On-vehicle device and program

Abstract

To eliminate imperfection in security associated with execution of power schedules.SOLUTION: An on-vehicle device comprises a controller. This controller obtains expiration date information that indicates an expiration date associated with authentication in a process for transferring power between a battery installed on a vehicle and a charging facility, and creates power schedules in which the process is completed by the expiration date.SELECTED DRAWING: Figure 2

Description

Technical Field

[0001] The present invention relates to an in-vehicle device and a program.

Background Art

[0002] As vehicles (also referred to as electric vehicles) that can be charged from an external power source to a driving battery, battery electric vehicles (BEV vehicles), plug-in hybrids (PHV) vehicles, etc. are known. Also, as authentication methods for charging the driving battery, etc., mainly an external authentication method (External Identification Means, EIM) and Plug & Charge (Plug and Charge, PnC) have been proposed (for example, see Patent Document 1 below ). PnC is a procedure according to ISO15118, which is a standard related to the communication interface between an electric vehicle and a power grid called a grid.

[0003] Also, regardless of the authentication method, when authentication of an electric vehicle or charging equipment (Electric Vehicle Supply Equipment, EVSE) is required, after the electric vehicle and the EVSE are connected, the certificate of the electric vehicle (for example, Vehicle certificate) is sent to the EVSE, and the certificate of the EVSE (for example, SECC certificate) is sent to the electric vehicle. Then, each certificate is authenticated by the certificate of the operator (for example, V2G ROOT certificate or OEM ROOT certificate) stored in the peer (the electric vehicle for the EVSE and the EVSE for the electric vehicle). Such an authentication procedure is called Transport Layer Security (TLS) client authentication and server authentication. In PnC, a Contract certificate is held in the electric vehicle in advance, and user authentication is performed using a cryptographic key that is paired with the Contract certificate.

[0004]

[0005] ​Furthermore, ISO15118 has various considerations for Vehicle-to-Grid (V2G). That is, ISO15118 assumes connecting the power grid (also simply referred to as the grid) provided by power companies, etc., to the battery of an electric vehicle and mutually utilizing electric power. And the electric vehicle and the infrastructure on the power grid side can coordinate the power schedule through the communication protocols between the electric vehicle and the EVSE and between the EVSE and the infrastructure.

[0006] Also, in ISO15118, when the electric vehicle does not immediately start charging or discharging with the EVSE on the power schedule, it can enter a pause (PAUSE). For example, There is also a mechanism for the electric vehicle to resume the TLS session at the timing when the power transmission starts. It is stipulated that the user authentication process is skipped during this session resume. In addition, there is a description that instead of the electric vehicle undergoing user authentication, the user authentication at the time of connection between the electric vehicle and the EVSE can be associated with the TLS session through a procedure called TLS binding.

Prior Art Documents

Patent Documents

[0007]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0008] However, in ISO15118, the operation method regarding the relationship between the execution of the power schedule and user authentication is not described. For example, consider the situation where the processing according to the power schedule resumes after a pause. During the execution of the processing in such a situation, TLS A case is assumed where the session lifetime (for example, in ISO 15118, the maximum time for session resumption is set to 24 hours) expires. Also, a case where the expiration date of the Contract certificate expires, or a case where the expiration date of the Vehicle certificate or SECC certificate expires is assumed. Or, a case where these cases are combined may occur. In these cases, there will be a period during which user authentication is not guaranteed. An aspect of the disclosed embodiment is to improve the security deficiency associated with the execution of the power schedule.

Means for Solving the Problem

[0009] One aspect of the disclosed embodiment is exemplified by an in-vehicle device. This in-vehicle device includes a controller. This controller acquires expiration date information indicating an expiration date related to authentication during the process of transferring power between a battery mounted on the vehicle and a charging facility, and creates a power schedule in which the process of transferring power is completed by the expiration date.

Effect of the Invention

[0010] This in-vehicle device acquires expiration date information indicating an expiration date related to authentication in the process of transferring power, and creates a power schedule in which the process of transferring power is completed by the expiration date. Therefore, when charging from the charging facility to the battery or discharging from the battery to the charging facility is performed according to the power schedule created in this way, the vehicle equipped with this in-vehicle device can suppress the expiration of the expiration date related to the above user authentication. That is, this in-vehicle device can reduce the possibility that user authentication fails during the above process. Therefore, this in-vehicle device can improve the security deficiency associated with the execution of the power schedule.

Brief Description of the Drawings

[0011]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

Figure 10

Figure 11

Figure 12

Figure 13

DETAILED DESCRIPTION OF THE INVENTION

[0012] Hereinafter, with reference to FIGS. 1 to 13, a charge / discharge control device 10 and a computer program (hereinafter simply referred to as a program) as an example of an in-vehicle device according to an embodiment will be described.

[0013] <Embodiment> (Configuration) FIG. 1 is a diagram illustrating a vehicle 1 equipped with the charge / discharge control device 10 of the present embodiment. In FIG. 1, a charging facility 2 that supplies power to a battery 19 (see FIG. 2, also referred to as a secondary battery or a storage battery) of the vehicle 1, a Mobility Operator (MO) server 5 that exchanges information with the vehicle 1, an Original Equipment Manufacturer (OEM) server 6, and a commercial power grid (grid) provided by an electric power company or the like are also described. In addition, it is assumed that a home power grid or a power load may be connected instead of the grid. The charge / discharge control device 10 is also called an Electric Vehicle Communication Controller (EVCC). Further, the facility control device 20 is also called a Supply Equipment Communication Controller (SECC).

[0014] The vehicle 1 is called an electric vehicle and can be charged with a traveling battery 19. The vehicle 1 has a charge / discharge control device 10 as an example of an in-vehicle device, and executes a charging process from the charging facility 2 to the battery 19 or a discharging process from the battery 19 to the commercial power grid via the charging facility 2. In the present embodiment, the charging process and the discharging process are called power transfer processes.

[0015] The charging facility 2 has a facility control device 20 and communicates with the charge / discharge control device 10 of the vehicle 1 in accordance with the procedure according to ISO15118 when connected to the charge / discharge control device 10 of the vehicle 1. More specifically, the facility control device 20 establishes a TLS session with the vehicle 1 and executes power supply to the vehicle 1 or power reception from the vehicle 1. Further, after establishing the TLS session, the charging facility 2 executes an authentication process by PnC or EIM through V2G communication and performs a payment process after authentication. In the present embodiment, the "payment process" includes both the payment (billing) from the user's account or the like to the operator's account for charging from the charging facility 2 to the battery 19 and the payment from the operator's account to the user's account for discharging from the battery 19 to the charging facility 2 (settlement for selling electricity).

[0016] In addition to the MO, the charging facility 2 may be managed and operated by an operator called CPO (Charge Point Operator). The charging facility 2 may be installed on the premises of the user's home, in addition to a parking lot where the vehicle 1 is parked, a facility managed by a CPO, an MO, an OEM, etc. The charging facility 2 is connected to a commercial power system, for example, and serves as an interface for exchanging power between the vehicle 1 and the power system. The user of the vehicle 1 concludes a contract with a service provider (such as an MO) in advance to execute the power exchange process via the charging facility 2. Under this contract, a Contract certificate and an encryption key are issued from the MO server 5 and installed in the vehicle 1 via, for example, the OEM server 6. The Contract certificate and the encryption key (these are also referred to as certificate data) can also be called certificate data. Note that the certificate data such as the Contract certificate may be installed in the vehicle 1 via the charging facility 2 in some cases.

[0017] In the power exchange process, first, a TLS session is established. For example, after the connection between the charging facility 2 and the vehicle 1 by the plug 2B, the SECC certificate of the charging facility 2 is notified to the vehicle 1. Then, the SECC certificate is authenticated by the V2G ROOT certificate stored on the vehicle 1 side. Subsequently, the Vehicle certificate of the vehicle 1 is notified to the charging facility 2. Then, the Vehicle certificate is authenticated by the V2G ROOT certificate stored on the charging facility 2 side, or the OEM ROOT certificate. Here, the SECC certificate includes a certificate chain of the operator having a hierarchical structure associated with the V2G ROOT certificate, and the Vehicle certificate includes a certificate chain of the operator having a hierarchical structure associated with the V2G ROOT certificate, or the OEM ROOT certificate.

[0018] The certificate chain corresponds to the hierarchy of the Certificate Authorities (CA). The certificate chain corresponds to the hierarchy of the Certificate Authorities (CA). The highest level of the certificate chain is the root certificate of the CA. The certificate chain includes a hierarchical structure associated with the V2G ROOT certificate, or a certificate chain of the operator having a hierarchical structure associated with the OEM ROOT certificate.

[0019] The highest level of the certificate chain is the root certificate of the CA. The upper-level certification authority can have intermediate certification authorities (also called sub CAs) as lower-level certification authorities. The topmost certification authority is called the ROOT certification authority, which issues V2G ROOT certificates and OEM ROOT certificates. Also, the certification authority certificates (sub-certificates) of the lower-level intermediate certification authorities are signed by the upper-level certification authority.

[0020] Vehicle 1 can finally authenticate the EVSE Leaf certificate by authenticating the certificate chain from top to bottom based on the V2G ROOT certificate. When Vehicle 1 successfully authenticates the SECC certificate, it can obtain the private key used for communication with Charging Facility 2, and thereafter the communication is encrypted by the private key. Thereby, a TLS session is established.

[0021] After the establishment of the TLS session, V2G communication is executed. In V2G communication, requests from Vehicle 1 and responses from Charging Facility 2 are mutually transmitted, and charging and discharging are carried out. In this V2G communication, for example, external authentication using PnC, RFID cards, etc. is carried out.

[0022] As PnC, which is the first authentication procedure after the establishment of the TLS session, the charge / discharge control device 10 of Vehicle 1 creates a signature based on a Contract certificate, etc. and a cryptographic key, and Charging Facility 2 authenticates this. If the authentication is successful, Vehicle 1 executes power transfer processing according to the PnC procedure with Charging Facility 2.

[0023] In addition, in the power transfer process between Vehicle 1 and Charging Facility 2, in addition to the procedure by PnC as described above, as a second authentication procedure, a procedure of an external authentication method (EIM) by presenting an RFID card, etc. is also possible. For this reason, Charging Facility 2 has an EIM reader 2A. The external authentication method is, for example, an authentication method based on user information obtained from a credit card, QR code (registered trademark), RFID (Radio Frequency Identification), etc. via the EIM reader 2A. Also, the case of performing authentication from a mobile app, etc. without going through the EIM reader 2A is also included in the external authentication method.

[0024] Further, the charge / discharge control device 10 can be connected to the MO server 5, the OEM server 6, etc. via the network N1. The network N1 includes, for example, wireless networks such as Long Term Evolution (LTE) , 5th Generation Mobile Communication System (5G), 6th Generation Mobile Communication System (6G), etc., and wired public networks such as the Internet.

[0025] The charging facility 2 may, for example, transfer the signature transmitted from the vehicle 1 to the MO server 5 and request user authentication of the vehicle 1. When the user authentication at the MO server 5 is successful, the charging facility 2 may execute power transfer processing with the battery 19 of the vehicle 1 and execute payment processing (charging or settlement) with the user of the vehicle 1.

[0026] Also, when executing power transfer processing, the vehicle 1 can also request the installation of a Contract certificate or the like from the charging facility 2. In this case, the vehicle 1 presents a certificate (such as an OEM provisioning certificate) issued by the OEM, which is the manufacturer and seller of the vehicle 1, to the charging facility 2. If the charging facility 2 has a valid Contract certificate or the like associated with the OEM provisioning certificate notified from the vehicle 1 and a cryptographic key, it can provide the Contract certificate or the like to the vehicle 1. Also, the charging facility 2 may access the MO server 5 to obtain a valid Contract certificate or the like corresponding to the OEM provisioning certificate and a cryptographic key, and install them in the vehicle 1.

[0027] FIG. 2 is a diagram illustrating modules that operate in the communication between the charge / discharge control device 10 of the vehicle 1 and the facility control device 20 of the charging facility 2 in accordance with ISO 15118, and the data flow between the modules. In each module of the charge / discharge control device 10, the CPU 11 illustrated in FIG. 3 executes processing in accordance with a computer program that has been loaded in an executable manner into memory 12. In each module of equipment control device 20, CPU 21 illustrated in FIG. 3 executes processing in accordance with a computer program that has been loaded in an executable manner into memory 22.

[0028] When the plug 2B of the charging equipment 2 is connected to a connection part including a terminal of the power receiving part and the charge communication part 16B of the power circuit in the vehicle 1 that charges the battery 19 (see FIG. 3), the charge / discharge control device 10 and the equipment control device 20 communicate with each other. That is, the charge / discharge control device 10 and the equipment control device 20 perform TLS authentication and V2G communication. First, the charge / discharge control device 10 notifies the equipment control device 20 of, for example, a Client Hello message, and the equipment control device 20 notifies the charge / discharge control device 10 of a Server Hello message.

[0029] Here, for example, in a procedure according to ISO15118-20, the TLS communication control unit 103 of the charge / discharge control device 10 transmits the Vehicle certificate to the TLS communication control unit 20 of the equipment control device 20. 3 (M1). The vehicle certificate is used to authenticate the authenticity of the charge / discharge control device 10. The vehicle certificate is a leaf certificate issued to the charge / discharge control device 10 (EVCC) by an OEM or a V2G certification authority (such as a sub-CA). The TLS communication control unit 103 reads the vehicle certificate from the certificate storage unit 112. The TLS communication control unit 203 is notified (M21).

[0030] The facility control device 20 communicates with the charge / discharge control device 10 in TLS communication using the vehicle certificate. The vehicle certificate verifies the authenticity of the same V2G session by the equipment control device 20. However, vehicle certificates are not used in procedures specified in standards prior to ISO 15118-20.

[0031] On the one hand, the TLS communication control unit 203 of the equipment control device 20 transmits the SECC certificate to the TLS communication control unit 103 of the charge and discharge control device 10 in accordance with the procedures specified in ISO 15118-20 and the procedures specified in the standards prior to ISO 15118-20 (M2). The SECC certificate is a certificate issued to the equipment control device 20 by either the V2G root CA or the sub-CA so that the charge and discharge control device 10 can verify the authenticity of the equipment control device 20 (SECC).

[0032] The charge and discharge control device 10 and the equipment control device 20 complete the TLS handshake through mutual communication via the TLS communication control unit 103 and the TLS communication control unit 203, and the TLS session starts. Here, for example, the charge and discharge control device 10 authenticates the charging equipment 2 or the equipment control device 20 based on the SECC certificate received from the equipment control device 20. In addition, the TLS communication control unit 103 notifies the power schedule calculation unit 101 of the lifetime of the TLS session (M18).

[0033] Furthermore, the TLS communication control unit 103 delivers the received SECC certificate to the certificate validity period acquisition unit 102 (M3). In addition, the certificate validity period acquisition unit 102 reads the Contract certificate and the Vehicle certificate from the certificate storage unit 112 (M4, M5). Then, the certificate validity period acquisition unit 102 notifies the power schedule calculation unit 101 of the validity periods of the SECC certificate, the Contract certificate, and the Vehicle certificate (M6).

[0034] Authentication of the Vehicle certificate through the TLS communication control unit 203 (however, ISO 15118- ​When the authentication of the SECC certificate through the TLS communication control unit 103 is successful in the case of 20, the V2G communication control units 104 and 204 execute negotiation of the authentication method protocol (M7). Through the negotiation of the authentication method protocol, the authentication method (PnC, EIM, etc.) and the protocol version in payment are determined.

[0035] Furthermore, the V2G communication control unit 104 reads out the Contract certificate from the certificate storage unit 112 (M19) and transmits it to the V2G communication control unit 204 (M8). The V2G communication control unit 204 authenticates the Contract certificate received from the V2G communication control unit 104, and when the verification of the signature signed with the encryption key paired with the Contract certificate is successful, it notifies the V2G communication control unit 104 of the grid power schedule (M9).

[0036] Here, the grid power schedule is the result calculated by the grid schedule calculation unit 205. More specifically, the grid power schedule is information that defines, with respect to the time axis, the power that can be supplied from the power grid (grid) and the power that the power grid (grid) can accept from the vehicle 1 in a predetermined period in the future from the current time. The grid schedule calculation unit 205 may, for example, obtain information on the available power and the acceptable power for each time period from a computer on the network N1 that manages the power grid (grid) and create the grid power schedule. The grid power schedule may include a first table exemplifying the power that the power grid (grid) can supply for each time period and a second table exemplifying the power that the power grid (grid) can accept for each time period.

[0037] The V2G communication control unit 104 notifies the protocol determination unit 105 of the protocol negotiation result with the V2G communication control unit 204 (M10). Also, the V2G communication control unit 104 notifies the authentication method determination unit 106 of the authentication method and the like, which is the negotiation result of the authentication method with the V2G communication control unit 204 (M11). Furthermore, the V2G communication control unit 104 transmits the grid power schedule received from the V2G communication control unit 204 to the grid power schedule acquisition unit 107 (M12).

[0038] The protocol determination unit 105 notifies the power schedule calculation unit 101 of the protocol negotiation result. Also, the authentication method determination unit 106 notifies the power schedule calculation unit 101 of the negotiation result of the authentication method (M13). Furthermore, the grid power schedule acquisition unit 107 notifies the power schedule calculation unit 101 of the grid power schedule (M14).

[0039] The battery information acquisition unit 108 detects the current state of the battery, such as the state of charge (SOC), state of health (SOH), etc. from the battery 19 (see FIG. 3). SOC is, for example, the ratio of the current charge amount to the charge amount at full charge. SOH is, for example, the ratio of the current full charge capacity to the initial (at factory shipment, etc.) full charge capacity. The battery information acquisition unit 108 sequentially or periodically notifies the detected SOC, SOH, etc. to the power schedule calculation unit 101 (M15). However, the battery information acquisition unit 108 may notify the power schedule calculation unit 101 of the SOC, SOH, etc. irregularly at the timing when it recognizes that the detected SOC, SOH, etc. have changed by more than a certain reference value.

[0040] The vehicle departure time input unit 109 acquires the vehicle departure time input by the user via the user interface by the display unit 14 and the operation unit 15 (see FIG. 3) mounted on the vehicle. The vehicle departure time input unit 109 notifies the acquired vehicle departure time to the power schedule calculation unit 101 (M16).

[0041] The power usage classification 110 is a register or the like in which information such as a time period for preferentially performing charging and a time period for preferentially performing discharging is set. The charge / discharge control device 10 may set information such as performing charging at night when the electricity rate is low according to the user's needs as the power usage classification information in a register, a non-volatile area of the memory 12, etc. The power schedule calculation unit 101 reads the classification of power usage from the power usage classification 110 (M17). The classification includes a time period and a designation for preferentially performing discharging or a designation for preferentially performing discharging, etc. The classification is , for example, input from the user via a user interface by the display unit 14 and the operation unit 15 and set in a register, a non-volatile area of the memory 12, etc.

[0042] The power schedule calculation unit 101 determines the earliest time among the SECC certificate expiration date, the Vehicle certificate expiration date , the Contract certificate expiration date, the lifetime of the TLS session, and the vehicle departure time. This earliest time to arrive is hereinafter referred to as the deadline time t1. Then, the power schedule calculation unit 101 calculates a charging schedule from the power grid to the battery 19 or a discharging schedule from the battery 19 to the power grid via the charging facility 2 with the deadline time t1 as the limit.

[0043] For example, the power schedule calculation unit 101 sets a charging schedule until the effective deadline time t1 within the range of the available power allowed by the grid power schedule, taking into account the power cost according to the SOC of the battery 19. Also, the power schedule calculation unit 101 sets a discharging schedule until the expiration date within the range of the acceptable power allowed by the grid power schedule, taking into account the selling electricity price according to the SOC of the battery 19. Note that the charging schedule and the discharging schedule are collectively referred to as the vehicle power schedule. Then, the power schedule calculation unit 101 notifies the charging facility 2 of the vehicle power schedule set via the V2G communication control unit 104 (M19, M20).

[0044] FIG. 3 is a diagram illustrating the hardware configuration of the vehicle 1 and the charging facility 2. A charge / discharge control device 10 of the vehicle 1 and a charging facility 2 that charges a battery 19 mounted on the vehicle 1 constitute a charging system. The vehicle 1 has a charge / discharge control device 10 and a battery 19 whose charge and discharge are controlled by the charge / discharge control device 10.

[0045] The charge / discharge control device 10 includes a CPU 11, a memory 12, and external devices connected to an external interface (I / F), and executes information processing by a program. Examples of the external devices include an external storage unit 13, a display unit 14, an operation unit 15, an external communication unit 16A, and a charging communication unit 16B. The CPU 11 and the memory 12 can be collectively referred to as a control unit. The control unit is also called an Electronic Control Unit (ECU). The control unit is an example of a controller. Example.

[0046] The CPU 11 executes a computer program expanded executable in the memory 12 and provides the functions of the charge / discharge control device 10. The CPU 11 is also called a processor. The CPU 11 is not limited to a single processor. The CPU 11 may be one in which a plurality of processors of the same type operate in parallel. Further, the CPU 11 may include one or more dedicated processors suitable for operations according to processing targets such as a GPU (Graphics Processing Unit) and a DSP (Digital Signal Processor). Further, the CPU 11 may execute processing in cooperation with other processors of the same type, a GPU, a DSP, etc.

[0047] The memory 12 stores a computer program executed by the CPU 11, data processed by the CPU 11, and the like. The memory 12 is a Dynamic Random Access Memory (DRAM), a Static Random Access Memory (SRAM), a Read Only Memory (ROM), or the like. ROM is an example of the non-volatile area of the memory 12. The external storage unit 13 is used, for example, as a storage area to assist the memory 12, and stores a computer program executed by the CPU 11, data processed by the CPU 11, and the like. The external storage unit 13 is a hard disk drive, a Solid State Drive (SSD), or the like. The external storage unit 13 is also an example of a non-volatile area. can be achieved.

[0048] The display unit 14 is, for example, a liquid crystal display, an electroluminescence panel, or the like. The operation unit 15 is, for example, a keyboard, a pointing device, or the like. In this embodiment a touch panel having a touch sensor as a pointing device is exemplified. The display unit 14 and the operation unit 15 act as a user interface available to the user.

[0049] The external communication unit 16A exchanges data with other devices (such as the OEM server 6 in FIG. 1) on a public network such as the network N1 (see FIG. 1). For example, the CPU 11 communicates with a computer of a business operator on the public network through the external communication unit 16A. The external communication unit 16A may be a wireless communication device that accesses a mobile phone network. Further, the external communication unit 16A may be a communication device that accesses a wireless LAN (Local Area Network). The external communication unit 16A is called a TCU (Telematics Control Unit) and may execute communication called telematics via the network N1 as well.

[0050] The charging communication unit 16B transmits and receives signals to and from the charging communication unit 26B. That is, the charging communication unit 16B communicates with the charging facility 2 based on, for example, PLC (Power Line Communications) or a communication method similar to PLC. However, the charging communication unit 16B may use CAN (Controller Area Network), wireless LAN, Ethernet, etc. to communicate with the charging communication unit 26B Communication may be performed by means of associated communication or communication procedures based thereon. The charging communication unit 16B may include a CPU, a memory, an input / output interface, a communication interface, etc. therein. In the present embodiment, the charge / discharge control device 10 communicates with the charging facility 2 by means of the external communication unit 16A or the charging communication unit 16B, and executes a charging request, a payment (authentication) process for charging, a discharging request, a payment (authentication) process for discharging, etc.

[0051] The charging facility 2 includes a CPU 21, a memory 22, and external devices connected to an external interface (I / F), and performs information processing by a program. Examples of the external devices include an external storage unit 23, an external communication unit 26A, a charging communication unit 26B, and an EIM reader 2A. Further, the charging facility 2 has a power supply circuit 29. Among the charging facility 2, the configurations other than the EIM reader 2A and the power supply circuit 29 are the same as those of the charge / discharge control device 10 of the vehicle 1, and thus the description thereof is omitted.

[0052] The EIM reader 2A is a card reader that reads information in contact or non-contact manner from an IC card such as a credit card, an image reader that reads a QR code (registered trademark), an RFID reader, etc.

[0053] As described above, when the plug 2B of the power supply circuit 29 is connected to the connection part including the power receiving part and the charging communication part 16B of the power circuit in the vehicle 1 that charges the battery 19, the charge and discharge control device 10 and the equipment control device 20 communicate with each other. The charge and discharge control device 10 and the equipment control device 20 communicate with each other through, for example, the charging communication parts 16B and 26B, and execute TLS authentication and V2G communication. That is, the charge and discharge control device 10 and the equipment control device 20 authenticate each other through TLS authentication and V2G communication, and perform charging of the battery 19 of the vehicle 1, authentication processing and payment for charging (charging billing), discharging from the battery 19 through the charging equipment 2, authentication processing and payment for discharging (settlement for selling electricity). However, the charge and discharge control device 10 and the equipment control device 20 may communicate with each other through the external communication parts 16A and 26A when the plug 2B of the power supply circuit 29 is connected to the power circuit that charges the battery 19.

[0054] The power supply circuit 29 is connected to a commercial power system (grid) and charges and discharges the battery 19. The power supply circuit 29, for example, converts AC power into DC power and charges the battery 19. However, when the vehicle 1 has a rectifier circuit, a DC-DC (DCDC) converter, etc., the power supply circuit 29 may supply AC power to the vehicle 1. Also, the power supply circuit 29, for example, converts the DC power of the battery 19 into AC power and transmits it to the power system (grid). However, when the vehicle 1 has an AC-DC conversion circuit, etc., the power supply circuit 29 may receive AC power from the vehicle 1 and transmit it to the power system (grid).

[0055] The MO server 5 and the OEM server 6 have the same configuration as the CPU 11, 21, the memory 12, 22, the external storage part 13, 23, the display part 14, the operation part 15, the external communication parts 16A, 26A, etc. The MO server 5 and the OEM server 6 are general computers. Note that the MO server 5 and the OEM server 6 may be a set of multiple computers called a cloud.

[0056] The MO server 5 can be said to be a computer of an operator (MO) that provides a charging service to the vehicle 1 for the user. Note that the charging facility 2 may be managed and operated by an operator called a CPO (Charge Point Operator) in addition to the MO. Also, the OEM server 6 can be said to be a computer of an operator related to the manufacture or sale of the vehicle 1. It can be said to be a computer of an operator related to the manufacture or sale of the vehicle 1.

[0057] (Processing procedure) Figures 4 and 5 are flowcharts illustrating the scheduling process executed by the charge and discharge control device 10. Note that in Figures 4 and 5, the processes are connected by symbols A1 and A2. In this process, the charge and discharge control device 10 determines whether the charging protocol to be executed conforms to ISO15118-20 (S1). Whether the charging protocol conforms to ISO15118-20 is determined, for example, as a result of negotiation in V2G communication. It can be said that, like the determination process in S1, the charge and discharge control device 10 selects the type of expiration information according to the protocol version of the process of power transfer.

[0058] If the charging protocol conforms to ISO15118-20, the charge and discharge control device 10 determines the authentication method (user authentication method) (S2). In the determination of S2, it is determined how to perform user authentication during payment for power transfer. That is, the authentication method can also be said to be the user authentication method for payment. Hereinafter, the determination of S2 is simply referred to as the authentication method. The default specification of the authentication method is stored, for example, in the non-volatile area of the memory 12. However, the charge and discharge control device 10 can receive a specification of the authentication method from the user through a user interface including the display unit 14 and the operation unit 15. Therefore, it can be said that the charge and discharge control device 10 selects the type of expiration information according to the payment method related to the process of power transfer.

[0059] Here, the authentication method (user authentication method) is, for example, PnC or EIM. Note that the authentication method during charging from the charging facility 2 to the battery 19 is a method for charging the user. On the other hand, the authentication method during discharging from the battery 19 to the commercial power grid via the charging facility 2 is a method for settling the selling electricity fee from the user.

[0060] When the authentication method is PnC, the charge and discharge control device 10 sets the latest one among the vehicle departure time, TLS session lifetime expiration, Vehicle certificate expiration, SECC certificate expiration, and Contract certificate expiration as the expiration time t1 (S3). The vehicle departure time, TLS session lifetime expiration, Vehicle certificate expiration, SECC certificate expiration, and Contract certificate expiration are examples of expiration information. Also, since the expiration information includes the vehicle departure time, it can be said that the power schedule is regulated by the vehicle departure time.

[0061] On the other hand, when the authentication method is EIM, the charge and discharge control device 10 sets the latest one among the vehicle departure time, TLS session lifetime expiration, Vehicle certificate expiration, and SECC certificate expiration as the expiration time t1 (S4). When the payment method is EIM, the Contract certificate is not used, so it is not necessary to confirm its expiration. Also, in the determination of S1, when the charging protocol does not conform to ISO15118-20, the charge and discharge control device 10 proceeds with the control to the process connected by the symbol A1 in FIG. 5. In FIG. 5, the charge and discharge control device 10 determines whether it has acquired the SECC certificate from the charging facility 2 (S5). When the charge and discharge control device 10 has acquired the SECC certificate from the charging facility 2, it determines the authentication method (user authentication method) (S6). The determination of S6 is the same as S2 in FIG. 4.

[0062]

[0063] ​In the determination of S6, when the authentication method is PnC, the charge / discharge control device 10 sets the latest one among the vehicle departure time, TLS session lifetime expiration, SECC certificate expiration, and Contract certificate expiration as the expiration time t1 (S7). On the other hand, when the payment method is EIM, the charge / discharge control device 10 sets the latest one among the vehicle departure time, TLS session lifetime expiration, and SECC certificate expiration as the expiration time t1 (S8). That is, when the charging protocol does not conform to ISO15118-20, the Vehicle certificate is not used, so it is not necessary to confirm its expiration date.

[0064] Also, in the determination of S5, when the charge / discharge control device 10 has not acquired the SECC certificate from the charging facility 2, it sets the vehicle departure time as the expiration time t1 (S9). This is because when the charge / discharge control device 10 cannot acquire the SECC certificate from the charging facility 2, it cannot establish a TLS session.

[0065] After the processes of S7 to S9, the charge / discharge control device 10 advances the control to the process of FIG. 4 connected by symbol A2. That is, after any of the processes of S3 and S4 in FIG. 4 or S7 to S9 in FIG. 5, the charge / discharge control device 10 executes a power schedule calculation process (S10). In the power schedule calculation process, a charging schedule or a discharging schedule for the vehicle 1 is set. In this embodiment, the charging schedule or the discharging schedule is collectively referred to as the power schedule. Also, in this embodiment, the power schedule calculated in the vehicle 1 is also referred to as the vehicle power schedule.

[0066] FIG. 6 is a flowchart illustrating the details of the power schedule calculation process (S10 in FIG. 4). In this process, after calculating the expiration time t1 by the method of FIGS. 4 and 5, the charge / discharge control device 10 calculates the charging schedule (S13). After that, it calculates the discharging schedule. (S15)

[0067] FIG. 7 is a flowchart illustrating the process of charging schedule calculation processing (S13 in FIG. 6). In this process, the charge-discharge control device 10 acquires the charging power amount J1 up to the target state of charge (S131). In the process of S131, the charge-discharge control device 10 calculates, for example, the charging power amount J1 required until the state of charge reaches the charge amount Q1 at the target state of charge from the charge amount Q1 at the target state of charge and the charge amount Q0 at the current state of charge. Then, the charge-discharge control device 10 allocates the charging power in each time period as follows so that the total power amount becomes the charging power amount J1 according to the grid power schedule.

[0068] That is, the charge-discharge control device 10 obtains the length Cx of the period during which the available power from the power system becomes a certain upper limit value (Px) with the current time being Tx in the grid power schedule acquired from the charging facility 2 (see FIG. 2) (S132). Then, the charge-discharge control device 10 sets a charging schedule with power possible within the range up to the charging power Px in the section (Tx, Tx + Cx).

[0069] More specifically, the charge-discharge control device 10 determines whether the time Tx + Cx is before the deadline time t1 (that is, less than t1) (S133). If the time Tx + Cx is less than the deadline time t1, the charge-discharge control device 10 sets the charging schedule for the section (Tx, Tx + Cx) (S134). Therefore, in this section, the maximum power amount of Px * Cx (where * is multiplication ) is supplied to the vehicle 1. On the other hand, if the time Tx + Cx is after the deadline time t1 (that is, t1 or more), the charge-discharge control device 10 sets the charging schedule for the section (Tx, Tx + t1) (S135).

[0070] Next, the charge-discharge control device 10 determines whether the total amount of power supplied to the vehicle 1 has reached the charging power amount J1, or whether the time Tx + Cx is greater than or equal to the deadline time t1 (S136). If the total amount of power supplied has not reached the charging power amount J1 and the time Tx + Cx is less than the deadline time t1 (NO in S136), the charge-discharge control device 10 shifts the section in the grid power schedule by one section. That is, the charge-discharge control device 10 sets Tx = Tx + Cx, shifts the time to the end of the section (Tx, Tx + Cx) (S137), and returns the process to S132.

[0071] On the other hand, if the total amount of power supplied has reached the charging power amount J1 or the time Tx + Cx is greater than or equal to the deadline time t1 (YES in S136), the charge period adjustment process shown in FIG. 8 is executed (S138).

[0072] The charge period adjustment process is a process of inserting a PAUSE section into the created charge schedule. The PAUSE section is a pause period during which power transfer defined in ISO15118 is suspended. During the PAUSE section, the power circuit 29 of the charging facility 2 stops, and power transfer between the charging facility 2 and the power grid is stopped. Therefore, the charging facility 2 also stops power transfer with the vehicle 1. After the pause period, power transfer between the vehicle 1 and the power grid via the charging facility 2 resumes. FIG. 8 is a flowchart illustrating the details of the charge period adjustment process (S138 in FIG. 7). In this process, the charge-discharge control device 10 identifies the section Ct with the highest electricity rate from among all sections of the current charge schedule (S1381). Then, the charge-discharge control device 10 determines whether there is a subsequent section Cn with an electricity rate lower than that of the section Ct after all sections of the current charge schedule and until the deadline time t1 (S1382).

[0073]

[0074] ​When the determination in S1382 is YES, the charge / discharge control device 10 sets at least a part of the section Ct as the PAUSE section Cp, and updates the charging schedule so as to charge in the subsequent section Cn instead of charging in the PAUSE section Cp (S1383). Then, the charge / discharge control device 10 identifies the section Ct with the next highest electricity charge in the updated charging schedule (S1384). Here, identifying the section Ct with the next highest electricity charge means newly setting the section with the next highest electricity charge after the section Ct identified in S1381 as the section Ct. Then, the charge / discharge control device 10 returns the process to S1382.

[0075] By repeating the processes from S1382 to S1384, the charge / discharge control device 10 sets as many PAUSE sections as possible for the section Ct with the highest electricity charge in the initial charging schedule and the subsequently updated charging schedules. Then, the charge / discharge control device 10 creates a schedule that can charge in the section with the cheapest electricity charge as much as possible until the deadline time t1, instead of at least a part of the section Ct with the highest electricity charge. When the determination in S1392 is NO, the charge / discharge control device 10 ends the process and returns to the process of FIG. 7.

[0076] FIG. 9 is a diagram illustrating a charging schedule that is the target of the charging period adjustment process. The upper graph in FIG. 9 illustrates the charging schedule before the execution of the charging period adjustment process based on the power values at each time. In the upper graph in FIG. 9, the horizontal axis represents time, and the vertical axis represents the charging power. Then, the lower graph in FIG. 9 illustrates the electricity charge. In the example of FIG. 9, in the section D0, the power E0 is set, then in the section D1, the power E1 is set, and then in the section D2, the power E2 is set. Therefore, the entire schedule period ranges from the section D0 to D2.

[0077] Also, in the lower graph of FIG. 9, the horizontal axis represents time, and the vertical axis represents the electricity rate at each time. In the interval from time TX1 to TX2, the electricity rate is in the high-cost interval Ct which is relatively high. And a part of interval D1 and the entire interval D2 overlap with the high-cost interval Ct.

[0078] FIG. 10 is a diagram illustrating the charging schedule after the charging period adjustment process. The definitions of the vertical axis and the horizontal axis of each graph in FIG. 10 are the same as those in FIG. 9. In FIG. 10, interval D1 is divided into intervals D1-1 and D1-2. Interval D1-2 is an interval that overlaps with the high-cost interval. And PAUSE is set for D1-2, and instead of interval D1-2, a charging schedule is set in interval DN1-2. In FIG. 10, interval DN1-2 has a schedule of being charged with the same power E1 as interval D1 before the charging period adjustment process. However, interval DN1-2 does not necessarily need to be charged with the same power E1 as interval D1 before the charging period adjustment process. In short, it is sufficient if the charging is completed by the deadline time t1.

[0079] Also, interval D2 is divided into interval D2-1 and interval D2-2. And instead of interval D2-2, a charging schedule is set in interval DN2-2. However, in this example, the end of interval DN2-2 reaches the deadline time t1. For this reason, the charge-discharge control device 10 can no longer set a PAUSE interval in the charging schedule.

[0080] Therefore, the charge-discharge control device 10 divides interval D2 into interval D2-2 corresponding to interval DN2-2 and the remaining interval D2-1. And the charge-discharge control device 10 sets PAUSE for interval D2-2 and sets a charging schedule for charging in interval DN2-2 instead of interval D2-2. In this way, the charge-discharge control device 10 sets PAUSE in the interval with the highest electricity rate as much as possible within the range where the charging schedule does not reach the deadline time t1. It can be set and revised to a charging schedule that performs charging in a low-cost period. Therefore, the entire schedule period ranges from section D0 to the deadline time t1.

[0081] FIG. 11 is a flowchart illustrating the process of the discharge schedule calculation process (S15 in FIG. 6). The discharge schedule calculation process is set as a PAUSE section in the charging period adjustment process For the section Cp thus set, the discharge schedule is set. That is, the charge / discharge control device 10 processes the first PAUSE section in the charging schedule set in the charging schedule calculation process Select it as the target section Cp (S151).

[0082] Then, the charge / discharge control device 10 is a section set as a PAUSE section in the charging period adjustment process It is determined whether at least a part of the section Cd of Cp is a dischargeable section where the acceptable power in the grid power schedule is greater than 0 (S152). In the case of YES in S512 ES, the charge / discharge control device 10 may further determine whether settlement for buying and selling can be received in the section Cd (S153). This is because there are few merits in discharging when settlement for buying and selling cannot be received. However, the determination in S153 is not essential, and the charge / discharge control device 10 may omit the determination in S153. If the determination in S152 or S153 is NO, the charge / discharge control device 10 proceeds to S157.

[0083] And when at least YES in the determination of S512, the charge / discharge control device 10 calculates the dischargeable power Pd of the vehicle in the section Cd (S154). Further, the charge / discharge control device 10 determines whether the electric energy Cd*Pd can be added to any of the charging sections Cx set in FIGS. 7 and 8 (S155). If the determination in S155 is NO, the charge / discharge control device 10 proceeds to S157.

[0084] If the determination in S155 is YES, the charge-discharge control device 10 adds the electric energy amount Cd*Pd to the charging interval Cx and sets the discharge schedule for the interval Cp (S156). This is because, at the stage when the EV charge-discharge schedule is completed, the electric energy amount Cd*Pd for discharge is subtracted from the charging electric energy amount J1 calculated in FIG. 7. Therefore, the purpose is to supplement the electric energy amount for this discharge during charging.

[0085] Furthermore, the charge-discharge control device 10 determines whether there is a next PAUSE interval after the interval Cp and before the deadline time t1 (S157). If such a next PAUSE interval exists (YES in the determination of S157), the next PAUSE interval is set as the interval Cp to be processed ( S159), and the process returns to S152. In this way, the charge-discharge control device 10 can set the discharge schedule for the PAUSE intervals existing before the deadline time t1 in the same manner if possible as the discharge intervals.

[0086] On the other hand, if there is no next PAUSE interval before the deadline time t1 (NO in the determination of S157 ), the charge-discharge control device 10 executes the discharge period adjustment process (S158). The discharge period adjustment process is a process of inserting a PAUSE interval into the created discharge schedule.

[0087] FIG. 12 is a flowchart illustrating the details of the discharge period adjustment process (S158 in FIG. 11). In this process, the charge-discharge control device 10 identifies the interval Ct with the lowest selling electricity price among all intervals of the current discharge schedule (S1581). Then, the charge-discharge control device 10 determines whether there is a subsequent interval Cn with a higher selling electricity price than the interval Ct after all intervals of the current discharge schedule and before the deadline time t1 (S1582).

[0088] ​If the determination in S1582 is YES, the charge / discharge control device 10 updates the discharge schedule so that at least a part of the section Ct is set as a PAUSE section Cp and discharge is performed in the section Cn instead of the PAUSE section Cp (S1583). Then, the charge / discharge control device 10 identifies the section Ct with the next lowest power selling price from the updated discharge schedule (S1584). Here, identifying the next lowest power selling price Ct means that the section with the next lowest power selling price after the section Ct identified in S1581 is set as the new section Ct. Then, the charge / discharge control device 10 returns the process to S1582.

[0089] By repeating the processes from S1582 to S1584, the charge / discharge control device 10 sets PAUSE as much as possible for the section Ct where the power selling price is the lowest in the initial discharge schedule and the updated discharge schedule. Instead of the high-cost section Ct, a discharge schedule is created that allows discharge to occur in a section with the highest possible power selling price until the deadline time t1. If the determination in S1592 is NO, the charge / discharge control device 10 ends the process and returns to the process in Fig. 11. Note that the processing example of the discharge period adjustment process differs from the processing example of the charge period adjustment process illustrated in Figs. 9 and 10 in that the low-cost section Ct, with a low power selling price, is used instead of the high-cost section Ct. However, since the processing method is the same, the processing example will be omitted.

[0090] (Example of calculated vehicle power schedule) Fig. 13 shows an example of a vehicle power schedule calculated by the charge / discharge control device 10. In Fig. 13, the horizontal axis represents time and the vertical axis represents power. Sections where power has a positive value represent charging sections, i.e., power supply from the power grid to the battery 19 via the charging facility 2. Sections where power has a negative value represent discharging sections, i.e., power supply (power sale) from the battery 19 to the power grid via the charging facility 2.

[0091] E[k] (k is an integer) in FIG. 13 exemplifies the value of electric power. The value of electric power E[k] is the result calculated within the range of the available power and the acceptable power of the grid power schedule notified from the charging facility 2. Also, D[k] (k is an integer) in FIG. 13 exemplifies the length of the interval (time). In the example of FIG. 13, first, a PAUSE interval (electric power E[0] = 0, interval length D[0]) is set, and then, electric power E[1], interval length D[1], electric power E[2], and interval length D[2] are set. Further, a PAUSE interval (electric power E[3] = 0, interval length D[3]) is set, and then, the power schedule is completed with electric power E[4] and interval length D[4]. In the example of FIG. 12, the positive electric powers E[1] and E[4] are charging powers. Also, the negative electric power E[2] is the discharging power.

[0092] In the example of FIG. 13, first, a PAUSE interval (electric power E[0] = 0, interval length D[0]) is set and then, electric power E[1], interval length D[1], electric power E[2], and interval length D[2] are set. Further, a PAUSE interval (electric power E[3] = 0, interval length D[3]) is set, and then, the power schedule is completed with electric power E[4] and interval length D[4]. In the example of FIG. 12, the positive electric powers E[1] and E[4] are charging powers. Also, the negative electric power E[2] is the discharging power.

[0093] In this example, the end of the vehicle power schedule calculated by the vehicle 1 is set as the end point of the TLS session lifetime. Also, in FIG. 13, the grid-side schedule end point exemplifies the end point of the grid power schedule indicating the available power received by the vehicle 1 from the charging facility 2 and the acceptable power. In any case, in the example of FIG. 13, the vehicle power schedule ends earlier than the vehicle departure time, the SECC certificate expiration date, the Vehicle certificate expiration date, the Contract certificate expiration date, and the end point of the TLS session lifetime.

[0094] (Effect of the Embodiment) As described above, the charge / discharge control device 10 acquires expiration information indicating an expiration date related to authentication during the process of transferring power between the battery 19 mounted on the vehicle 1 and the charging facility 2 (from the above S3, S4, and S7 to S9). Then, the charge / discharge control device 10 creates a power schedule for which the process is completed by the expiration date. Therefore, the charge / discharge control device 10 can suppress the execution of processes related to charge / discharge beyond the expiration date related to authentication, and can suppress the execution of processes related to charge / discharge during a period when the user authentication or the authentication of the charging facility 2 is not guaranteed. As a result, the charge / discharge control device 10 can improve the security deficiencies associated with the execution of the power schedule.

[0095] Here, the expiration information includes at least one of the TLS session lifetime, the Contract certificate expiration date, the Vehicle certificate expiration date, and the SECC certificate expiration date. Therefore, the charge / discharge control device 10 can create a power schedule for executing the process within the expiration date related to authentication during the process of transferring power between the battery 19 and the charging facility 2.

[0096] Also, the above power schedule is regulated by the departure time of the vehicle 1. For this reason, the charge / discharge control device 10 can create a power schedule for charge / discharge on the vehicle 1 side according to the grid power schedule from the charging facility 2 within the range where the vehicle 1 is parked.

[0097] Furthermore, the charge / discharge control device 10 selects the type of expiration information according to the protocol version of the process of transferring the above power. Therefore, the charge / discharge control device 10 can create a power schedule for charge / discharge on the vehicle side corresponding to the expiration date compliant with the protocol version of a standard specification such as ISO15118.

[0098] Furthermore, the charge / discharge control device 10 selects expiration information of a type corresponding to a method of paying (i.e., authenticating) costs related to the process of power transfer. Therefore, the charge / discharge control device 10 can create a power schedule for vehicle-side charge / discharge corresponding to an expiration date compliant with a payment method of a standard specification such as ISO15118.

[0099] During the power schedule, the charge / discharge control device 10 can perform charge / discharge during a period advantageous in terms of the electricity charge or the selling electricity price between the operator providing the commercial power grid called the grid and the operator providing the charging facility 2 by providing a PAUSE section. Note that when performing charge / discharge after the PAUSE section, the charge / discharge control device 10 can also eliminate the need for user authentication and authentication of the charging facility 2 with the charging facility 2. For example, it is assumed to prevent a case where a user operation is required again at the time of session resume when authentication via a user operation in the EIM is necessary. Also, at the time of session resume, instead of performing user authentication and authentication of the charging facility 2, authentication may be associated with the TLS session by TLS binding. By doing so, it is possible to prevent a case where a user operation is required again at the time of session resume.

[0100]

[0101] (Computer-readable recording medium) A program for causing a computer or other machine or device (hereinafter referred to as a computer or the like) to realize any of the above functions can be recorded on a computer-readable recording medium. Then, by causing the computer or the like to read and execute the program of this recording medium, the function can be provided.

[0102] ​Here, a computer-readable recording medium refers to a recording medium that accumulates information such as data and programs by electrical, magnetic, optical, mechanical, or chemical actions and can be read by a computer or the like. Among such recording media, removable ones from a computer or the like include, for example, flexible disks, magneto-optical disks, CD-ROMs, CD-R / Ws, DVDs, Blu-ray disks, memory cards such as flash memories, and the like. Also, recording media fixed to a computer or the like include hard disks, ROMs (read-only memories), and the like. Furthermore, an SSD (Solid State Drive) can be used as both a removable recording medium from a computer or the like and a recording medium fixed to a computer or the like. It can be used as both a removable recording medium from a computer or the like and a recording medium fixed to a computer or the like.

Explanation of Signs

[0103] 1 Vehicle 2 Charging equipment 5 MO server 6 OEM server 10 Charge and discharge control device 11, 21 CPU 12, 22 Memory 13, 23 External storage unit 14 Display unit 15 Operation unit 16A, 26A External communication unit 16B, 26B Charging communication unit 19 Battery 29 Power supply circuit 2A EIM reader 2B Plug 101 Power schedule calculation unit 102 Certificate expiration date acquisition unit 103 TLS communication control unit 104 V2G communication control unit 111 Charge and discharge control unit 112 Certificate storage unit

Claims

1. An in-vehicle device comprising a controller that obtains expiration date information indicating an expiration date related to authentication during a process of exchanging power between a battery mounted on a vehicle and a charging facility, and creates a power schedule for completing the process by the expiration date.

2. The in-vehicle device according to claim 1, wherein the expiration date information includes at least one of a TLS session lifetime, a Contract certificate expiration date, a Vehicle certificate expiration date, and a SECC certificate expiration date.

3. The in-vehicle device according to claim 1, wherein the power schedule is regulated by a departure time of the vehicle.

4. The in-vehicle device according to claim 1, wherein the controller selects the type of expiration date information according to a protocol version of the process of exchanging the power.

5. The in-vehicle device according to claim 1, wherein the controller selects the type of expiration date information according to a payment method for a fee related to the process of exchanging the power.

6. The in-vehicle device according to claim 1, wherein the power schedule includes a rest period during which the process of exchanging the power is not performed.

7. A program for causing a computer to obtain expiration date information indicating an expiration date related to authentication during a process of exchanging power between a battery mounted on a vehicle and a charging facility, and create a power schedule for completing the process by the expiration date. ​ ​ ​

Images