Electronic control device, function restriction management system, function restriction management method, and function restriction management program

Abstract

To properly obtain an effect of restricting a function to vehicle theft.SOLUTION: An electronic control device 6 comprises: a function restriction setting part 17a that sets function restrictions on vehicle theft; a releasing-propriety determining part 17e that determines releasing-propriety of the function restrictions set by the function restriction setting part, on the basis of priority; and a function restriction releasing part 17g that releases the function restrictions set by the function restriction setting part, under the condition that the releasing-propriety of the function restrictions is identified by the releasing-propriety determining part.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present invention relates to an electronic control device, a function restriction management system, a function restriction management method, and a function restriction management program. [Background technology]

[0002] Conventionally, anti-theft devices for preventing vehicle theft have been provided. For example, Patent Document 1 discloses a system that allows the vehicle to travel when the vehicle is located within a predetermined area such as a valet parking area, and restricts the vehicle from traveling when the vehicle is located outside the predetermined area, thereby preventing the vehicle from leaving the predetermined area. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2010-922 A Summary of the Invention [Problem to be solved by the invention]

[0004] In recent years, there are functions that aim not only to prevent vehicle theft but also to reduce damage if the vehicle is stolen, and set functional restrictions when the vehicle is stolen and release the functional restrictions when the theft is resolved. However, even if the owner of a stolen vehicle sets functional restrictions, if the thief who stole the vehicle can release the functional restrictions, the functional restrictions will not be effective against vehicle theft.

[0005] The present invention has been made in consideration of the above-mentioned circumstances, and its object is to provide an electronic control device, a function restriction management system, a function restriction management method, and a function restriction management program that can appropriately obtain the effect of function restriction against vehicle theft. [Means for solving the problem]

[0006] According to the invention described in claim 1, a function restriction setting unit (17a) sets function restrictions against vehicle theft. A release possibility determination unit (17e) determines whether the function restrictions set by the function restriction setting unit can be released based on priority. A function restriction release unit (17g) releases the function restrictions set by the function restriction setting unit on condition that the release possibility determination unit specifies that the function restrictions can be released.

[0007] Whether or not the function restriction can be lifted is determined based on the priority, and the function restriction is lifted only if it is determined that the function restriction can be lifted. By setting a priority for determining whether or not the function restriction can be lifted, it is possible to prevent a situation in which a thief who steals a vehicle can lift the function restrictions set by the owner of the stolen vehicle. This makes it possible to appropriately obtain the effect of the function restriction against vehicle theft. [Brief description of the drawings]

[0008] [Figure 1] A functional block diagram showing the overall configuration of a first embodiment. [Diagram 2] Functional block diagram of electronic control unit [Diagram 3] A diagram showing a route corresponding to a function restriction setting operation or a function restriction release operation. [Figure 4] A diagram showing the relationship between priority and cancellation possibility [Diagram 5] Flowchart showing function restriction setting processing via the first route [Figure 6] Flowchart showing function restriction setting processing via the first route [Figure 7] Flowchart showing function restriction setting processing via the first route [Figure 8] Flowchart showing function restriction setting processing via the first route [Figure 9] Flowchart showing function restriction setting processing by the second route [Figure 10] Flowchart showing function restriction setting processing by the second route [Figure 11]Flowchart showing function restriction setting processing by the second route [Figure 12] Flowchart showing function restriction setting processing by the second route [Figure 13] Flowchart showing function restriction setting processing by the third route [Figure 14] Flowchart showing function restriction setting processing by the third route [Figure 15] Flowchart showing function restriction release processing [Figure 16] A diagram showing the display transition associated with the setting of function restrictions via the first route [Figure 17] A diagram showing the display transition associated with the setting of function restrictions via the first route [Figure 18] A diagram showing the display transition associated with the setting of function restrictions via the first route [Figure 19] A diagram showing the display transition associated with the setting of function restrictions via the first route [Figure 20] A diagram showing the display transition accompanying the release of function restrictions via the first route [Figure 21] A diagram showing the display transition accompanying the release of function restrictions via the first route [Figure 22] A diagram showing the display transition accompanying the release of function restrictions via the first route [Diagram 23] A diagram showing the display transition accompanying the release of function restrictions via the first route [Figure 24] A diagram showing the display transition associated with setting function restrictions via the second route [Diagram 25] A diagram showing the display transition associated with setting function restrictions via the second route [Figure 26] A diagram showing the display transition associated with setting function restrictions via the second route [Figure 27] A diagram showing the display transition associated with setting function restrictions via the second route [Figure 28] A diagram showing the display transition accompanying the release of function restrictions via the second route [Figure 29] A diagram showing the display transition accompanying the release of function restrictions via the second route [Diagram 30]A diagram showing the display transition accompanying the release of function restrictions via the second route [Diagram 31] A diagram showing the display transition accompanying the release of function restrictions via the second route [Diagram 32] A diagram showing the display transition associated with setting function restrictions via the third route [Diagram 33] A diagram showing the display transition associated with setting function restrictions via the third route [Diagram 34] A diagram showing the display transition associated with setting function restrictions via the third route [Diagram 35] A diagram showing the display transition accompanying the release of function restrictions via the third route [Diagram 36] A diagram showing the display transition accompanying the release of function restrictions via the third route [Figure 37] A diagram showing the display transition accompanying the release of function restrictions via the third route [Figure 38] Flowchart showing function restriction release processing according to the second embodiment [Figure 39] Flowchart showing function restriction release processing according to the third embodiment [Diagram 40] Flowchart showing function restriction release processing DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Hereinafter, a number of embodiments will be described with reference to the drawings. In the following embodiments, descriptions of parts that overlap with the preceding embodiments will be omitted. (First embodiment)

[0010] The first embodiment will be described with reference to Fig. 1 to Fig. 37. A function restriction management system 1 mounted on a vehicle is configured so that a vehicle system 2 mounted on the vehicle and a server 3 can communicate data with each other via a communication network 4. The vehicle system 2 is configured so that an in-vehicle communication device (hereinafter referred to as DCM (Data Communication Module)) 5, electronic control devices (hereinafter referred to as ECUs (Electronic Control Units)) 6 to 9, and an HMI (Human Machine Interface) control unit (hereinafter referred to as HCU (HMI Control Unit)) 10 can communicate data with each other via an in-vehicle network 11.

[0011] The in-vehicle network 11 is, for example, a Controller Area Network (CAN) (registered trademark). The in-vehicle network 11 may be FLEXRAY (registered trademark), CXPI (Clock Extension Peripheral Interface) (registered trademark), Ethernet (registered trademark), or the like. In the present embodiment, a configuration in which four ECUs 6 to 9 are connected to the in-vehicle network 11 is illustrated, but the number of ECUs connected to the in-vehicle network 11 is arbitrary. In addition, the number of in-vehicle networks 11 is also arbitrary.

[0012] The DCM 5 is wirelessly connected to the server 3 via the communication network 4, and is also wirelessly connected to an external device 15 (described later) without going through the communication network 4. The ECU 6 is a device that controls setting and releasing of functional restrictions against vehicle theft. Functions against vehicle theft are functions that cause disadvantages to the owner of a stolen vehicle, such as functions related to driving and functions related to charges for using paid services and downloading paid apps.

[0013] Setting a function restriction means enabling the corresponding function restriction and prohibiting the use of the function in whole or in part. For example, if the corresponding function is related to driving, it means prohibiting engine start or motor start or limiting the driving speed to a low speed. For example, if the corresponding function is related to charges such as the use of paid services or the downloading of paid apps, it means prohibiting the use of paid services or the downloading of paid apps in whole or in part.

[0014] Lifting a function restriction means disabling the corresponding function restriction and permitting the use of all or part of a function that was prohibited. For example, if the corresponding function is related to driving, it means permitting engine start or motor start or lifting the limit on driving speed. For example, if the corresponding function is related to charges such as the use of paid services or the downloading of paid apps, it means permitting the use of paid services or the downloading of paid apps in whole or in part.

[0015] That is, by setting the function restriction on the stolen vehicle by the owner of the stolen vehicle, even if the thief performs an operation such as starting the engine or starting the motor, the engine or motor can be prohibited from being started. Even if the thief performs an operation such as using a paid service that requires a fee or downloading a paid application, the use of the paid service or downloading the paid application can be prohibited. After the theft is resolved, the owner of the vehicle performs an operation to release the function restriction, and the function restriction on the vehicle whose theft has been resolved can be released, allowing the engine or motor to be started, for example. The use of paid services and downloading of paid applications can be permitted. The ECU 6 is connected to a battery power source (+B) supplied from the vehicle battery, and can operate even when the vehicle power source is off.

[0016] The other ECUs 7 to 9 are, for example, a device that controls a drive system, a device that controls an ADAS (Advanced Driving Assistant System) system, a device that controls a multimedia system, and the like.

[0017] The HCU 10 is connected to a center information display (hereinafter referred to as CID (Center Information Display)) 12, a meter device 13, and a head-up display (hereinafter referred to as HUD (Head-Up Display)) 14. The CID 12 is disposed in front of the driver's seat and displays, for example, a map used for a navigation function, a camera image by a parking assist function, audio information related to audio, and air conditioning information related to air conditioning. The meter device 13 is disposed in front of the driver's seat and includes various indicators and displays vehicle speed, shift position, remaining fuel, warnings, etc. The HUD 14 projects information such as vehicle speed, shift position, and route guidance on the windshield as a virtual image in front of the driver's seat. Note that the HCU 10 is also connected to a battery power source (+B) supplied from a vehicle battery, similar to the above-mentioned ECU 6, and can operate even when the vehicle power source is off.

[0018] The external device 15 is capable of data communication with the vehicle system 2 by wirelessly connecting to the DCM 5 via the communication network 4. The external device 15 is a portable information terminal such as a smartphone or a tablet terminal that can be carried by the occupant and is a terminal that can be used by the occupant inside or outside the vehicle.

[0019] An operation input unit 16 that allows an occupant to input operations is connected to the HCU 10. The operation input unit 16 is, for example, a touch panel of the CID 12, a steering switch arranged on the steering wheel, or the like.

[0020] As shown in FIG. 2, the ECU 6 includes a control unit 17 and a CAN communication unit 18. The control unit 17 is mainly configured as a microcomputer having a CPU (Central Processing Unit), a ROM (Read Only Memory), a RAM (Random Access Memory), and an I / O (Input / Output). The functions provided by the control unit 17 can be provided by software recorded in a physical memory device and a computer that executes the software, software only, hardware only, or a combination of these. For example, when the control unit 17 is provided by an electronic circuit that is hardware, it can be provided by a digital circuit including a large number of logic circuits or an analog circuit. The control unit 17 executes a program stored in a non-transitive physical recording medium, thereby executing a process corresponding to the control program and a method corresponding to the program.

[0021] The CAN communication unit 18 controls transmission and reception of CAN signals to and from the in-vehicle network 11 .

[0022] The control unit 17 includes a function restriction setting unit 17a, a priority setting unit 17b, a priority holding unit 17c, a priority updating unit 17d, a release possibility determination unit 17e, a determination result notification unit 17f, and a function restriction release unit 17g. The units 17a to 17g constitute a function restriction management program.

[0023] The function restriction setting unit 17a sets function restrictions against vehicle theft. The functions to be restricted may be arbitrarily selected by the vehicle owner in advance, or may be set in advance when the vehicle is shipped from the factory or sold. When setting a function restriction related to driving, for example, the function restriction setting unit 17a transmits a function restriction setting signal to an ECU that controls engine start, an ECU that controls motor start, an ECU that controls driving, etc., and prohibits engine start or motor start or limits the driving speed to a low speed as described above. The priority setting unit 17b sets a priority, which will be described later, based on an operation type corresponding to a function restriction setting operation or release operation. The operation type will be described later.

[0024] When the priority is set by the priority setting unit 17b, the priority holding unit 17c holds the set priority as priority information. The priority update unit 17d updates the priority information held by the priority holding unit 17c. That is, when the priority information is updated by the priority update unit 17d, the priority holding unit 17 holds the updated priority information. Priority will also be described later.

[0025] The release possibility determination unit 17e determines whether the function restriction set by the function restriction setting unit 17a can be released based on the priority according to the operation type held by the priority holding unit 17c. When the release possibility determination unit 17e determines whether the function restriction can be released, the determination result notification unit 17f notifies the determination result.

[0026] When the release possibility determination unit 17e determines whether the function restriction is to be released, the function restriction release unit 17g does not release the function restriction set by the function restriction setting unit 17a. When the release possibility determination unit 17e determines whether the function restriction is to be released, the function restriction release unit 17g releases the function restriction set by the function restriction setting unit 17a. When releasing a function restriction related to driving, for example, the function restriction release unit 17g transmits a function restriction release signal to an ECU that controls engine start, an ECU that controls motor start, an ECU that controls driving, etc., and permits engine start or motor start or releases the limit on the driving speed as described above.

[0027] The operation types corresponding to the setting operation or the release operation of the function restriction will be described. As shown in FIG. 3, there are three types of operation corresponding to the setting operation or the release operation of the function restriction: an operation via communication from the external device 15 through the communication network 4 (hereinafter, sometimes referred to as an operation via the first route), an operation via short-range wireless communication from the external device 15 (hereinafter, sometimes referred to as an operation via the second route), and an operation from the operation input unit 16 (hereinafter, sometimes referred to as an operation via the third route). The short-range wireless communication is a communication in which the external device 15 and the DCM 5 are directly connected wirelessly, such as Bluetooth (registered trademark) or WiFi (registered trademark). If the DCM 5 is configured to be connected by wire, the second route may be a communication in which the external device 15 and the DCM 5 are directly connected by wire, such as a USB (Universal Serial Bus) interface. Each operation will be described below.

[0028] The operation via the first route is an operation in which the vehicle owner operates the external device 15 to transmit a function restriction setting request or a function restriction release request to the HCU 10 of the vehicle system 2 from the external device 15 via the server 3. Since the function restriction setting request or the function restriction release request is transmitted from the external device 15 to the HCU 10 via the server 3, user authentication is performed in three stages: the external device 15, the server 3, and the vehicle system 2. In this case, it is assumed that, for example, the vehicle owner notices that the vehicle has been stolen a certain amount of time has passed since getting off the vehicle, and the external device 15 is unable to communicate with the DCM 5 via short-distance wireless communication.

[0029] For example, when the owner of the vehicle leaves the parking position after parking and returns to the parking position and realizes that the vehicle that should have been parked is not there, the owner operates the external device 15 to wirelessly connect to the server 3 and transmit a function restriction setting request from the external device 15 to the server 3. When the server 3 receives the function restriction setting request from the external device 15, the server 3 transmits the received function restriction setting request to the DCM 5 associated with the external device 15 that is the transmission source of the function restriction setting request. When the DCM 5 receives the function restriction setting request from the server 3, the server 3 transmits the received function restriction setting request to the HCU 10. That is, in the operation of setting the function restriction through the first route, the function restriction setting request is transmitted from the external device 15 to the HCU 10 through the server 3. The above describes the operation of setting the function restriction, but the operation of releasing the function restriction is similar, and in the operation of releasing the function restriction through the first route, the function restriction release request is transmitted from the external device 15 to the HCU 10 through the server 3. The operation through the first route performs user authentication in three stages, and therefore has the highest authentication accuracy.

[0030] The operation via the second route is an operation in which the vehicle owner operates the external device 15 to transmit a function restriction setting request or a function restriction release request to the HCU 10 of the vehicle system 2 without going through the server 3. Since the function restriction setting request or the function restriction release request is transmitted from the external device 15 to the HCU 10 without going through the server 3, user authentication is performed in two stages, the external device 15 and the vehicle system 2. In this case, it is assumed that the vehicle is stolen immediately after the owner parks or gets out of the vehicle, for example, and that the external device 15 is capable of short-range wireless communication with the DCM 5.

[0031] For example, if the owner of the vehicle is threatened after parking and gets off the vehicle, the owner operates the external device 15 to transmit a function restriction setting request from the external device 15 to the DCM 5. When the DCM 5 receives the function restriction setting request from the server 3, the DCM 5 transmits the received function restriction setting request to the HCU 10. That is, in the operation of setting the function restriction through the second route, the function restriction setting request is transmitted from the external device 15 to the HCU 10 without passing through the server 3. Although the operation of setting the function restriction has been described above, the operation of releasing the function restriction is similar, and in the operation of releasing the function restriction through the second route, the function restriction release request is transmitted from the external device 15 to the HCU 10 without passing through the server 3. Since the operation through the second route performs user authentication in two stages, the accuracy of authentication is second only to the operation through the first route. For example, the owner of the vehicle may perform the operation of setting the function restriction through the second route and then the operation of setting the function restriction through the first route. By performing an operation to set function restrictions via the first route after performing an operation to set function restrictions via the second route, it is possible to increase the accuracy of authentication.

[0032] The operation via the third route is an operation in which the vehicle owner operates the operation input unit 16 to directly transmit a function restriction setting request or a function restriction release request from the operation input unit 16 to the HCU 10. Since a function restriction setting request or a function restriction release request is transmitted from the operation input unit 16 to the HCU 10, user authentication is performed at a single stage in the vehicle system 2. In this case, it is assumed that, for example, the vehicle is stolen before the owner of the vehicle gets out of the vehicle, and the operation input unit 16 is operable.

[0033] For example, if the owner of the vehicle is threatened before getting off the vehicle, the owner operates the operation input unit 16 to transmit a function restriction setting request from the operation input unit 16 to the HCU 10. That is, the function restriction setting request is directly transmitted from the operation input unit 16 to the HCU 10. The operation for setting the function restriction has been described above, but the operation for releasing the function restriction is similar. In the operation for releasing the function restriction via the third route, the function restriction release request is directly transmitted from the operation input unit 16 to the HCU 10. The operation via the third route performs user authentication in one step, and therefore has the lowest degree of authentication accuracy. For example, the owner of the vehicle may perform an operation for setting the function restriction via the third route, and then an operation for setting the function restriction via the first route or an operation for setting the function restriction via the second route. By performing an operation for setting the function restriction via the third route, and then an operation for setting the function restriction via the first route or an operation for setting the function restriction via the second route, the degree of authentication accuracy can be increased. In addition, for example, the owner of the vehicle may park the vehicle and then operate the operation input unit 16 to send a function restriction setting request from the operation input unit 16 to the HCU 10 as a preventive safety measure, not limited to cases where the owner has been threatened, before getting out of the vehicle.

[0034] As described above, the priority setting unit 17b acquires information about the routes of the function restriction setting requests and the function restriction release requests from the HCU 10, because the function restriction setting requests and the function restriction release requests are collected in the HCU 10 regardless of the route. When the priority setting unit 17b acquires the information about the routes from the HCU 10, the priority setting unit 17b sets priorities to three routes corresponding to the function restriction setting operation or the release operation. The priority setting unit 17b sets the priority of the first route to "1", the priority of the second route to "2", and the priority of the third route to "3". Here, the smaller the priority number, the higher the priority and the higher the priority should be, and the larger the priority number, the lower the priority and the lower the priority should be. When the priority is set by the priority setting unit 17b in this manner, the priority holding unit 17c holds the set priority as priority information.

[0035] 4, the release possibility determination unit 17e determines whether or not the function restriction can be released by comparing the priority of the function restriction release request and the priority of the function restriction setting request for the function restriction setting request. When the release possibility determination unit 17e determines that the priority of the function restriction release request is higher than the priority of the function restriction setting request or that the priority of the function restriction release request matches the priority of the function restriction setting request, it determines whether or not the function restriction can be released. On the other hand, when it determines that the priority of the function restriction release request is lower than the priority of the function restriction setting request, it determines whether or not the function restriction can be released.

[0036] For example, if the function restriction setting request is the first route and the function restriction release request is the first route, the release possibility determination unit 17e determines that the priority of the function restriction release request matches the priority of the function restriction setting request, and specifies whether the function restriction set by the first route can be released. On the other hand, if the function restriction setting request is the first route and the function restriction release request is the second or third route, the release possibility determination unit 17e determines that the priority of the function restriction release request is lower than the priority of the function restriction setting request, and specifies whether the function restriction set by the first route can be released. In other words, if the owner of a stolen vehicle sets a function restriction by the first route, the function restriction will not be released even if the thief who stole the vehicle attempts to release the function restriction by the third route.

[0037] For example, if the function restriction setting request is the second route and the function restriction release request is the first or second route, the release possibility determination unit 17e determines that the priority of the function restriction release request is higher than the priority of the function restriction setting request, or that the priority of the function restriction release request matches the priority of the function restriction setting request, and specifies whether the function restriction set by the second route can be released. On the other hand, if the function restriction setting request is the second route and the function restriction release request is the third route, the release possibility determination unit 17e determines that the priority of the function restriction release request is lower than the priority of the function restriction setting request, and specifies whether the function restriction set by the second route can be released. That is, if the owner of a stolen vehicle sets a function restriction by the second route, the function restriction will not be released even if the thief who stole the vehicle attempts to release the function restriction by the third route.

[0038] In this way, the owner of a stolen vehicle can operate the external device 15 to set the function restriction via the first route or the second route, so that even if the thief operates the operation input unit 16 to release the function restriction via the third route, the function restriction can be continued without being released, thereby minimizing damage caused by the theft. Furthermore, after the theft is resolved, the owner of the vehicle can release the function restriction via the first route or the second route by operating the external device 15.

[0039] Next, the operation of the above-mentioned configuration will be described with reference to Fig. 5 to Fig. 37. Here, the function restriction setting process by the first route, the function restriction setting process by the second route, the function restriction setting process by the third route, and the function restriction release process will be described in order.

[0040] (1-1) Function restriction setting process via the first route (see Figures 5 to 8) The external device 15, the server 3, and the vehicle system 2 cooperate to perform the function restriction setting process by the first route. When the owner of the vehicle performs an operation to start an application for setting function restrictions on the external device 15, the external device 15 starts the application for setting function restrictions (S1), displays, for example, a password input screen, and waits for the password input operation. When the owner of the vehicle performs an operation to input the password, the external device 15 transmits authentication information required for user authentication, including the password input by the owner of the vehicle, to the server 3 (S2).

[0041] When the server 3 receives authentication information from the external device 15, it compares the received authentication information with pre-registered information and determines whether the authentication has been successful (S3). If the server 3 determines that the authentication information does not match the registered information and determines that the authentication has failed (S3: NO), it transmits authentication failure information indicating that the authentication has failed and indicating the reason for the authentication failure to the external device 15 (S4). When the external device 15 receives the authentication failure information from the server 3, it displays that the authentication has failed and the reason for the authentication failure (S5).

[0042] The external device 15 determines whether to retry the user authentication (S6). If it is determined that the vehicle owner has performed an operation on the external device 15 not to retry the user authentication, or that the vehicle owner has not performed an operation and the time has expired (S6: NO), the application for setting the function restriction is terminated, and the function restriction setting process by the first route is terminated.

[0043] If it is determined that the vehicle owner has performed an operation to retry user authentication on the external device 15 (S6: YES), the process returns to step S2, and the external device 15 displays, for example, a password input screen again and waits for the password input operation again. If the vehicle owner performs the password input operation again, the external device 15 repeats step S3 and subsequent steps. Note that the number of times user authentication is retried may be limited, and when the number of user authentication retries exceeds a predetermined number, the external device 15 may force-terminate the application that sets the function restriction and force-terminate the function restriction setting process by the first route.

[0044] When the server 3 determines that the authentication information matches the registration information and determines that the authentication has been successful (S3: YES), it transmits authentication success information indicating that the authentication has been successful to the external device 15 (S7).

[0045] When the external device 15 receives the authentication success information from the server 3, it displays that the authentication has been successful (S8). The external device 15 displays a function restriction setting screen and waits for a function restriction setting operation (S9). When the owner of the vehicle performs a function restriction setting operation, the external device 15 accepts the function restriction setting by the setting operation from the vehicle owner (S10) and transmits a function restriction setting request indicating the accepted function restriction setting to the server 3 (S11).

[0046] The external device 15 determines whether the transmission of the function restriction setting request to the server 3 was successful (S12). If the external device 15 determines that the transmission of the function restriction setting request to the server 3 failed (S12: NO), for example, by determining that a timeout has occurred without receiving a response confirmation of the function restriction setting request from the server 3, the external device 15 displays a message indicating that the transmission of the function restriction setting request failed (S13), terminates the application for setting the function restrictions, and terminates the function restriction setting process via the first route.

[0047] Furthermore, the external device 15 determines whether to retry sending the function restriction setting request to the server 3, and if it determines that the vehicle owner has performed an operation on the external device 15 that does not retry sending the function restriction setting request to the server 3, or that the vehicle owner has not performed an operation and the timeout has expired, it may terminate the app that sets the function restrictions and terminate the function restriction setting process via the first route.

[0048] If it is determined that the vehicle owner has performed an operation to retry transmission of the function restriction setting request to the server 3 in the external device 15, the process may return to step S9 and repeat steps S9 and thereafter. Alternatively, the number of retries may be limited, and when the number of retries exceeds a predetermined number, the external device 15 may force-terminate the application that sets the function restrictions, and force-terminate the function restriction setting process via the first route.

[0049] For example, when the external device 15 determines that it has received a response confirmation for the function restriction setting request from the server 3 and determines that the transmission of the function restriction setting request to the server 3 was successful (S12: YES), it displays that the transmission of the function restriction setting request was successful.

[0050] When the server 3 receives a function restriction setting request from the external device 15, it transmits the received function restriction setting request to the DCM 5 associated with the external device 15 (S14). The server 3 determines whether the transmission of the function restriction setting request to the DCM 5 was successful (S15). If the server 3 determines that a timeout has occurred because no response confirmation to the function restriction setting request has been received from the DCM 5 and that the transmission of the function restriction setting request to the DCM 5 has failed (S15: NO), it transmits a transmission failure notification indicating failure in the transmission of the function restriction setting request to the external device 15.

[0051] When the external device 15 receives the transmission failure notification from the server 3, it displays that the transmission of the function restriction setting request has failed (S16), terminates the application for setting the function restrictions, and terminates the function restriction setting process via the first route. Note that the external device 15 may determine whether or not to retry transmission of the function restriction setting request from the server 3 to the DCM 5, and when it determines that the vehicle owner has performed an operation in the external device 15 not to retry transmission of the function restriction setting request from the server 3 to the DCM 5, or that a timeout has occurred without the vehicle owner performing any operation, terminate the application for setting the function restrictions and terminate the function restriction setting process via the first route.

[0052] If it is determined that the vehicle owner has performed an operation in the external device 15 to retry transmission of the function restriction setting request from the server 3 to the DCM 5, the process may return to step S11 and repeat steps S11 and thereafter. Alternatively, the number of retries may be limited, and when the number of retries exceeds a predetermined number, the external device 15 may force-terminate the application that sets the function restrictions, and force-terminate the function restriction setting process via the first route.

[0053] For example, when the server 3 determines that it has received a response confirmation of the function restriction setting request from the DCM 5 and determines that the transmission of the function restriction setting request to the DCM 5 was successful (S15: YES), it transmits a transmission success notification indicating that the transmission of the function restriction setting request was successful to the external device 15. When the external device 15 receives the transmission success notification from the server 3, it displays that the transmission of the function restriction setting request was successful (S17).

[0054] When the DCM 5 receives a function restriction setting request from the server 3, the DCM 5 transmits the received function restriction setting request to the HCU 10. When the HCU 10 receives a function restriction setting request from the DCM 5, the HCU 10 transmits the received function restriction setting request to the ECU 6.

[0055] When the ECU 6 receives a function restriction setting request from the HCU 10, the ECU 6 determines whether or not it holds priority information at that time (S18). If the ECU 6 determines that it does not hold priority information (S18: NO), it sets function restrictions based on the received function restriction setting request (S19, which corresponds to a function restriction setting procedure) and determines whether the function restriction setting has been successful (S20).

[0056] For example, after transmitting a function restriction setting signal to the corresponding ECU, the ECU 6 determines that a timeout has occurred without receiving a response signal to the function restriction setting signal from the corresponding ECU, and when it determines that the function restriction setting has failed (S20: NO), it transmits a setting failure notice indicating the failure of the function restriction setting to the external device 15. When the external device 15 receives the setting failure notice from the ECU, it displays that the function restriction setting has failed (S21), terminates the application that sets the function restriction, and terminates the function restriction setting process via the first route.

[0057] For example, after transmitting a function restriction setting signal to the corresponding ECU, the ECU 6 determines that a response signal to the function restriction setting signal has been received from the corresponding ECU, and when it determines that the function restriction setting has been successful (S20: YES), it transmits a setting success notification indicating that the function restriction setting has been successful to the external device 15. When the external device 15 receives the setting success notification from the ECU, it displays that the function restriction setting has been successful (S22).

[0058] The ECU 6 determines the route of the function restriction setting request. If the ECU 6 determines that the function restriction setting request is the first route (S23: YES), it sets the priority information to "1" (S24). If the ECU 6 determines that the function restriction setting request is the second route (S25: YES), it sets the priority information to "2" (S26). If the ECU 6 determines that the function restriction setting request is the third route (S27: YES), it sets the priority information to "3" (S28).

[0059] When the ECU 6 sets the priority information, it transmits a priority setting notification indicating that the priority information has been set to the HCU 10, and also causes the DCM 5 to transmit it to the server 3. When the HCU 10 receives the priority setting notification from the ECU 6, it causes the CID 12 and the meter device 13 to display that the priority information has been set (S29). When the server 3 receives the priority setting notification from the DCM 5, it causes the received priority setting notification to be transmitted to the external device 15 (S30). When the external device 15 receives the priority setting notification from the server 3, it displays that the priority information has been set (S31), and ends the function restriction setting process via the first route.

[0060] On the other hand, when the ECU 6 determines that it holds priority information (S18: YES), it identifies the route of the function restriction setting request (S32), sets the priority of the identified route of the function restriction setting request as the current priority, and compares the current priority with the priority of the held priority information (S33). When the ECU 6 determines that the current priority is higher than the priority of the priority information (S33: YES), it updates the priority information to the current priority (S34) and performs step S29 and subsequent steps. When the ECU 6 determines that the current priority matches the priority of the priority information or that the current priority is lower than the priority of the priority information (S33: NO), it does not update the priority information to the current priority, and performs step S29 and subsequent steps.

[0061] (1-2) Function restriction setting process via the second route (see Figures 9 to 12) The external device 15 and the vehicle system 2 cooperate to perform the function restriction setting process by the second route. When the owner of the vehicle performs an operation to start an application for setting function restrictions on the external device 15, the external device 15 starts the application for setting function restrictions (S41), displays, for example, a password input screen, and waits for the password input operation. When the owner of the vehicle performs an operation to input the password, the external device 15 transmits authentication information required for user authentication, including the password input by the owner of the vehicle, to the DCM 5 (S42).

[0062] When the DCM5 receives authentication information from the external device 15, it transmits the received authentication information to the HCU10. When the HCU10 receives authentication information from the DCM5, it compares the received authentication information with pre-registered registration information and determines whether the authentication is successful (S43). When the HCU10 determines that the authentication information does not match the registration information and determines that the authentication has failed (S43: NO), it transmits authentication failure information to the DCM5 indicating that the authentication has failed and indicating the reason for the authentication failure. When the DCM5 receives authentication failure information from the HCU10, it transmits the received authentication failure information to the external device 15 (S44). When the external device 15 receives authentication failure information from the DCM5, it displays that the authentication has failed and the reason for the authentication failure (S45).

[0063] In this case, the external device 15 also determines whether to retry the user authentication (S46). If it is determined that the vehicle owner has performed an operation on the external device 15 not to retry the user authentication, or that the vehicle owner has not performed an operation and the time has expired (S46: NO), the application for setting the function restriction is terminated, and the function restriction setting process by the second route is terminated.

[0064] If it is determined that the vehicle owner has performed an operation to retry user authentication on the external device 15 (S46: YES), for example, the password input screen is displayed again and the external device 15 waits for the password input operation again. If the vehicle owner performs the password input operation again, the external device 15 returns to step S42 and repeats step S42 and subsequent steps. Note that the number of times user authentication is retried may be limited, and when the number of user authentication retries exceeds a predetermined number, the external device 15 may force-terminate the application that sets the function restriction and force-terminate the function restriction setting process by the second route.

[0065] When the HCU 10 determines that the authentication information matches the registration information and determines that the authentication has been successful (S43: YES), it transmits authentication success information indicating that the authentication has been successful to the DCM 5 (S47). When the DCM 5 receives the authentication success information from the HCU 10, it transmits the received authentication success information to the external device 15.

[0066] When the external device 15 receives the authentication success information from the DCM 5, it displays a message to the effect that the authentication has been successful (S48), displays a function restriction setting screen, and waits for a function restriction setting operation (S49).

[0067] When the owner of the vehicle performs a function restriction setting operation, the external device 15 accepts the function restriction setting by the setting operation from the vehicle owner (S50), and transmits a function restriction setting request indicating the accepted function restriction setting to the DCM 5 (S51).

[0068] The external device 15 determines whether the transmission of the function restriction setting request to the DCM 5 was successful (S52). If the external device 15 determines that the transmission of the function restriction setting request to the DCM 5 was unsuccessful (S52: NO), it displays a message indicating that the transmission of the function restriction setting request to the DCM 5 was unsuccessful (S53), terminates the application that sets the function restriction, and terminates the function restriction setting process via the second route. Note that the external device 15 may determine whether to retry the transmission of the function restriction setting request to the DCM 5, and if it determines that the vehicle owner has performed an operation on the external device 15 that does not retry the transmission of the function restriction setting request to the DCM 5, or that the vehicle owner has not performed an operation and a timeout has occurred, it may terminate the application that sets the function restriction and terminate the function restriction setting process via the second route.

[0069] If it is determined that the vehicle owner has performed an operation in the external device 15 to retry sending the function restriction setting request to the DCM 5, the process may return to step S51 and repeat steps S51 and thereafter. Alternatively, the number of retries may be limited, and when the number of retries exceeds a predetermined number, the external device 15 may force-terminate the application that sets the function restrictions, and force-terminate the function restriction setting process by the second route.

[0070] When the external device 15 determines that the transmission of the function restriction setting request to the DCM 5 has been successful (S52: YES), it displays a message to that effect. After this, steps S55 to S65 are performed in the same manner as steps S18 to S28 described in the function restriction setting process by the first route described above.

[0071] When the ECU 6 sets the priority information, it transmits a priority setting notification indicating that the priority information has been set to the HCU 10, and also causes the DCM 5 to transmit the priority setting notification to the external device 15. When the HCU 10 receives the priority setting notification from the ECU 6, it causes the CID 12 and the meter device 13 to display that the priority information has been set (S66). When the external device 15 receives the priority setting notification from the DCM 5, it displays that the priority information has been set (S67), and ends the function restriction setting process via the second route.

[0072] When it is determined that the priority information is held (S55: YES), the ECU 6 performs steps S68 to S70 in the same manner as steps S32 to S34 described in the function restriction setting process according to the first route described above.

[0073] (1-3) Function restriction setting process via the third route (see Figures 13 and 14) The vehicle system 2 independently performs the function restriction setting process via the third route. When the operation input unit 16 accepts the setting of the function restriction by the setting operation from the vehicle owner (S71), it transmits a function restriction setting request indicating the accepted function restriction setting to the HCU 10. When the HCU 10 receives the function restriction setting request from the operation input unit 16, it transmits the received function restriction setting request to the ECU 6. After this, steps S72 to S82 are performed similarly to steps S18 to S28 described in the function restriction setting process via the first route described above. In this case, when the ECU 6 determines that the function restriction setting has failed (S74: NO), it transmits a setting failure notice indicating the failure of the function restriction setting to the HCU 10. When the HCU 10 receives the setting failure notice from the ECU, it displays the fact that the function restriction setting has failed on the CID 12 and the meter device 13 (S75). When the ECU 6 determines that the function restriction has been successfully set (S74: YES), it transmits a setting success notification indicating that the function restriction has been successfully set to the HCU 10. When the HCU 10 receives the setting success notification from the ECU, it displays on the CID 12 and the meter device 13 that the function restriction has been successfully set (S76).

[0074] When the ECU 6 sets the priority information, it transmits a priority setting notification indicating that the priority information has been set to the HCU 10. When the HCU 10 receives the priority setting notification from the ECU 6, it causes the CID 12 and the meter device 13 to display that the priority information has been set (S83), and ends the function restriction setting process via the third route.

[0075] When it is determined that the priority information is held (S72: YES), the ECU 6 performs steps S84 to S86 similarly to steps S32 to S34 described in the function restriction setting process according to the first route described above.

[0076] (1-4) Function restriction release process (see Figure 15) The ECU 6 identifies the route of the function restriction release request (S91), and compares the priority of the identified route of the function restriction release request with the priority of the route of the function restriction setting request (S92, S93, corresponding to the release possibility determination procedure). If the ECU 6 determines that the priority of the route of the function restriction release request is higher than the priority of the route of the function restriction setting request (S92: YES), or if the ECU 6 determines that the priority of the route of the function restriction release request matches the priority of the route of the function restriction setting request (S93: YES), the ECU 6 releases the function restriction (S94, corresponding to the function restriction release procedure). The ECU 6 deletes the priority information (S95), and saves history information indicating that the function restriction has been released (S96).

[0077] The ECU 6 determines whether the DCM 5 can be wirelessly connected to the server 3 (S97). If the ECU 6 determines that the DCM 5 can be wirelessly connected to the server 3 (S97: YES), the ECU 6 wirelessly connects the DCM 5 to the server 3, causes the DCM 5 to transmit history information to the server 3 (S98), and ends the function restriction release process.

[0078] On the other hand, when the ECU 6 determines that the priority of the route of the function restriction release request is lower than the priority of the route of the function restriction setting request (S92: NO, S93: NO), it does not release the function restriction, does not delete the priority information, and ends the function restriction release process. By comparing the priority of the route of the function restriction release request with the priority of the route of the function restriction setting request in this way, even if, for example, the owner of a stolen vehicle operates the external device 15 to set function restriction via the first or second route, and then the thief of the vehicle operates the operation input unit 16 to release function restriction via the third route, the function restriction setting continues without being released.

[0079] Next, the transition of the display will be described with reference to Fig. 16 to Fig. 37. Here, the transition of the display accompanying the setting of function restrictions by each route and the transition of the display accompanying the release of function restrictions will be described.

[0080] (1) Display transition accompanying the setting of function restrictions via the first route (see Figures 16 to 19) The external device 15 waits for the user to input an ID and password while displaying the login screen, and performs authentication when it receives the input of the ID and password. If authentication fails, the external device 15 displays a message saying "ID or password is incorrect." If the external device 15 cannot wirelessly connect to the server 3, it displays a message saying "Cannot wirelessly connect to the server. Please check the communication environment."

[0081] If the authentication is successful, the external device 15 displays a main menu screen, and when the function restriction management application is launched, the external device 15 displays a message "Do you want to set function restrictions?" and waits for operation input. If the external device 15 receives operation input to set function restrictions by pressing the "YES" button, it displays a message "Setting function restrictions."

[0082] When the external device 15 fails to set the function restrictions due to an inability to wirelessly connect to the server 3, the external device 15 displays a message saying "Failed to connect wirelessly to the server. Failed to set function restrictions." When the external device 15 fails to set the function restrictions due to an inability to wirelessly connect between the server 3 and the DCM 5, the external device 15 displays a message saying "Failed to connect wirelessly to the DCM. Failed to set function restrictions." When the external device 15 fails to set the function restrictions due to an access error to the HCU 10 in the vehicle system 2, the external device 15 displays a message saying "An error has occurred in the vehicle system. Failed to set function restrictions." When the external device 15 fails to set the function restrictions because the function restrictions have already been set, the external device 15 displays a message saying "Function restrictions have already been set."

[0083] When the external device 15 has successfully set the function restriction, it displays a message saying "Function restriction has been set. If you want to cancel the function restriction, please perform the cancel operation." In addition, the HCU 10 displays a message saying "The registered terminal has instructed you to set the function restriction. The function restriction has been set" on the CID 12, and when a function restriction for the navigation function is set, for example, the navigation screen is changed from a normal display to a grayed-out display, or when an icon indicating the function for which the function restriction has been set is displayed, the icon is erased, or when a limit on the driving speed is set, a message saying "The driving speed has been limited to XX km / h" is displayed. Note that, for example, when a map screen is displayed while driving, the HCU 10 sets function restrictions such as destination setting, route guidance, and viewing of registered addresses, since graying out the map screen may affect driving, but the display of the map screen may continue without setting a function restriction on the display of the map screen.

[0084] (2) Display transition accompanying release of function restrictions via the first route (see Figures 20 to 23) The external device 15 waits for the user to input an ID and password while displaying the login screen, and performs authentication when it receives the input of the ID and password. If the authentication fails, the external device 15 displays a message saying "ID or password is incorrect," and if it cannot connect wirelessly to the server 3, it displays a message saying "Cannot connect wirelessly to the server. Please check the communication environment."

[0085] If the authentication is successful, the external device 15 displays a main menu screen, and when the function restriction management application is launched, the external device 15 displays a message "Do you want to release the function restriction?" and waits for an operation input. If the external device 15 receives an operation input to release the function restriction by pressing the "YES" button, it displays a message "Removing the function restriction."

[0086] When the external device 15 fails to release the function restriction due to an inability to wirelessly connect to the server 3, the external device 15 displays a message saying "Failed to connect wirelessly to the server. Failed to release the function restriction." When the external device 15 fails to release the function restriction due to an inability to wirelessly connect between the server 3 and the DCM 5, the external device 15 displays a message saying "Failed to connect wirelessly to the DCM. Failed to release the function restriction." When the external device 15 fails to release the function restriction due to an error in accessing the HCU 10 in the vehicle system 2, the external device 15 displays a message saying "An error has occurred in the vehicle system. Failed to release the function restriction." When the external device 15 fails to release the function restriction because the function restriction has already been released, the external device 15 displays a message saying "The function restriction has been released."

[0087] When the external device 15 has successfully released the function restriction, it displays a message saying "Function restriction has been released. If you want to set a function restriction, please perform the setting operation." In addition, the HCU 10 displays a message saying "A registered terminal has instructed to release the function restriction. The function restriction has been released" on the CID 12, and for example, when the function restriction of the navigation function is released, it returns the navigation screen from a grayed-out display to a normal display, when an icon showing the function for which the function restriction has been released is erased, it displays the icon, and when the driving speed restriction is released, it displays a message saying "Driving speed restriction has been released."

[0088] (3) Display transition accompanying the setting of function restrictions via the second route (see Figures 24 to 27) In this case, the parts related to the server 3 are omitted from the explanation of "(1) Display transition accompanying setting of functional restrictions via the first route" above, but the rest is the same.

[0089] (4) Display transition accompanying release of function restrictions via the second route (see Figures 28 to 31) In this case, the parts related to the server 3 are omitted from the explanation of "(2) Transition of display when functional restrictions are lifted via the first route" above, but the rest is the same.

[0090] (5) Display transition accompanying the setting of function restrictions via the third route (see Figures 32 to 34) The HCU10 displays the message "Set function restrictions?" on the CID12 and waits for operation input from the operation input unit 16. When the HCU10 receives operation input from the operation input unit 16 to set function restrictions by pressing the "YES" button, the HCU10 displays the message "Setting function restrictions" on the CID12.

[0091] When the HCU10 fails to set the function restrictions due to an access error to the HCU10 in the vehicle system 2, it displays a message "An error has occurred in the vehicle system. Setting of function restrictions has failed" on the CID 12. When the HCU10 fails to set the function restrictions because the function restrictions have already been set, it displays a message "Function restrictions have already been set" on the CID 12.

[0092] When the HCU10 has successfully set the function restriction, it displays the message "Function restriction has been set. To release the function restriction, please perform the release operation" on the CID12. In this case, similar to the above-mentioned "(1) Display transition accompanying setting of function restriction by the first route", for example, when a function restriction of the navigation function is set, the HCU10 changes the navigation screen from a normal display to a grayed-out display, when an icon showing the function for which the function restriction has been set is displayed, it erases the icon, and when a limit on the driving speed is set, it displays the message "Driving speed has been limited to XX km / h".

[0093] (6) Display transition accompanying the setting of function restrictions via the third route (see Figures 35 to 37) The HCU10 displays the message "Release function restriction?" on the CID12 and waits for an operation input from the operation input unit 16. When the HCU10 receives an operation input from the operation input unit 16 indicating that the function restriction is to be released by pressing the "YES" button, the HCU10 displays the message "Released function restriction" on the CID12.

[0094] When the HCU10 fails to release the function restriction due to an access error to the HCU10 in the vehicle system 2, it displays a message "An error occurred in the vehicle system. Release of the function restriction failed" on the CID 12. When the HCU10 fails to release the function restriction because the function restriction has already been released, it displays a message "The function restriction has been released" on the CID 12.

[0095] When the HCU10 has successfully released the function restriction, it displays the message "Function restriction has been released. If you want to set a function restriction, please perform the setting operation" on the CID 12. In this case, too, when the HCU10 has released the function restriction on the navigation function, it returns the navigation screen from a grayed-out display to a normal display, when the HCU10 has erased an icon indicating the function for which the function restriction has been released, it displays the icon, and when the HCU10 has released the driving speed restriction, it displays the message "Driving speed restriction has been released."

[0096] In addition, the ECU 6 may store the date and time when the function restriction is set or released as history information in association with the route, and may display the history information on the external terminal 15, CID 12, etc. Also, the display outside the vehicle and the display inside the vehicle, i.e., the display on the external terminal 15 and the display on the CID 12, etc. may be synchronized, and when the function restriction is set or released via the first route or the second route by operating the external terminal 15, the effect may be notified to the CID 12, etc., or when the function restriction is set or released via the third route by operating the operation input unit 16, the effect may be notified to the external terminal 15. Also, it may be possible to select whether or not to synchronize the display on the external terminal 15 and the display on the CID 12, etc. The effect of setting or releasing the function restriction may be notified in any manner, and instead of or in addition to the display on the external terminal 15 and CID 12 as described above, a display by an indicator of the meter device 13 may be used. Also, instead of or in addition to the display, a voice output may be used.

[0097] According to the first embodiment described above, the following advantageous effects can be obtained. The ECU 6 determines whether or not the function restriction can be lifted based on a priority, and lifts the function restriction on the condition that it is determined that the function restriction can be lifted. By setting a priority for determining whether or not the function restriction can be lifted, it is possible to prevent a situation in which a thief who steals a vehicle can lift the function restriction set by the owner of the stolen vehicle. This makes it possible to appropriately obtain the effect of the function restriction against vehicle theft.

[0098] A priority is set based on the operation type corresponding to the setting operation or the release operation of the function restriction, and whether or not the function restriction can be released is determined based on the priority according to the operation type. By associating the operation type with the priority, it is possible to determine whether or not the function restriction can be released by determining the operation type.

[0099] An operation from the external device 15 via communication through the communication network 4 is set as a first route, an operation from the external device 15 via short-range wireless communication is set as a second route, and an operation from the operation input unit 16 is set as a third route, and priorities are set. By determining whether the route is the first route, the second route, or the third route, it is possible to determine whether or not to release the function restriction.

[0100] For example, by setting a function restriction by the setting operation of the setting restriction via the first route after setting a function restriction via the setting operation of the setting restriction via the second route, the accuracy of authentication can be increased, and a situation in which a thief who has stolen a vehicle can cancel the function restriction can be more appropriately prevented.

[0101] Whether or not the function restriction can be released is determined by checking the priority of the function restriction setting request for each route and the priority of the function restriction release request for each route. By giving the priority of the function restriction setting request for each route and the priority of the function restriction setting request, it is possible to determine whether or not the function restriction can be released.

[0102] When the priority of the function restriction release request is higher than the priority of the function restriction setting request or the priority of the function restriction release request and the function restriction setting request match, it is determined whether the function restriction can be released, and when the priority of the function restriction release request is lower than the priority of the function restriction setting request, it is determined whether the function restriction can be released. For example, if the owner of a stolen vehicle sets a function restriction via the first or second route, even if the thief who stole the vehicle attempts to release the function restriction via the third route, the effect of the function restriction can be appropriately obtained by not releasing the function restriction.

[0103] Second embodiment The second embodiment will be described with reference to Fig. 38. The second embodiment differs from the first embodiment in that additional authentication is performed even if the priority of the route of the function restriction release request is lower than the priority of the route of the function restriction setting request.

[0104] (2-1) Function restriction release process (see Figure 38) When the ECU 6 determines that the priority of the route of the function restriction release request is lower than the priority of the route of the function restriction setting request (S92: NO, S93: NO), it determines whether or not additional authentication is required, for example, by password input (S101). When the ECU 6 determines that additional authentication is not required (S101: NO), it ends the function restriction release process. When the ECU 6 determines that additional authentication is required (S101: YES), it determines whether or not the additional authentication has been successful (S102). When the ECU 6 determines that the additional authentication has failed (S102: NO), it ends the function restriction release process. When the ECU 6 determines that the additional authentication has been successful (S102: YES), it performs step S94 and subsequent steps.

[0105] That is, even if the priority of the route of the function restriction release request is lower than the priority of the route of the function restriction setting request, when the ECU 6 determines that the additional authentication is successful, the ECU 6 releases the function restriction in the same manner as when it determines that the priority of the route of the function restriction release request is higher than the priority of the route of the function restriction setting request or that the priority of the route of the function restriction release request and the priority of the route of the function restriction setting request match. The additional authentication may be, for example, a one-time password.

[0106] According to the second embodiment described above, the following advantageous effects can be obtained. In the ECU 6, even if the priority of the route of the function restriction release request is lower than the priority of the route of the function restriction setting request, the function restriction is released on the condition that the additional authentication is successful. For example, even if there is a request to release the function restriction from a route with a low priority due to a mistake by the vehicle owner, the function restriction can be released if the additional authentication is successful.

[0107] Third embodiment The third embodiment will be described with reference to Figures 39 and 40. The third embodiment differs from the first embodiment in that additional authentication is performed when the route priority of the function restriction setting request is "3".

[0108] (3-1) Function restriction release process (see Fig. 39 to Fig. 40) When the ECU 6 determines that the priority of the route of the function restriction setting request is higher than the priority of the route of the function restriction release request (S92: YES), or when the priority of the route of the function restriction release request matches the priority of the route of the function restriction setting request (S93: YES), the ECU 6 determines whether or not the priority of the route of the function restriction setting request is "3" (S201). When the ECU 6 determines that the priority of the route of the function restriction setting request is not "3" (S201: NO), the ECU 6 performs step S94 and subsequent steps.

[0109] When the ECU 6 determines that the priority of the route of the function restriction setting request is "3" (S201: YES), it determines whether or not additional authentication, for example, by password input, is required (S202). When the ECU 6 determines that additional authentication is not required (S202: NO), it releases the function restriction in a limited manner (S204) and ends the function restriction release process. Release of the function restriction in a limited manner means re-setting the function restriction after a certain time has elapsed since the function restriction was released, re-setting the function after the number of times the corresponding function has been used reaches a predetermined number since the function restriction was released, or releasing part of the function restriction, for example, releasing the function restriction not related to driving while not releasing the function restriction related to driving, etc.

[0110] When the ECU 6 determines that additional authentication is necessary (S202: YES), it determines whether the additional authentication is successful (S203). When the ECU 6 determines that the additional authentication is unsuccessful (S203: NO), it also releases the function restriction in a limited manner (S204) and ends the function restriction release process. When the ECU 6 determines that the additional authentication is successful (S203: YES), it performs step S94 and subsequent steps.

[0111] That is, when the ECU 6 determines that additional authentication is not required or that additional authentication is required but failed when the priority of the route of the function restriction release request is higher than the priority of the route of the function restriction setting request, or the priority of the route of the function restriction release request matches the priority of the route of the function restriction setting request and the priority of the route of the function restriction setting request is "3", the ECU 6 releases the function restriction in a limited manner, and when the ECU 6 determines that the additional authentication was successful, the ECU 6 releases the function restriction without any limiting conditions. Note that the additional authentication may also be a one-time password or the like in this case.

[0112] According to the third embodiment described above, the following advantageous effects can be obtained. In the ECU 6, when a function restriction is released by an operation from the operation input unit 16, the function restriction is released on the condition that the additional authentication is successful. By adding the additional authentication, it is possible to prevent a situation in which a function restriction set by a setting operation via the third route is unconditionally released by a release operation via the third route, and it is possible to more appropriately prevent a situation in which a thief who has stolen a vehicle can release the function restriction. Furthermore, if the owner of the vehicle properly performs the additional authentication, the function restriction can be appropriately released.

[0113] In the ECU 6, when the function restriction is released by an operation from the operation input unit 16, if additional authentication is not required or if the additional authentication fails, the function restriction is released in a limited manner. By releasing the function restriction in a limited manner, even if a thief who steals the vehicle is able to release the function restriction, damage caused by releasing the function restriction can be suppressed by setting limited conditions.

[0114] In addition to the claims, the present disclosure also includes the following inventions. [1] a function restriction setting unit (17a) for setting a function restriction against vehicle theft; a release possibility determination unit (17e) for determining whether or not the function restriction set by the function restriction setting unit can be released based on a priority; An electronic control device (6) comprising: a function restriction release unit (17g) that releases the function restriction set by the function restriction setting unit on condition that the release possibility determination unit has determined that the function restriction can be released.

[0115] [2] a priority setting unit (17b) for setting a priority based on an operation type corresponding to a function restriction setting operation or a function restriction release operation; a priority holding unit (17c) for holding the priority set by the priority setting unit, The electronic control device according to [1], wherein the release possibility determination unit determines whether or not the function restriction set by the function restriction setting unit can be released based on the priority held by the priority holding unit.

[0116] [3] The electronic control device described in [2], wherein the priority setting unit sets a priority based on one of the following operation types: operation via communication over a communication network from an external device, operation via short-range wireless communication or wired communication from an external device, and operation from an operation input unit.

[0117] [4] The electronic control device according to claim [2] or [3], further comprising a priority update unit (17d) for updating the priorities held by the priority holding unit.

[0118] [5] The electronic control device described in any one of claims [2] to [4], wherein the release possibility determination unit determines whether or not the function restriction set by the function restriction setting unit can be released by comparing the priority of the function restriction setting request for each operation type with the priority of the function restriction release request for each operation type.

[0119] [6] The electronic control device described in [5], wherein the release possibility determination unit determines whether the function restriction can be released when it determines that the priority of the function restriction release request is higher than the priority of the function restriction setting request, or that the priority of the function restriction release request matches the priority of the function restriction setting request.

[0120] [7] The electronic control device according to [5] or [6], wherein the release possibility determination unit determines whether or not to release the function restriction when it determines that the priority of the function restriction release request is lower than the priority of the function restriction setting request.

[0121] [8] An electronic control device described in any one of [5] to [7], wherein the release possibility determination unit determines whether the function restriction can be released, provided that the authentication result is positive, even if it determines that the priority of the function restriction release request is lower than the priority of the function restriction setting request.

[0122] [9] An electronic control device as described in any one of [3] to [8], wherein the function restriction release unit releases the function restriction when the function restriction is released by operation from the operation input unit, provided that the authentication result is positive.

[0123]

[10] The electronic control device according to any one of claims [3] to [9], wherein the function restriction release unit releases the function restriction in a limited manner when the function restriction is released by operation from the operation input unit.

[0124]

[11] A determination result notifying unit (17f) for notifying a result of the determination by the release determination unit, The electronic control device according to any one of claims [1] to

[10] , wherein the judgment result notification unit notifies the reason for whether or not the functional restriction should be lifted when the liftability judgment unit determines whether or not the functional restriction should be lifted.

[0125] (Other embodiments) Although the present disclosure has been described based on the embodiment, it is understood that the present disclosure is not limited to the embodiment or structure. The present disclosure also includes various modifications and modifications within the equivalent range. In addition, various combinations and forms, as well as other combinations and forms including only one element, more than one element, or less than one element, are also within the scope and concept of the present disclosure.

[0126] The control unit and the method described in the present disclosure may be realized by a special-purpose computer provided by configuring a processor and a memory programmed to execute one or more functions embodied in a computer program. Alternatively, the control unit and the method described in the present disclosure may be realized by a special-purpose computer provided by configuring a processor with one or more dedicated hardware logic circuits. Alternatively, the control unit and the method described in the present disclosure may be realized by one or more special-purpose computers configured by a combination of a processor and a memory programmed to execute one or more functions and a processor configured with one or more hardware logic circuits. Also, the computer program may be stored in a computer-readable non-transitory tangible recording medium as instructions executed by a computer. [Explanation of symbols]

[0127] In the drawing, 1 is a functional restriction management system, 6 is an ECU, 15 is an external device, 16 is an operation input unit, 17 is a control unit, 17a is a functional restriction setting unit, 17b is a priority setting unit, 17c is a release possibility determination unit, 17d is a determination result notification unit, and 17e is a functional restriction release unit.

Claims

1. a function restriction setting unit (17a) for setting a function restriction against vehicle theft; a priority setting unit (17b) for setting a priority based on an operation type corresponding to a function restriction setting operation or a function restriction release operation; a priority holding unit (17c) for holding the priority set by the priority setting unit; a priority update unit (17d) for updating the priority when a current priority indicated by a function restriction setting request is higher than a priority held in the priority holding unit; a release possibility determination unit (17e) for determining whether or not the function restriction set by the function restriction setting unit can be released based on the priority; a function restriction release unit (17g) that releases the function restriction set by the function restriction setting unit on condition that the release possibility of the function restriction is specified by the release possibility determination unit.

2. An electronic control device as described in claim 1, wherein the priority setting unit sets a priority based on one of the following operation types: operation via communication over a communication network from an external device, operation via short-range wireless communication or wired communication from an external device, and operation from an operation input unit.

3. An electronic control device as described in claim 1, wherein the release possibility determination unit determines whether or not the function restriction set by the function restriction setting unit can be released by comparing the priority of the function restriction setting request for each operation type with the priority of the function restriction release request for each operation type.

4. An electronic control device as described in claim 3, in which the release possibility determination unit determines whether a function restriction can be released when it determines that the priority of the function restriction release request is higher than the priority of the function restriction setting request, or that the priority of the function restriction release request matches the priority of the function restriction setting request.

5. The electronic control device according to claim 3 , wherein the release possibility determination unit determines whether or not to release the function restriction when it determines that the priority of the function restriction release request is lower than the priority of the function restriction setting request.

6. 4. The electronic control device according to claim 3, wherein the release possibility determination unit determines whether the function restriction can be released, provided that the authentication result is positive, even if it determines that the priority of the function restriction release request is lower than the priority of the function restriction setting request.

7. An electronic control device as described in claim 2, wherein when a function restriction is released by operation from the operation input unit, the function restriction release unit releases the function restriction on the condition that the authentication result is positive.

8. An electronic control device as described in claim 2, wherein the function restriction release unit releases the function restriction in a limited manner when the function restriction is released by operation from the operation input unit.

9. A determination result notification unit (17f) that notifies a result of the determination by the release determination unit, The electronic control device according to claim 1 , wherein the determination result notification unit, when it is determined by the release possibility determination unit that the function restriction should be released or not, notifies the user of a reason why the function restriction should be released or not.

10. A function restriction management system (1) comprising an electronic control device (6) mounted on a vehicle, an external device (15), and an operation input unit (16), The electronic control device includes: a function restriction setting unit (17a) for setting a function restriction against vehicle theft; a priority setting unit (17b) for setting a priority based on an operation type corresponding to a function restriction setting operation or a function restriction release operation; a priority holding unit (17c) for holding the priority set by the priority setting unit; a priority update unit (17d) for updating the priority when a current priority indicated by a function restriction setting request is higher than a priority held in the priority holding unit; a release possibility determination unit (17e) for determining whether or not the function restriction set by the function restriction setting unit can be released based on the priority; a function restriction release unit (17g) that releases the function restriction set by the function restriction setting unit on condition that the release possibility of the function restriction is specified by the release possibility determination unit, The priority setting unit is a function restriction management system that sets a priority based on any one of the following operation types: operation via communication over a communication network from the external device, operation via short-range wireless communication or wired communication from the external device, and operation from the operation input unit.

11. An electronic control device (6) mounted on a vehicle, A function restriction setting procedure for setting function restrictions against vehicle theft; a priority setting step of setting a priority based on an operation type corresponding to a function restriction setting operation or a function restriction release operation; a priority maintaining step for maintaining the priority set by the priority setting step; a priority update procedure for updating the priority when a current priority indicated by a function restriction setting request is higher than a priority held in the priority holding procedure; a release possibility determination step of determining whether or not the function restriction set by the function restriction setting step can be released based on the priority; a function restriction release step of releasing the function restriction set by the function restriction setting step, on condition that the release possibility of the function restriction is specified by the release possibility determination step.

12. A control unit (17) of an electronic control device (6) mounted on a vehicle, A function restriction setting procedure for setting function restrictions against vehicle theft; a priority setting step of setting a priority based on an operation type corresponding to a function restriction setting operation or a function restriction release operation; a priority maintaining step for maintaining the priority set by the priority setting step; a priority update procedure for updating the priority when a current priority indicated by a function restriction setting request is higher than a priority held in the priority holding procedure; a release possibility determination step of determining whether or not the function restriction set by the function restriction setting step can be released based on the priority; a function restriction release procedure for releasing the function restriction set by the function restriction setting procedure on condition that the release possibility of the function restriction is specified by the release possibility determination procedure; and

Images