue unconditionally (the function of the alternative authentication unit 4c). Also, if the DCU 4 fails to authenticate by the authentication unit 4b and the pay-per-use function is in use at the time when the DCU 4 determines whether to stop the pay-per-use function, the DCU 4 may allow the pay-per-use function to continue unconditionally without determining whether to stop the function (the function of the alternative authentication unit 4c).

[0045] Furthermore, the DCU 4 may determine that a paid function can be implemented and perform alternative authentication when the paid function to be determined whether it can be implemented falls under at least one of a function necessary for the running of the vehicle 2, a function necessary for the safety of the user (passengers), and a function for making the internal environment of the vehicle 2 comfortable (function of the alternative authentication unit 4c). Although each of these will be described individually below, the DCU 4 may determine that a paid function can be implemented when it falls under any two or more of these functions.

[0046] <Functions required for running vehicle 2> Specifically, as shown in FIG. 3, the DCU 4 determines in S31 whether the charged function to be executed is a function necessary for the running of the vehicle 2, and if it determines that the function is necessary, the DCU 4 performs the processing from S32 onward using the function of the alternative authentication unit 4c.

[0047] For example, when driving the vehicle 2, the user sets a drive mode through the operation input unit 12 in order to change the driving performance of the vehicle 2. When the drive mode is set, the driving control system ECU sets the driving performance to match this drive mode and controls the driving of the vehicle 2. This drive mode supports the operation when the user drives manually, making it possible to control the driving. The standard normal mode is preset to a mode that emphasizes the balance between operability and comfort.

[0048] In addition, the Sport mode is set to a mode that improves the acceleration and deceleration response characteristics compared to the Normal mode. The Race Drive mode is a mode that improves the acceleration and deceleration response performance even more actively than the Sport mode. The Comfort mode is a mode that emphasizes comfort.

[0049] The snow mode is a mode that makes the driving performance of the vehicle 2 suitable for driving on snowy roads. The eco mode is a mode that improves fuel efficiency compared to the normal mode. When the user selects these drive modes as chargeable functions and purchases or rents the vehicle, the user can select the drive mode by operating the operation input unit 12.

[0050] These drive modes include functions necessary for driving the vehicle 2. For example, in the sports mode or race drive mode, the HCU 3 provides a service in which samples of gear shifting, accelerator work, and brake work are visually presented on the display device 11, and the user operates the gears, accelerator, and brakes in accordance with the samples. In the snow mode, a service is provided that can adjust the driving performance of the vehicle 2 to a performance suitable for driving on snowy roads.

[0051] Even if the DCU 4 cannot authenticate these drive modes as paid functions through the Internet communication unit 4a, if the DCU 4 determines in S31 that the functions are necessary for the vehicle 2 to run, it determines in S32 that the target paid function can be implemented.

[0052] The DCU 4 determines the importance of the target paid function in S33. This importance indicates the degree of necessity for driving the vehicle 2, and is set in advance in stages from the necessary function to the important function. The importance information is stored in advance in the storage unit 4d. For example, the snow mode is one of the functions that is important for the vehicle 2 to drive safely on snowy roads. The race drive mode is a relatively hobby-oriented mode, and is therefore one of the functions that is less important for the vehicle 2 to drive. Although an example of setting the importance is given here, the order of importance setting is not limited to this.

[0053] If the DCU 4 determines in S33 that the importance is lower than a predetermined level, then after obtaining consent by an operational instruction from the user in S34, it can activate the target charged function in S35 and make the subscription service of the charged function available. Conversely, if the DCU 4 determines that the importance of the target charged function is higher than a predetermined level, it can forcibly activate the target charged function in S35 without asking for an instruction from the user and make the subscription service available. This allows the user to use the corresponding charged function.

[0054] <Functions necessary for the safety of users (passengers)> As shown in FIG. 4, if the DCU 4 determines in S41 whether or not the paid function to be executed is a function necessary for the safety of the user, and determines that the function is necessary, then the DCU 4 executes the processing from S42 onwards using the alternative authentication unit 4c.

[0055] For example, the vehicle 2 is provided with a manual driving mode and an automatic driving mode. When driving the vehicle 2, the user changes the setting of the driving mode of the vehicle 2 by inputting an operation from the operation input unit 12. When this driving mode is set, the driving control system ECU controls the driving of the vehicle 2 in accordance with this driving mode.

[0056] In the autonomous driving modes, the method of driving assistance or autonomous driving differs according to each level. When a user purchases or rents each level of these autonomous driving modes as a paid function, the user can select the driving mode by operating the operation input unit 12. For example, each function such as a radar cruise control function (LCC), an emergency stop function for collision prevention, and an accelerator depression prevention function can be selectively implemented.

[0057] Even if the DCU 4 cannot authenticate these driving modes as paid functions through the Internet communication unit 4a, if the DCU 4 determines in S41 of Figure 4 that the functions are necessary for the safety of the occupants, it determines in S42 that the target paid function can be implemented.

[0058] Next, the DCU 4 determines the importance of the target paid function in S43. This importance indicates the degree of necessity for the safety of the occupants, and is set in advance in stages from the necessary function to the important function. Information on the importance is stored in advance in the storage unit 4d.

[0059] For example, the emergency stop function for collision prevention is a necessary and important function for preventing a collision accident with another vehicle 2 or an obstacle from the viewpoint of safety. For this reason, the importance is set to be relatively high. The accelerator depression prevention function is an important function for preventing a collision accident with an obstacle from the viewpoint of safety, and therefore the importance is set to be relatively high. The radar cruise control function is a function for following a vehicle 2 traveling in front of the vehicle 2 while maintaining a certain distance, and the importance is set to be relatively low compared to the emergency stop function and the accelerator depression prevention function. Here, an example of information setting of importance is given, but the order of importance setting is not limited to this.

[0060] If the DCU 4 determines in S43 that the importance is lower than a predetermined level, it activates the target paid function in S45 after obtaining consent from the user through an operational instruction in S44. Conversely, if the DCU 4 determines that the importance of the target paid function is higher than a predetermined level, it forcibly activates the target paid function in S45 without asking for an instruction from the user, thereby allowing the user to use the paid function.

[0061] Whether or not the target pay-based function is a pay-based function related to safety and security and has a higher importance than a predetermined level may be stored in the external management server 8 or the storage unit 4d. If the pay-based function is related to safety and security, the DCU 4 may unconditionally activate the pay-based function by the alternative authentication unit 4c. In this way, when the license authentication of the pay-based function fails, the DCU 4 can unconditionally execute the pay-based function to be authenticated if the pay-based function is related to the safety and security of the occupants.

[0062] <Functions to make the interior environment of vehicle 2 more comfortable> 5, the DCU 4 determines whether the pay function to be executed in S52 is a comfort function for making the environment in the vehicle comfortable by the alternative authentication unit 4c. If the DCU 4 determines that the pay function is a comfort function, it determines in S53 that the pay function can be executed.

[0063] When the DCU 4 determines in S52 whether or not to execute a comfort function for making the internal environment of the vehicle 2 comfortable, it is preferable that the DCU 4 acquires external environmental information in S51 prior to this process and performs alternative authentication by adding the external environmental information of the vehicle 2 to the determination conditions for whether or not to execute a pay function. For example, it is preferable to use outside air temperature information acquired by a temperature sensor or illuminance information acquired by an illuminance sensor as the external environmental information.

[0064] When the DCU 4 determines that the outside air temperature is lower than a predetermined standard temperature, it determines that the heating function for the interior of the vehicle can be performed using the vehicle equipment 10 for heating, such as an air conditioner or a seat heater (function of the alternative authentication unit 4c).When the DCU 4 determines that the outside air temperature is higher than a predetermined standard temperature, it determines that the cooling function can be performed using the vehicle equipment 10 for cooling, such as an air conditioner (function of the alternative authentication unit 4c).

[0065] A subscription service that lights up the interior of the vehicle 2 also corresponds to the comfort function. In this case, the DCU 4 judges whether or not to implement the pay-for-service function using illuminance information acquired by an illuminance sensor as environmental information outside the vehicle 2 (function of the alternative authentication unit 4c). For example, when the DCU 4 judges that the illuminance outside the vehicle is lower than a predetermined value, it judges that lighting up the interior of the vehicle using lighting such as LEDs is possible (function of the alternative authentication unit 4c). Conversely, when the DCU 4 judges that the illuminance outside the vehicle is equal to or higher than a predetermined value, it disables the lighting (function of the alternative authentication unit 4c).

[0066] Other convenient functions include music distribution services and video and movie distribution subscription services. Even if the DCU 4 cannot authenticate the billing functions of these convenient functions through the Internet communication unit 4a, if the DCU 4 determines in S52 of Fig. 5 that the billing functions are necessary for comfort, it determines in S53 that the target billing functions can be implemented (the function of the alternative authentication unit 4c).

[0067] Next, the DCU 4 determines the importance of the target paid function in S54. This importance indicates the degree of necessity for making the interior environment of the vehicle 2 comfortable, and is set in advance in stages from the most necessary function to the most important. Information on the importance is stored in advance in the storage unit 4d.

[0068] For example, among the comfort functions, the cooling / heating function in the vehicle cabin is set to a relatively high importance, whereas the function of turning on the lights in the vehicle cabin of the vehicle 2 is set to a relatively low importance. Although an example of setting the importance is given here, the order of importance is not limited to this.

[0069] If the DCU 4 determines in S54 that the importance is lower than a predetermined level, it activates the target paid function in S56 after obtaining consent by a user's operation instruction in S55. Conversely, if the DCU 4 determines that the importance of the target paid function is higher than a predetermined level, it forcibly activates the target paid function in S56 without asking for a user's instruction, thereby allowing the user to use the paid function.

[0070] Returning to the reference drawing in FIG. 2, the description will be continued. The DCU 4 acquires the result of alternative authentication performed by the alternative authentication unit 4c in S14, and notifies the alternative authentication result in S14a. For example, the DCU 4 may display "Alternative authentication has succeeded (or failed)" (first notification information) on the display device 11 via the HCU 3. The DCU 4 may also communicate with the mobile terminal 9 and display this on the display screen of the mobile terminal 9. Next, the DCU 4 may display "The function will continue. It can be used until the vehicle is stopped and the engine is turned off" (second notification information) on the display device 11 or the mobile terminal 9.

[0071] The first notification information and the second notification information may be transmitted and notified in chronological order or simultaneously. The DCU 4 may display a predetermined special icon representing the alternative function on the display device 11 or the mobile terminal 9 only during the period in which the function is permitted by the alternative authentication unit 4c.

[0072] The DCU4 judges whether or not all authentications by the alternative authentication unit 4c have failed in S15. When all authentications by the alternative authentication unit 4c have failed, the DCU4 disables the subscription service of the target pay-based function in S20. When both authentications by the authentication unit 4b and the alternative authentication unit 4c have failed, the HCU3 may notify the reason for the authentication failure in S14b. For example, the reason may be notified, such as "authentication failed due to a network disconnection." This allows the vehicle occupant to understand why the vehicle cannot be used, and supports the vehicle occupant not to feel distrustful. Although a network disconnection has been exemplified here, the reason may also be notified in the case where authentication has failed due to a cause other than a disconnection to the network 7.

[0073] Furthermore, if all authentications by the alternative authentication unit 4c have not failed in S15, the DCU 4 enables the continuous use of the pay-per-use function through authentication by the alternative authentication unit 4c, as described above with reference to Figures 3 to 5. Even after the authentication by the alternative authentication unit 4c is completed, the DCU 4 determines in S16 whether authentication is possible through the network 7 by the authentication unit 4b. That is, the DCU 4 determines whether online authentication is possible.

[0074] If authentication by the authentication unit 4b becomes possible in S16, the DCU 4 activates the billing function in S18 by being authenticated or confirmed by the authentication unit 4b in S17. In other words, the result of the determination by the alternative authentication unit 4c as to whether or not the billing function can be implemented is valid until authentication by the authentication unit 4b becomes possible. This is because alternative authentication by the alternative authentication unit 4c is unnecessary if confirmation is made by the authentication unit 4b. If authentication by the authentication unit 4b cannot be performed in S17, the DCU 4 transitions to S16 and continues to wait until authentication becomes possible. In other words, the DCU 4 continues to wait until online authentication becomes possible.

[0075] For example, when the DCU 4 detects that the power switch of the vehicle 2 has been turned off without being authenticated by the authentication unit 4b, the DCU 4 determines NO in S16 and YES in S19. As a result, even if alternative authentication by the alternative authentication unit 4c has been performed for the target pay-based function, the DCU 4 invalidates the alternative authentication by the alternative authentication unit 4c on the condition that the power switch has been turned off.

[0076] In other words, the DCU 4 holds the result of the determination by the alternative authentication unit 4c as to whether or not the charging function can be implemented valid until the vehicle 2 stops and the power supply of the vehicle 2 is cut off while authentication by the authentication unit 4b is not possible. For example, although the charging function was valid before driving started, it is possible that the validity period expires while driving.

[0077] In this case, the DCU 4 may determine that the billing function can be implemented unconditionally while the vehicle 2 is in operation. When the power switch is turned off, the unconditional permission by the alternative authentication unit 4c is cancelled. When the power switch is turned on again, authentication by the authentication unit 4b is required. After the power switch is turned on again, authentication by the authentication unit 4b or alternative authentication by the alternative authentication unit 4c is required again, so that the contract for the billing function can be complied with. When the DCU 4 determines that the vehicle 2 is stopped, it may notify the HCU 3 and the display device 11 or the mobile terminal 3 that authentication by the authentication unit 4b has failed, and immediately stop the billing function.

[0078] The DCU 4 may use the alternative authentication unit 4c to determine whether the validity of the billing function has passed by using a GPS or a timer, and may determine whether the billing function can be implemented. As shown in Fig. 6A, the alternative authentication unit 4c may use authentication history information of the billing function stored in the database 4e to determine whether the function can be implemented.

[0079] Consider a case where the DCU 4 fails to be authenticated by the authentication unit 4b in S21 of Fig. 6A due to reasons such as an inability to establish a communication connection to the network 7. At this time, if the alternative authentication unit 4c determines that there is a history of successful authentication by referring to the database 4e going back to the past, it performs alternative authentication by the alternative authentication unit 4c in S23, and if the alternative authentication is successful, it is preferable to activate the target pay-for-play function (see S35, S45, S56).

[0080] Conversely, if authentication by the authentication unit 4b has not been successful in the past, the DCU 4 judges NO in S22 and does not permit alternative authentication by the alternative authentication unit 4c. At this time, the DCU 4 should only accept authentication by the regular authentication unit 4b. If authentication has never been successful, the target billing function is a function for which no billing has been performed in the past. For this reason, it is preferable not to permit alternative authentication. As a result, it is possible to prevent fraudulent use of billing functions that should not have been available in the first place.

[0081] FIG. 6B shows a modified example of FIG. 6A. When the DCU 4 determines that there is no successful authentication history as shown in S22 of FIG. 6B, the DCU 4 may display the reason why the function cannot be used on the display device 11 in S24. The DCU 4 causes the display device 11 to notify a message via the HCU 3. The message may be, for example, "This function has never been used and there is no history of past authentication, so it cannot be used." This allows the vehicle occupant to understand why it cannot be used, and supports the vehicle occupant to avoid causing distrust. The DCU 4 may also notify a message such as "Do you want to be charged after communication is restored?" in S25 of FIG. 6B and suggest that the function be charged.

[0082] 7A, the DCU 4 may determine whether or not the charging function can be implemented by the authentication unit 4b in S63 even when the vehicle 2 is traveling in S61 and the charging function is being implemented in S62. If the DCU 4 fails to determine whether or not the charging function can be implemented in S63, the DCU 4 may forcibly determine in S64 that the charging function can be implemented even while the vehicle 2 is traveling by the alternative authentication unit 4c.

[0083] When the vehicle 2 is traveling, the DCU 4 may regard the failure in determining whether or not to execute the paid function as being due to a deterioration in the radio communication state, and may forcibly permit the alternative authentication by the alternative authentication unit 4c and continue to activate the paid function, thereby allowing the occupant to continue using the target paid function.

[0084] As described above, according to this embodiment, when communication with the external vehicle management server 8 is not possible and the network connection of the billing function is cut off, the authentication unit 4b fails to determine whether or not the billing function can be executed via the network communication unit 4a, so that the alternative authentication unit 4c performs alternative authentication. Therefore, alternative authentication can be performed even in an offline environment.

[0085] <Modification of the first embodiment> A modified example is shown in Fig. 7B. Here, the process at the start of the vehicle 2 will be described. When the ignition switch of the vehicle 2 is turned on and the vehicle 2 starts up, the DCU 4 performs authentication by the authentication unit 4b in S222, and determines whether the authentication is successful in S223. If the authentication is successful, the DCU 4 activates a pay-per-use function in S224, but if the authentication is not successful, the DCU 4 checks the authentication history of the alternative authentication unit 4c in S225.

[0086] Here, the DCU 4 checks the authentication history by the alternative authentication unit 4c at the time the ignition switch was last turned off. Specifically, it checks whether the usage period of the billing function that is enabled by the alternative authentication unit 4c has expired. If the alternative authentication by the alternative authentication unit 4c is within the validity period, for example, the DCU 4 executes the alternative authentication by the alternative authentication unit 4c in S227. This makes it possible to realize an alternative function for the billing function, thereby improving the convenience of the occupant.

[0087] Conversely, if the alternative authentication by the alternative authentication unit 4c has expired in S226, the DCU4 retries the alternative authentication, and repeats the retries from S222 until the number of retries exceeds a predetermined number in S228. If the DCU4 determines that the authentication has failed a predetermined number of times or more after retrying several times, it displays the reason for the authentication failure on the display device 11 via the HCU3 in S230. For example, the HCU3 displays a message such as "Authentication failed the last time the power was turned off, so it is not in a state where it can be used unconditionally" on the display device 11 to inform the occupant of the reason for the authentication failure. This allows the occupant to understand the reason why the pay-per-use function cannot be used.

[0088] Furthermore, if the power supply to the DCU 4 is cut off while authentication by the authentication unit 4b has failed, and if authentication also fails the next time the power supply is turned on as shown in S223 to S230 in Fig. 7B, the DCU 4 may notify the occupant of the function for which authentication by the authentication unit 4b has failed, together with the reason for the authentication failure, that the function cannot be used, via the HCU 3 and the display device 11. In this case, the occupant can know the reason why the pay function cannot be used.

[0089] Second embodiment The second embodiment will be described with reference to Fig. 8 to Fig. 10C. In the second embodiment, when a charged function cannot be authenticated, an alternative function that substitutes for the charged function is searched for and the alternative function is executed.

[0090] In this embodiment, as shown in Fig. 8, the DCU 4 has an application function as a search unit 4f that searches for the alternative function. The DCU 4 also has an application function as an authentication determination unit 4g. The HCU 3 also has an application function as a notification control unit 3d. The other configurations are the same as those in the first embodiment, so the description will be omitted.

[0091] 9, the DCU 4 determines in S71 whether or not the target billing function can be implemented by the authentication unit 4b via the network communication unit 4a. If the DCU 4 determines that the billing function can be implemented, it determines YES in S71 and implements the target billing function in S72.

[0092] Conversely, if the DCU 4 determines in S73 that the target charged function cannot be implemented as a result of determining whether the charged function can be implemented in S71, the DCU 4 disables the charged function in S74. After that, regardless of the reason for whether or not the DCU 4 can connect to the network 7, the DCU 4 searches for an application that executes an alternative function that satisfies the same conditions as the purpose of use of the charged function by the search unit 4f in S76 or S81.

[0093] If the DCU 4 judges YES in S75 and judges by the authentication unit 4b that the billing function cannot be executed due to a communication disconnection of the network 7, the DCU 4 judges that it cannot connect via the Internet communication unit 4a. In this case, the DCU 4 may search for an application with an alternative function that can be executed in an offline state, i.e., in a local environment, in S76 by the search unit 4f. Here, if the DCU 4 judges in S75 that the cause is an inability to connect to the Internet, it searches offline in S76 for an application with an alternative function that has the same purpose as the billing function.

[0094] The DCU 4 searches for an app preinstalled in, for example, the storage unit 4d of the DCU 4 in the local environment inside the vehicle 2. If an app with an alternative function is stored in the storage unit 4d, the DCU 4 determines that the alternative function can be implemented. When performing the offline search, the DCU 4 may search for an app installed in the storage unit 3a of the HCU 3.

[0095] If the authentication unit 4b determines that the paid function cannot be implemented due to, for example, expiration of the contract or failure to authenticate personal identification information, even though a connection with the external management server 8 via the network 7 has been established, the DCU 4 determines NO in S75. In this case, the DCU 4 may search the external management server 8 or the like for an app with an alternative function that can be implemented free of charge or for a fee, using the search unit 4f in S81.

[0096] That is, if the DCU 4 determines in S75 that the cause is not an inability to connect to the Internet but an expiration of the contract or a failure in personal authentication, it searches in S81 for an app having an alternative function with the same purpose as the charged function through the network 7. When the DCU 4 searches through the network 7 using the search unit 4f, it may search for an app from the external management server 8, or may search for an app from another server (not shown) through the network 7. This app may be a non-chargeable app or an app with the same function as that stored offline in the storage unit 4d.

[0097] Furthermore, the DCU 4 may search for an alternative function from functions provided in the portable terminal 4 as an external terminal by the search unit 4f. The communication method during the search may be a local communication connection via the short-range wireless communication units 5 and 9b, or a communication connection via a connection server (not shown) through the network communication unit 4a and the network 7.

[0098] When the device can connect to the network 7, if there is an app with the same purpose and corresponding function, the app may be a subscription service with a paid function. In this case, the DCU 4 may determine whether or not the subscription service with a paid function can be used.

[0099] Therefore, the application that performs the alternative function may be an application for a subscription service with a paid function, an application for a one-time paid function (so-called shareware), or an application for a non-paid function (so-called freeware).

[0100] As a specific example of an app, if the paid function under contract is a driving assistance app that includes a driving control function of the vehicle 2, such as an app having a driving assistance function related to peace of mind or safety, the DCU 4 searches for a driving control app with the same purpose as the driving assistance using the search unit 4f.

[0101] If the pay-for-use function under contract is an app that has a navigation function that displays a map on the display screen of the display device 11 and provides guidance to a destination, the DCU 4 uses the search unit 4f to search for map display apps with different titles or other apps with navigation functions.

[0102] As a navigation function, for example, a pay-per-use function is provided that accurately searches the network 7 for high-resolution 3D map display and guidance to places where various services can be provided. In addition, an alternative function is provided that displays high-resolution 2D maps and provides route guidance. In addition, a local function is provided that displays simplified maps and provides geographic guidance using only simple symbols. In this way, the functions can be divided into stages.

[0103] Even if it is difficult to authenticate a billing function for which a contract has been held in advance, the DCU 4 can search for applications of other functions online from the network 7 via the network communication unit 4a. The DCU 4 can also search for applications stored in advance in the storage units 3a and 4d offline. In this way, functions can be searched for in stages.

[0104] For example, when the HCU 3 is unable to display only the map portion of the navigation function, the DCU 4 may search for only the map portion from the local storage units 3a and 4d. In this case, the HCU 3 may read out only the map portion searched for by the DCU 4 from the storage units 3a and 4d, use it, and display it on the display screen of the display device 11.

[0105] For example, DCU4 may explore functions in stages for applications that authenticate people. For example, a person authentication application may have a paid function with relatively high-resolution recognition accuracy, and a local function with low resolution recognition accuracy. This is also true for such a person recognition application.

[0106] The DCU 4 may also download and store in advance in the storage unit 4d an application that allows the implementation of an alternative function when authentication by the authentication unit 4b fails. Then, the DCU 4 can immediately search for an alternative function that is allowed to be implemented by the search unit 4f.

[0107] If the target application for the paid function is an application for a comfort function related to entertainment that pursues comfort in the vehicle 2, the search unit 4f searches for an application having the same comfort function for the same purpose. The DCU 4 may search from the same category or genre by the search unit 4f. Then, when the authentication unit 4b of the DCU 4 determines that the paid function cannot be implemented, the HCU 3 may implement the application for the alternative function searched for by the search unit 4f of the DCU 4.

[0108] Here, a specific example of an alternative function will be further described. An alternative function for a paid function may be a 100% alternative to the target paid function, or may be a partial alternative. Usually, paid functions are often higher performance than free apps. For this reason, even if an alternative function for a paid function is realized using only free functions, it is unlikely that it can be reproduced 100%.

[0109] When DCU4 is to replace 100% of the paid functions, it is recommended that it search for and use other paid apps. For example, by searching for and using another audio app as the paid app, it is possible to receive radio in addition to the music playback function. When the audio app's functions become unavailable due to an expired certification, DCU4 should use another music app. This music app should search for an app that can both play music and receive radio.

[0110] When replacing some functions, it is advisable to search for an app that is pre-installed as a default in the memory unit 3a, 4d of the HCU3 or DCU4, search for a free app from the system, or search for and use another paid app that is cheaper than the usage fee for an expired paid function or the specified fee.

[0111] When substituting some functions, DCU4 may search for and use an app that has only a music playback function and cannot receive radio. When searching for an alternative function because a paid function is not available, DCU4 may search for and use an app that has only a music playback function and cannot receive radio from the beginning. Also, DCU4 may first search for an audio app that has both a music playback function and a radio function, and then, when the audio app with both functions becomes unusable due to an expired certification, DCU4 may search for and use an app that has only a music playback function and cannot receive radio.

[0112] In this case, if the app with the alternative function being searched for is an app related to safety or security, it may be given a high priority, other low priority apps may be stopped, and apps determined to be low priority may be deleted (trimmed) in order to free up memory capacity.

[0113] The DCU 4 may use multiple alternative functions to implement the alternative function so as to reproduce the pay-based function that is determined to be impossible to implement. In this case, the alternative function may be implemented by combining apps that can substitute for some of the functions to reproduce the pay-based function.

[0114] At this time, the HCU 3 may cooperate with the external mobile terminal 9 and further cooperate with other applications. For example, the HCU 3 may have a music playback function as the local function 3c, the mobile terminal 9 may have a radio reception function, and the external management server 8 may have an audio setting function.

[0115] For example, when transmitting / receiving or mediating music content data, the DCU 4 may transmit / receive applications and data present in various places in the system, and may execute an add-on function for further adjustment. In this case, the application having the adjustment function may be searched for from the external mobile terminal 9 or application server.

[0116] For example, when coordinating and mediating a navigation application having a navigation function and an audio application, a mediation application having a mediation function for mediating a volume adjustment function when guiding a destination by the navigation application and a music volume adjustment function by the audio application may be searched for. For example, the HCU3 may receive the searched application from the DCU4 and execute this mediation application together with the navigation application and the audio application. Then, the HCU3 can selectively notify the vehicle interior of route guidance and music, so that the passengers can comfortably obtain route guidance information and enjoy music. Here, the coordination and mediation of the navigation application and the audio application have been described, but it is preferable to search for an application that can adjust, coordinate, and link various applications and acquire it as an application having an alternative function.

[0117] If the DCU 4 is unable to find an alternative function through the network 7 by the search unit 4f in S81, the DCU 4 may determine NO in S82 and return to S76 to search for an alternative function that can be implemented in an offline state.

[0118] If the DCU4 searches for an application of the alternative function and determines in S78 that the alternative function can be implemented, the authentication unit 4b also determines in S79 through the network communication unit 4a whether the alternative function can be implemented. If the authentication unit 4b determines that the alternative function can be implemented and YES is determined in S79, the DCU4 activates the application of the alternative function in S80. The HCU3 then implements the application of the alternative function. The user can use the alternative function, improving user convenience. If the authentication unit 4b cannot perform online authentication in S79, the DCU4 may perform offline alternative authentication using the alternative authentication unit 4c.

[0119] When an occupant (user) starts using the application of the alternative function, the DCU 4 executes the process shown in FIG. 10A. The DCU 4 executes the application of the alternative function searched for by the search unit 4f in S83. When the alternative function is substituting for a paid function, it is preferable to notify the occupant that the paid function has been disabled due to an expired authentication, so that the occupant is made aware of this. Examples of the method for this include (1) graying out the icon of the corresponding function, (2) erasing the icon of the corresponding function from the menu screen, and (3) displaying information indicating that the function has been disabled in a part of the screen. The displayed information may be text information or a mark indicating that the function has been disabled.

[0120] The amount of information that can be displayed on the display screen of the display device 11 is limited. The HCU 3 periodically checks the icons displayed on the display device 11, and if the number of icons increases beyond a predetermined amount, organizes the displayed information by reducing the displayed information to secure a display area or by deleting less important displayed information.

[0121] The HCU3 may display link information for moving to an authentication registration site for the application of the charged function. When checking whether the authentication of the charged function has expired, the occupant can access the registration site for the charged function by selecting a link to the contact information using the browser function of the HCU3 or the display device 11. The telephone number or URL of the contact information or its QR code (registered trademark) may also be displayed. Even if the DCU4 of the vehicle 2 cannot connect to the network 7, the occupant may be able to deal with the situation using the communication function of the mobile terminal 9 as long as the information is displayed. As a result, even if the DCU4 cannot connect to the network 7, the occupant can access the registration site through the mobile terminal 9, which can alleviate the occupant's anxiety.

[0122] The DCU4 may determine whether the authentication unit 4b can authenticate the charged function in S84 even while the application of the alternative function searched for by the search unit 4f in S83 is being executed. If the DCU4 determines that the authentication of the charged function is possible in S85, the HCU3 may stop the execution of the application of the alternative function in S86 and activate the charged function in S87. The HCU3 may then prioritize the execution of the application of the charged function. As a result, even while the application of the alternative function is being executed, if authentication of the regular application of the charged function becomes possible, the application of the charged function can be executed with priority, improving user convenience.

[0123] Conversely, once the HCU3 has performed the alternative function, the priority of performing the alternative function may be increased over the billable function of the subscription service. The DCU4 may store in the storage unit 4d that the priority has been changed, and may refer to the priority in the storage unit 4d to determine which function to perform. In this case, the HCU3 may prioritize the performance of the alternative function over the billable function.

[0124] As described above, according to this embodiment, even if the search unit 4f searches for an alternative function and the authentication unit 4b determines that the paid function cannot be implemented, the HCU 3 implements the alternative function searched for by the search unit 4f. Therefore, even if the license authentication for the paid function of the subscription service fails from within the vehicle 2, the alternative function can be used to implement a function at the same level as the subscription service of the paid function or at the minimum level required by the occupant.

[0125] A modification of the second embodiment will be described below with reference to FIGS. 10B and 10C. <Modification 1 of the second embodiment> A first modified example of the second embodiment will be described with reference to FIG. 10B. The DCU 4 uses the authentication unit 4b to determine whether or not to implement the billing function. If there is no section where the signal is interrupted when the navigation application is being executed (NO in S281), the billing function can be activated as usual (S282). However, there are cases where it is possible to recognize in advance that there is a section where the signal is interrupted on the route indicated by the navigation (YES in S281). Here, the DCU 4 determines in advance the possibility of a network connection failure, thereby determining in advance that the authentication unit 4b will be unable to authenticate the billing function.

[0126] In such a case, the DCU 4 notifies the occupant in advance via the HCU 3 that there is a section on the route where radio waves are interrupted (S283), and then searches for an alternative function from the portable terminal 9 (S284). Then, the DCU 4 determines whether an alternative function is available in S285, and if an alternative function is available, suggests to the occupant to use the alternative function in the specific section in S286. At this time, when the DCU 4 receives an operation input from the operation input unit 12, it stores the occupant's response in the storage unit 4d.

[0127] On the other hand, if the DCU 4 determines in S285 that there is no alternative function, it notifies the occupant through the HCU 3 and the display device 11 in S288 that the pay function may be unavailable in the specific section. If the DCU 4 determines in S289 that the pay function can be authenticated even when the specific section is reached, it exits this routine and executes the pay function as usual. Conversely, if the DCU 4 determines in S289 that the pay function cannot be authenticated because the specific section is reached, it implements a response in accordance with the occupant's answer that is pre-stored in the storage unit 4d in S290.

[0128] For example, if a route where radio waves are interrupted is set or if the validity period of the billing function expires after midnight, the DCU 4 can execute the billing function as usual if it is possible to authenticate the billing function even when the vehicle approaches the specific section described above. Conversely, if the DCU 4 determines that the billing function is no longer possible to authenticate when the vehicle approaches the specific section, it takes action according to the occupant's response that is pre-stored in the storage unit 4d in S290. At this time, even if the billing function becomes unavailable, an alternative function that the occupant has pre-set can be executed, improving the convenience of the occupant.

[0129] <Modification 2 of the second embodiment> 10C, the processes of S381 to S386 may be executed before searching for an alternative function from the mobile terminal 9 in S284. The DCU 4 refers to the storage unit 4d and determines whether or not a charged function whose expiration date is within a predetermined period (for example, one day, two days, one week, etc.) is registered in S381. If the expiration date is set to be within the predetermined period in S381, the DCU 4 notifies the occupant that there is a charged function whose expiration date is about to expire in S382 by using the function of the notification control unit 3d of the HCU 3. Then, the DCU 4 proposes updating the expiration date of the charged function in S383. If the occupant confirms the update, that is, does not deny the update, the DCU 4 communicates with the external management server 8 in S386 to update the expiration date of the charged function and stores the result in the storage unit 4d.

[0130] Furthermore, when the route is set by the navigation function, if it is expected that the validity period of the billing function will expire during driving, the HCU 3 searches for an alternative function from the mobile terminal 9 in S284. The subsequent processing is similar to the processing of S285 to S290 in Fig. 10B, and therefore the description will be omitted.

[0131] According to such a modified example of the second embodiment, the network communication unit 4a communicates with an external management server 8 that stores information on billing functions that can be executed by the occupant of the vehicle 2 via the network 7, and the authentication unit 4b judges whether or not the billing function can be executed via the network communication unit 4a. The authentication judgment unit 4g judges in advance whether authentication of the billing function by the authentication unit 4b will be impossible by determining in advance the possibility of occurrence of at least one of a network connection failure and expiration of the billing function. The notification control unit 3d is configured to notify the occupant when the authentication judgment unit 4g judges that authentication by the authentication unit 4b will be impossible.

[0132] Furthermore, the DCU 4 searches for an alternative function that has the same purpose of use as the charged function by the search unit 4f, and when the authentication judgment unit 4g judges that the authentication by the authentication unit 4b is impossible due to poor network connection, the notification control unit 3d proposes the implementation of the searched alternative function. For example, when the DCU 4 judges that there is a high possibility that the network 7 cannot be connected because of a route setting that causes radio waves to be interrupted, it judges that the function will not be usable for a long period of time and proposes the implementation of the alternative function. This makes it possible to make a thoughtful proposal to the occupant by proposing the implementation of the alternative function even if the charged function will not be usable for a long period of time.

[0133] When using the function of the search unit 4f, the DCU 4 may add the passenger's preferences to the determination of the alternative function. For example, in the case of audio applications, it may search for an application with an alternative function that is strong in deep bass or treble, or an application with an alternative function that emphasizes the preference for music genres such as JPOP and jazz. In addition, in the case of the navigation function, it may set the background color to pastel or vivid, have the passenger input these preferences in advance on an option screen, or learn the audio setting input by the passenger.

[0134] The DCU 4 searches for an alternative function by the search unit 4f, and when it is determined that the authentication by the authentication unit 4b becomes impossible due to the expiration of the billing function, it is preferable to suggest to the occupant that the billing function be extended by the notification control unit 3d. For example, when the expiration date is changed beyond 12:00 p.m. or when the expiration date is expired while the vehicle 2 is traveling, it is preferable to suggest to the occupant that the expiration date be extended. It is also preferable to suggest to the occupant that the expiration date be extended when the expiration date is relatively close, such as within one week or two weeks.

[0135] Third embodiment The third embodiment will be described with reference to Fig. 11A to Fig. 13B. In the third embodiment, differences from the first and second embodiments will be described. As shown in Fig. 11A, in S91, the DCU 4 performs authentication via the network 7 using the authentication unit 4b. In S92, the DCU 4 determines whether the authentication is successful using the authentication unit 4b.

[0136] If the authentication is successful in S92, the DCU 4 activates the pay-per-use function using the authenticated regular ID (personal authentication identification information) in S93. In this case, the user can use the pay-per-use function as usual.

[0137] If the authentication by the authentication unit 4b fails in S92, the DCU 4 judges in S94 whether the reason for the failure is communication interruption due to deterioration of the communication environment. If the communication is not interrupted, the DCU 4 judges NO in S94 and judges that the personal authentication has failed. However, if the reason for the failure is communication interruption, the DCU 4 inquires the user in S95 whether or not the user intends to be charged for the corresponding charged function by displaying the display device 11 through the HCU 3 or communicating with the mobile terminal 9. For example, during a trial period such as one month, the charged function or other charged functions may be available free of charge. In this case, the user may be notified of this fact and asked whether or not the user intends to be charged. If the DCU 4 does not accept an approval operation by the operation input unit 12 for a predetermined period of time, the DCU 4 may erase the display of whether or not the user intends to be charged for the additional function.

[0138] As a result, the DCU 4 determines in S96 whether or not there is an intention to charge additional fees. When the DCU 4 receives an input indicating an intention to charge from the operation input unit 12 or the mobile terminal 9, the DCU 4 determines YES in S96 and determines that the user intends to charge additional fees for the corresponding charge-based function. For example, if identification information such as a credit card number is stored in advance in the storage units 3a, 4d in the vehicle 2, the DCU 4 may regard this as an intention of the user to charge and automatically determine that there is an intention to charge additional fees.

[0139] In S97, the DCU 4 performs additional charging via the short-range wireless communication unit 5 through the mobile terminal 9, for example, by credit card payment, and activates a charging function using the personal authentication information of the new ID. After that, the corresponding charging function may be executed by the HCU 3 or the like. In addition, if a certificate is stored in the mobile terminal 9, the mobile terminal 9 may transmit the certificate to the vehicle 2, thereby enabling authentication even offline.

[0140] On the other hand, if the reason for failure is not communication interruption in S94 of Fig. 11A, the routine may be terminated as it is as shown in Fig. 11A, but the DCU 4 may inquire of the occupant whether or not he / she wishes to add charging by linking it to a conventional ID that has existed for a long time as shown in S95a of Fig. 11B. Then, if the occupant indicates an intention to charge in S96a, the DCU 4 may activate the charging system function with the conventional ID in S97a.

[0141] If it is determined that the occupant has the intention to be charged, and even while the HCU 3 is performing the corresponding charging function, the DCU 4 performs online authentication via the network communication unit 4a in S101 of Fig. 12. When the communication environment of the network 7 becomes good, the DCU 4 collates the information stored in the database 8a of the external management server 8 in S101.

[0142] In S102, the DCU4 judges whether the corresponding charged function can be used without additional charge. When the DCU4 judges in S102 that the corresponding charged function can be used without additional charge, it may cancel the additional charge for the corresponding charged function in S103 and cancel the occupant's decision on whether to charge the additional charge. Furthermore, the new ID may be canceled in S104. Canceling the new ID is optional, and it may be canceled after confirming the occupant's intention to cancel. Thereafter, the HCU3 becomes able to execute the corresponding charged function with the existing regular ID. As a result, the occupant can effectively use the charged function with the existing regular ID. Also, for example, the period during which the additional charge was used may be compared with the expiration date before the authentication expired, and if it is outside the expiration date, additional charge may be executed.

[0143] The DCU 4 may determine YES in S102, and may perform a refund process if it determines that, for example, a double charge has occurred. When canceling the charge in S103 and performing a new ID deletion process in S104, it may notify the passenger of this through the display device 11. The message at this time may be, for example, "A refund process will be performed since a double charge has occurred," or "No additional charge was made since a charge had already been made. The function is functioning without additional charge." In this case, the passenger can confirm whether he or she ended up being charged in vain, whether a refund was made after the charge, or whether no charge was made at all, which prevents the passenger from feeling uneasy.

[0144] <Variation 1> <Regarding button operations by passengers and the display screen contents of the display device 11 while the vehicle is stopped, during automatic driving, or while the vehicle is running> For example, if the authentication by the authentication unit 4b fails due to a communication interruption in S94 in Fig. 11A, the occupant is asked whether or not he / she will be charged. Even if the authentication by the authentication unit 4b fails due to a communication interruption in S94 in Fig. 11B, the occupant is asked whether or not he / she will be charged in S95a.

[0145] For example, as shown in FIG. 11C, the HCU3 displays an inquiry display P on the display screen of the display device 11 to prompt the occupant to input an operation. For example, in the example shown in FIG. 11C, "Approval for the application in use has failed. Would you like to make an additional charge? 'Yes' or 'No'" is displayed to prompt the occupant to input an operation. At the same time, the HCU3 warns the occupant by displaying an exclamation mark in the center of the map screen M where the navigation application is running, and directs the occupant's attention to the inquiry display P. In this case, some kind of operation input is required by the operation input unit 12.

[0146] When the occupant presses a predetermined button "Yes" through the operation input unit 12 while the vehicle 2 is stopped, in automatic driving, or in manual driving, the HCU3 makes an additional charge, activates the charge-based function, and then erases the inquiry display P from the display screen as shown in FIG. 11C.

[0147] Also, when the vehicle 2 is being manually driven, there may be cases where the occupant does not press the predetermined button "Yes" through the operation input unit 12. In this case, the pay-per-use function cannot be activated no matter how much time passes in the processing routine shown in FIG. 11A. In such a case, as shown in S96a to S96c in FIG. 11D, when the HCU 3 determines that no operation instruction is accepted through the operation input unit 12 for a predetermined period of time, it is advisable to delete the inquiry display P. An example of this screen transition is shown in FIG. 11E.

[0148] If the driver does not input the charging intention even after a predetermined time has elapsed, a list of expired billing functions may be notified by a pop-up on the display screen of the display device 11 in S96c of FIG. 11D. An example of the screen at this time is shown in FIG. 11F. As shown in the upper column of FIG. 11F, the HCU3 may prompt the driver to input the operation by displaying a question display P2 of the "Authentication expired application list" button while leaving a warning display of an exclamation mark on the map screen M. Then, when the HCU3 detects that the question display P2 of the authentication expired application list has been input, the DCU4 refers to the database 4e, and the HCU3 selects the expired billing functions stored in the database 4e and displays them on the display screen. See the lower column of FIG. 11F.

[0149] If the intention to charge is not inputted after a specified time has elapsed, the HCU3 may directly display a list of expired applications on the display screen of the display device 11, as shown in the lower column of Figure 11F, without displaying the inquiry display P2 for a list of expired applications as shown in the upper column of Figure 11F.

[0150] The HCU3 may selectively allow the occupant to determine whether or not a billing function is necessary. In this case, the HCU3 may display a question display P3 indicating "enable", and selectively enable, i.e., activate, the billing function when the question display P3 is pressed. Here, the billing period and its history information may be displayed for each billing function.

[0151] <Variation 2> <In particular, regarding the indication of charging intention while the vehicle is moving and the display screen contents of the display device 11> In particular, it is difficult for the driver to indicate his / her intention to charge additional fees while the vehicle is being driven manually, etc. For example, if the DCU 4 needs to inquire in detail about the intention to charge additional fees from the occupant, it may be necessary for the driver to input the operation multiple times.

[0152] For example, this is the case where numbers or setting buttons are operated at least twice in succession to input charging conditions such as credit card number information, expiration date (charging method), and expiration date and valid number of times required when adding a charging function. The charging method here indicates, for example, information such as a credit card number and expiration date. Furthermore, charging conditions can include, for example, a charging period condition in units of one day, one week, one month, three months, six months, or one year, and a number of times condition such as once or three times while the vehicle 2 is running. In such a case, it is not preferable for a passenger in the vehicle 2, particularly the driver, to input operations multiple times. Therefore, it is preferable to perform all authentication by accepting a single button operation input.

[0153] In this case, the operation button of the operation input unit 12 may be an icon displayed on the display screen of the display device 11 or a physical button installed on a steering wheel or the like. In the case of an icon, it is not normally displayed on the display screen of the display device 11. The HCU3 displays an icon on the display screen only in an emergency, and the occupant taps this icon to accept operation input via the touch panel. In particular, it is preferable that the icon is configured to be displayed only "when an operation is required from the occupant in an emergency while driving."

[0154] Also, for example, the physical buttons installed around the steering wheel are not normally assigned with their functions. Only when an emergency operation is required from the occupant while driving, the HCU 3 displays the role of the physical button on the display screen of the display device 11, and treats the result of pressing the physical button as the operation input result of the operation input unit 12, indicating the decision of charging intention.

[0155] In particular, when requesting approval in an emergency, it is preferable to accept operation input using a physical button or an icon on the condition that authentication by the authentication unit 4b has already expired. There is no need to provide a separate confirmation button for charging. As a result, for example, when an operation input is made using a physical button or an icon, if the condition of S94 in FIG. 11A is satisfied, the processes of S95 and S96 can be omitted and the charge-based function can be immediately activated in S97. Also, for example, if it is determined that the condition of S94 in FIG. 11B is not satisfied, the processes of S95a and S96a can be omitted and the charge-based function can be immediately activated in S97a.

[0156] Also, by setting various authentications in advance, the charging intention including the charging method and charging conditions may be set in advance in the storage unit 3a or the storage unit 4d of the DCU 4 through the HCU 3. Alternatively, the charging intention including the charging method and charging conditions may be set in the mobile terminal 9. For example, the HCU 3 may display an option setting screen and allow the occupant to input the charging method and charging conditions through the operation input unit 12. The mobile terminal 9 may display an option setting screen on the display screen and allow the occupant to input the charging method and charging conditions.

[0157] If the charging intention is stored in advance in the storage unit 3a, 4d or the mobile terminal 9 in this way, the DCU 4 can refer to this charging intention information locally or through the network 7 and determine that there is a charging intention without performing various authentications. In this case, too, if the charging intention is set in advance in the storage unit 3a, 4d or the mobile terminal 9, for example, if the condition of S94 in Fig. 11A is satisfied, the processing of S95 and S96 can be omitted and the charging function can be immediately activated in S97. Also, for example, if it is determined that the condition of S94 in Fig. 11B is not satisfied, the processing of S95a and S96a can be omitted and the charging function can be immediately activated in S97a.

[0158] <Variation 3> The DCU 4 may determine whether or not the occupant intends to request additional charging for the relevant paid function not only when online authentication by the authentication unit 4b fails, but also when offline alternative authentication by the alternative authentication unit 4c fails.

[0159] 13A, in S111, the DCU 4 performs authentication by the authentication unit 4b via the network 7. In S112, the DCU 4 determines whether or not the authentication by the authentication unit 4b has been successful.

[0160] If the authentication is successful in S112, the DCU 4 activates the pay-per-use function using the authenticated regular ID (personal authentication identification information) in S113. In this case, the user can use the pay-per-use function as usual.

[0161] If authentication by the authentication unit 4b fails in S112, the DCU 4 determines in S114 whether the reason for the failure is communication interruption due to a deterioration in the communication environment. If communication interruption is not the reason, the DCU 4 determines NO in S114, determines that personal authentication has failed, and exits the routine. However, if the reason for failure is communication interruption, the DCU 4 substitutes the authentication by the authentication unit 4b with the alternative authentication unit 4c in S115. If authentication by the alternative authentication unit 4c fails, the DCU 4 inquires of the user in S117 whether or not he or she wishes to be charged for the corresponding fee-based function.

[0162] In this case, the DCU4 may make an inquiry from the mobile terminal 9 using communication of the short-range wireless communication unit 5, and in S118, it judges whether or not there is an intention to charge additionally. When the DCU4 accepts an input of an intention to charge from the mobile terminal 9, it judges YES in S118 and judges that the user intends to charge additionally for the corresponding charged function. In S119, the DCU4 performs additional charging, for example, by credit card payment, and activates the charged function using a new ID (personal authentication information). Then, it is preferable to execute the corresponding charged function by the HCU3 or the like. Also, as shown in FIG. 13B, if the DCU4 does not indicate an intention to charge even after a predetermined time has elapsed in S118a, it may erase the inquiry display P in S118b and display a list of expired charged functions in S118c. Also, it may execute the same process as that shown in <Modification 1>.

[0163] As described above, according to this embodiment, when authentication by the authentication unit 4b fails, the DCU 4 judges whether the occupant intends to charge additional fees for the corresponding charged function. If the DCU 4 judges that the occupant intends to charge additional fees for the corresponding charged function, the DCU 4 enables the corresponding charged function to be implemented. This makes it possible to meet the occupant's requests and improve user convenience.

[0164] (Other embodiments) The present invention is not limited to the above-described embodiment, but can be implemented in various modified forms, and can be applied to various embodiments without departing from the spirit of the present invention. In the above embodiment, the authentication process is mainly performed by the DCU4, but some or all of the processes and functions may be performed by another in-vehicle device (e.g., the HCU3). Conversely, the functions installed in the HCU3 may be performed by another in-vehicle device (e.g., the DCU4).

[0165] The methodology of the HCU3 or other DCU4 described in the present disclosure may be implemented by a special-purpose computer provided by configuring a processor and memory programmed to execute one or more functions embodied in a computer program. Alternatively, the methodology of the HCU3 and DCU4 described in the present disclosure may be implemented by a special-purpose computer provided by configuring a processor with one or more dedicated hardware logic circuits. Alternatively, the control device and the methodology described in the present disclosure may be implemented by one or more special-purpose computers configured by combining a processor and memory programmed to execute one or more functions and a processor configured with one or more hardware logic circuits. Also, the computer program may be stored in a computer-readable non-transitory tangible recording medium as instructions executed by the computer.

[0166] Processing may be performed by combining the techniques of the functions in each embodiment, or by combining the techniques of the respective embodiments. Among these, according to the first aspect of the present disclosure, in addition to the claims, the following inventions are also included.

[11] The vehicle authentication system includes an internet communication unit (4a) that communicates via a network with a server (8) that stores information regarding chargeable functions that can be implemented by vehicle occupants, an authentication unit (4b) that authenticates whether or not the chargeable function can be implemented through the internet communication unit, and an alternative authentication unit (4c) that substitutes for the authentication unit's authentication when it is not possible to connect to the server through the internet communication unit, wherein the alternative authentication unit performs alternative authentication when the authentication unit fails to determine whether or not the chargeable function can be implemented through the internet communication unit as a result of a loss of connection with the server.

[0167]

[12] The alternative authentication unit determines that a paid function can be implemented and performs alternative authentication when the paid function to be determined as executable falls under at least one of a function necessary for the running of the vehicle, a function necessary for the safety of the occupants, or a function for making the internal environment of the vehicle comfortable

[11] .

[0168]

[13] An authentication system for a vehicle according to

[11] or

[12] , comprising an external environment acquisition unit (6) that acquires environmental information external to the vehicle, wherein when the alternative authentication unit determines whether or not a comfort function for making the internal environment of the vehicle comfortable can be implemented, the alternative authentication unit performs alternative authentication by adding the environmental information external to the vehicle to the determination conditions for whether or not to implement the paid function.

[0169]

[14] A vehicle authentication system according to any one of

[11] to

[13] , wherein when the vehicle is traveling and the authentication unit fails to determine whether the charging function can be implemented while the charging function is being implemented, the alternative authentication unit determines that the charging function can be implemented.

[0170]

[15] The vehicle further includes a notification control unit (3d) for notifying the occupant, The vehicle authentication system according to any one of

[11] to

[14] , wherein when the alternative authentication unit determines whether or not the paid function can be implemented through the alternative authentication, the notification control unit controls to notify the occupant of the result of the determination made by the alternative authentication unit as to whether or not the paid function can be implemented.

[0171]

[16] A vehicle authentication system according to any one of

[11] to

[15] , wherein the result of the determination made by the alternative authentication unit as to whether or not a charge-based function can be implemented is valid until authentication by the authentication unit is possible, or until the vehicle is stopped and the power source of the vehicle is turned off while authentication by the authentication unit is not possible.

[0172]

[17] The vehicle authentication system according to

[16] further comprises a notification control unit (3d) that notifies the occupant, and if the power is turned off while the authentication by the authentication unit has failed, and if authentication also fails the next time the power is turned on, the notification control unit notifies the occupant that the function for which the authentication by the authentication unit has failed cannot be used.

[0173]

[18] The vehicle authentication system according to any one of

[11] to

[17] , further comprising an authentication history information storage unit that stores authentication history information of a paid function, and the alternative authentication unit uses the authentication history information of the paid function to determine whether or not to implement the function.

[0174]

[19] The authentication method for a vehicle includes a process in which an internet communication unit (4a) communicates via a network with a server (8) that stores information regarding pay-per-use functions that vehicle occupants can perform, an authentication unit (4b) authenticates whether or not the pay-per-use function can be performed through the internet communication unit, and a process in which an alternative authentication unit (4c) substitutes for the authentication of the authentication unit when it is not possible to connect to the server through the internet communication unit, wherein the alternative authentication unit performs alternative authentication when the authentication unit fails to determine whether or not the pay-per-use function can be performed through the internet communication unit as a result of the network connection being interrupted.

[0175]

[20] A vehicle authentication program comprising: a procedure for communicating, via a network, with a server (8) that stores information on chargeable functions that can be performed by vehicle occupants using an internet communication unit (4a); a procedure for authenticating, via the internet communication unit, whether or not the chargeable functions can be performed using an authentication unit (4b); and a procedure for substituting the authentication unit's authentication when it is not possible to connect to the server via the internet communication unit using an alternative authentication unit (4c), wherein the vehicle authentication program causes the vehicle authentication system to execute a procedure for substituting the authentication unit's authentication when the authentication unit fails to determine whether or not the chargeable functions can be performed via the internet communication unit as a result of the network connection being interrupted.

[0176] According to a second aspect of the present disclosure, in addition to the claims, the following invention is also included. [twenty one] A vehicle control system comprising: an internet communication unit (4a) that communicates via a network with a server that stores information on paid functions that can be implemented by vehicle occupants; an authentication unit (4b) that determines whether or not the paid function can be implemented via the internet communication unit; a search unit (4f) that searches for an alternative function that has the same purpose of use as the paid function; and a control unit (3) that implements the alternative function found when the authentication unit determines that the paid function cannot be implemented.

[0177] [twenty two] A vehicle control system as described in

[21] , wherein when the authentication unit determines that the pay-per-use function cannot be implemented due to a loss of communication connection with the network, the search unit searches for the alternative function that can be implemented in an offline state.

[0178] [twenty three] A vehicle control system according to

[21] or

[22] , wherein, when the authentication unit determines that the pay-per-use function cannot be implemented even though a connection with the server via a network has been established, the search unit searches for executable alternative functions via the server.

[0179] [twenty four] The vehicle control system according to any one of

[21] to

[23] , wherein the search unit searches for the alternative function that can be implemented in an offline state if the alternative function cannot be found even by searching through the network.

[0180] [twenty five] The authentication unit also determines whether the alternative function can be implemented, and the control unit implements the alternative function if the authentication unit determines that the alternative function can be implemented. Any of the vehicle control systems

[21] to

[24] .

[0181]

[26] The vehicle control system according to any one of

[21] to

[25] , wherein the search unit searches for an alternative function from functions provided in an external terminal.

[27] The control unit of any one of

[21] to

[26] above uses a plurality of the alternative functions and performs the alternative functions so as to reproduce the pay-per-use function that is determined to be impossible to perform.

[0182]

[28] A vehicle control system according to any one of

[21] to

[27] , wherein when the authentication unit is able to implement the paid function while the alternative function is being implemented, the control unit stops implementing the alternative function and prioritizes the implementation of the paid function.

[0183]

[29] Any of the vehicle control systems

[21] to

[28] , wherein when the alternative function is implemented, the priority of implementing the alternative function is increased over the paid function, and the control unit prioritizes implementation of the alternative function over the paid function.

[0184]

[30] a network communication unit (4a) for communicating with a server storing information on pay-per-use functions that can be executed by a vehicle occupant via a network; an authentication unit (4b) for determining whether or not a billing function can be implemented via the network communication unit; and an authentication judgment unit (4) for judging in advance the possibility of occurrence of at least one of a network connection failure and an expiration of the term of validity of the billing function, thereby judging in advance that the authentication unit will be unable to authenticate the billing function; The vehicle control system includes a notification control unit (3) that notifies an occupant when the authentication determination unit determines that authentication by the authentication unit will be impossible.

[0185]

[31] a search unit (4f) for searching for an alternative function having the same purpose of use as the chargeable function, When the authentication judgment unit determines that authentication by the authentication unit is impossible due to a poor network connection, the notification control unit proposes implementing the searched alternative function

[30] .

[0186]

[32] The vehicle control system according to claim 31, wherein the search unit considers occupant preferences as conditions when determining the alternative function.

[0187]

[33] a search unit (4f) for searching for an alternative function having the same purpose of use as the chargeable function, When the authentication judgment unit judges that the authentication of the authentication unit becomes impossible due to the expiration of the term of validity of the charging function, The notification control unit may propose to an occupant an extension of the pay-per-use function.

[34] A vehicle control method comprising the steps of: an internet communication unit communicating via a network with a server storing information on paid functions that can be implemented by vehicle occupants; an authentication unit determining whether or not the paid function can be implemented via the internet communication unit; a search unit searching for an alternative function that has the same purpose of use as the paid function; and a control unit implementing the searched alternative function when the authentication unit determines that the paid function cannot be implemented.

[0188]

[35] A vehicle control program that causes a vehicle control system to execute the following steps: communicating via a network with a server that stores information on paid functions that can be implemented by vehicle occupants using an online communication unit; determining whether or not a paid function can be implemented via the online communication unit using an authentication unit; searching for an alternative function that has the same purpose of use as the paid function using a search unit; and, if the authentication unit determines that the paid function cannot be implemented, executing the searched alternative function using a control unit.

[0189] According to a third aspect of the present disclosure, in addition to the claims, the following invention is also included.

[41] A vehicle control system comprising: an internet communication unit (4a) that communicates via a network with a server (8) that stores information on paid functions that can be implemented by vehicle occupants; an authentication unit (4b) that determines whether or not a paid function can be implemented via the internet communication unit; and a control unit (3) that enables the implementation of the paid function, and when authentication by the authentication unit fails, determines whether or not the occupant intends to be charged for the corresponding paid function, and when the control unit determines that the occupant intends to be charged for the corresponding paid function, enables the implementation of the corresponding paid function.

[0190]

[42] When the authentication unit determines that the occupant intends to be charged and the corresponding charging function is being implemented, the control unit performs online authentication via the Internet communication unit, compares the information stored in the server, and if it determines that the corresponding charging function can be used without additional charge, cancels the additional charge for the corresponding charging function and implements the corresponding charging function

[41] .

[0191]

[43] A vehicle control system according to claim

[41] or

[42] , which is provided with an operation input unit that accepts an approval operation by a passenger indicating his / her intention to make an additional charge.

[0192]

[44] a notification control unit for displaying whether or not there is an intention to charge the additional fee, The vehicle control system of any one of

[41] to

[43] , wherein the notification control unit erases the display indicating whether or not there is an intention to make additional charges when the approval operation is not accepted by the operation input unit for a predetermined period of time.

[0193]

[45] The vehicle control system of any one of

[41] to

[44] , wherein the notification control unit displays, via a pop-up, a list of functions for which the approval operation was not accepted by the operation input unit, or a list of expired paid functions.

[0194]

[46] A vehicle control system comprising: an internet communication unit (4a) that communicates via a network with a server (8) that stores information on pay-based functions that can be implemented by vehicle occupants; an authentication unit (4b) that determines whether or not a pay-based function can be implemented via the internet communication unit; and a control unit (3) that enables the implementation of the pay-based function. The vehicle control system also comprises an alternative authentication unit (4d) that substitutes for the authentication by the authentication unit when authentication by the authentication unit fails, wherein the alternative authentication unit determines whether or not the occupant intends to make an additional charge for a corresponding pay-based function when alternative authentication by the alternative authentication unit fails, and when the control unit determines that the occupant intends to make an additional charge for the corresponding pay-based function, enables the implementation of the corresponding pay-based function.

[0195]

[47] A vehicle control method comprising the steps of: an internet communication unit communicating via a network with a server storing information on paid functions that can be implemented by vehicle occupants; an authentication unit determining whether or not a paid function can be implemented via the internet communication unit; and a control unit implementing the paid function, wherein the authentication unit determines whether or not the occupant intends to be charged for the corresponding paid function when authentication by the authentication unit fails, and the control unit enables the implementation of the corresponding paid function when it determines that the occupant intends to be charged for the corresponding paid function.

[0196]

[48] A vehicle control program that causes a vehicle control system to execute the following steps: an online communication unit communicates via a network with a server that stores information on paid functions that can be implemented by vehicle occupants; an authentication unit determines whether or not a paid function can be implemented via the online communication unit; and a control unit implements a paid function, wherein the authentication unit determines whether or not the occupant intends to be charged for the corresponding paid function when authentication by the authentication unit fails, and the control unit enables the implementation of the corresponding paid function when it determines that the occupant intends to be charged for the corresponding paid function.

[0197] Although the present disclosure has been described based on the above-described embodiment, it is understood that the present invention is not limited to the embodiment or structure. The present invention also encompasses various modifications and modifications within the equivalent range. In addition, various combinations and forms, as well as other combinations and forms including one, more, or less than one element, are also within the scope and concept of the present disclosure. [Explanation of symbols]

[0198] In the drawing, 1 indicates a vehicle authentication system (vehicle control system), 3 indicates an HCU (control unit), 4 indicates a DCU, 4a indicates a network communication unit, 4b indicates an authentication unit, 4c indicates an alternative authentication unit, 4d indicates a memory unit, 4f indicates a search unit, 6 indicates an external information acquisition unit, and 8 indicates an external vehicle management server (server).

Claims

1. a network communication unit (4a) for communicating with a server (8) that stores information regarding chargeable functions that can be executed by a vehicle occupant via a network; an authentication unit (4b) for authenticating whether or not the charging function can be implemented through the network communication unit; an alternative authentication unit (4c) for performing authentication by the authentication unit when the server cannot be connected via the network communication unit; the alternative authentication unit performs alternative authentication when the authentication unit fails to determine whether or not the billing function can be executed via the network communication unit as a result of a disconnection of the connection with the server, A vehicle authentication system that determines that a paid function can be implemented and performs alternative authentication when the paid function to be implemented corresponds to a function necessary for the safety of the occupants.

2. A network communication unit (4a) for communicating with a server (8) that stores information regarding pay-per-use functions that can be performed by a vehicle occupant, an authentication unit (4b) for authenticating whether or not the charging function can be implemented through the network communication unit; an alternative authentication unit (4c) for performing authentication by the authentication unit when the server cannot be connected via the network communication unit; the alternative authentication unit performs alternative authentication when the authentication unit fails to determine whether or not the billing function can be executed via the network communication unit as a result of a disconnection of the connection with the server, An external environment acquisition unit (6) for acquiring environmental information external to the vehicle, The alternative authentication unit performs alternative authentication by adding external environmental information about the vehicle to the determination conditions for whether or not to implement the paid function when determining whether or not to implement a comfort function for making the internal environment of the vehicle comfortable.

3. A network communication unit (4a) for communicating with a server (8) that stores information regarding pay-per-use functions that can be performed by a vehicle occupant, an authentication unit (4b) for authenticating whether or not the charging function can be implemented through the network communication unit; an alternative authentication unit (4c) for performing authentication by the authentication unit when the server cannot be connected via the network communication unit; the alternative authentication unit performs alternative authentication when the authentication unit fails to determine whether or not the billing function can be executed via the network communication unit as a result of a disconnection of the connection with the server, When the vehicle is traveling and the authentication unit fails to determine whether or not the charging system function can be executed while the charging system function is being executed, The alternative authentication unit is a vehicle authentication system that determines that the fee-charging function can be implemented.

4. A network communication unit (4a) for communicating with a server (8) that stores information regarding pay-per-use functions that can be performed by a vehicle occupant, an authentication unit (4b) for authenticating whether or not the charging function can be implemented through the network communication unit; an alternative authentication unit (4c) for performing authentication by the authentication unit when the server cannot be connected via the network communication unit; the alternative authentication unit performs alternative authentication when the authentication unit fails to determine whether or not the billing function can be executed via the network communication unit as a result of a disconnection of the connection with the server, the alternative authentication unit determines whether or not the billing function can be implemented based on the alternative authentication, A vehicle authentication system in which the result of the determination made by the alternative authentication unit as to whether or not the charging function can be implemented is valid until authentication by the authentication unit is possible, or until the vehicle is stopped and the power supply to the vehicle is cut off while authentication by the authentication unit is not possible.

5. A notification control unit (3d) that notifies the occupant, If the power supply is turned off while the authentication by the authentication unit has failed, and if authentication also fails the next time the power supply is turned on, The vehicle authentication system according to claim 4 , wherein the notification control unit notifies the occupant that a function that has failed to be authenticated by the authentication unit cannot be used.

6. A network communication unit (4a) for communicating with a server (8) that stores information regarding pay-per-use functions that can be performed by a vehicle occupant, an authentication unit (4b) for authenticating whether or not the charging function can be implemented through the network communication unit; an alternative authentication unit (4c) for performing authentication by the authentication unit when the server cannot be connected via the network communication unit; the alternative authentication unit performs alternative authentication when the authentication unit fails to determine whether or not the billing function can be executed via the network communication unit as a result of a disconnection of the connection with the server, The vehicle includes an authentication history information storage unit that stores authentication history information of the charging function, The alternative authentication unit uses authentication history information of the charge system function to determine whether or not the function can be implemented.

7. The alternative authentication unit 7. A vehicle authentication system as claimed in any one of claims 2 to 4 and 6, wherein the paid function to be implemented is judged to be executable and alternative authentication is performed when the paid function to be implemented corresponds to at least one of a function necessary for the running of the vehicle, a function necessary for the safety of the occupants, or a function for making the internal environment of the vehicle comfortable.

8. A notification control unit (3d) that notifies the occupant, 7. The vehicle authentication system according to claim 1, wherein when the alternative authentication unit determines whether or not the paid function can be implemented, the notification control unit controls to notify the occupant of the result of the determination made by the alternative authentication unit as to whether or not the paid function can be implemented.

9. A process in which the network communication unit (4a) communicates with a server (8) that stores information on pay-based functions that can be performed by a vehicle occupant, via a network; an authentication unit (4b) authenticating whether or not the charging function is enabled through the network communication unit; a step of an alternative authentication unit (4c) substituting the authentication unit for the authentication when the server cannot be connected via the network communication unit; the alternative authentication unit performs alternative authentication when the authentication unit fails to determine whether or not the billing function can be executed via the network communication unit as a result of a disconnection of the connection with the server, A vehicle authentication method that determines that a paid function can be implemented and performs alternative authentication when the paid function to be implemented is a function necessary for the safety of the occupants.

10. Vehicle authentication system, A procedure for communicating, via a network, with a server (8) that stores information regarding chargeable functions that can be performed by a vehicle occupant by using a network communication unit (4a); a step of authenticating whether or not the charging function can be implemented through the network communication unit by an authentication unit (4b); and a procedure for substituting the authentication of the authentication unit when a connection to the server through the network communication unit cannot be made by an alternative authentication unit (4c), a procedure for performing alternative authentication by the alternative authentication unit when the authentication unit fails to determine whether or not the charging function can be implemented via the network communication unit as a result of a disconnection of the connection with the server; A vehicle authentication program that determines that a paid function that is to be determined as to whether it can be implemented is a function necessary for the safety of the occupants, and causes the alternative authentication unit to perform alternative authentication.

11. A process in which the network communication unit (4a) communicates with a server (8) that stores information on pay-based functions that can be performed by a vehicle occupant, via a network; an authentication unit (4b) authenticating whether or not the charging function is enabled through the network communication unit; a step of an alternative authentication unit (4c) substituting the authentication unit for the authentication when the server cannot be connected via the network communication unit; the alternative authentication unit performs alternative authentication when the authentication unit fails to determine whether or not the billing function can be executed via the network communication unit as a result of a disconnection of the connection with the server, An external environment acquisition unit (6) acquires environmental information external to the vehicle, An authentication method for a vehicle in which the alternative authentication unit, when determining whether or not to implement a comfort function for making the internal environment of the vehicle comfortable, performs alternative authentication by adding external environmental information of the vehicle to the determination conditions for whether or not to implement the paid function.

12. Vehicle authentication system, A procedure for communicating, via a network, with a server (8) that stores information regarding chargeable functions that can be performed by a vehicle occupant by using a network communication unit (4a); a step of authenticating whether or not the charging function can be implemented through the network communication unit by an authentication unit (4b); and a procedure for substituting the authentication of the authentication unit when a connection to the server through the network communication unit cannot be made by an alternative authentication unit (4c), a procedure for performing alternative authentication by the alternative authentication unit when the authentication unit fails to determine whether or not the charging function can be implemented via the network communication unit as a result of a disconnection of the connection with the server; an external environment acquisition unit (6) executes a procedure for acquiring environmental information external to the vehicle; A vehicle authentication program that, when determining whether or not to implement a comfort function for making the internal environment of the vehicle comfortable, adds external environmental information about the vehicle to the determination conditions for whether or not to implement the paid function and performs alternative authentication by the alternative authentication unit.

Images