Vehicle, control method, control program, and digital key system

Abstract

To provide a vehicle which can be locked by a user even when there is a device storing information on a digital key in the vehicle.SOLUTION: The vehicle is capable of communicating with a plurality of devices that store information about digital keys. The vehicle comprises a locking means. In the vehicle, when there is a locking request for the car through communication with the devices, in a case where the devices that performed the communication that triggered the locking request are outside the car (step S63: YES) and other devices that store information relating to the digital key of the car are present in the car (step S62: YES), the locking means confirms information of the other devices (step S61), and determines whether or not to lock the car based on the confirmed information of the other devices (step S64).SELECTED DRAWING: Figure 10

Description

[Technical Field]

[0001] The present invention relates to a vehicle, a control method, a control program, and a digital key system. [Background technology]

[0002] Patent Document 1 describes a digital key system. The digital key system includes a vehicle and multiple devices. In the digital key system, information about a digital key for controlling the vehicle is stored in the multiple devices, and the digital key can be registered in the multiple devices. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2024-1720 Summary of the Invention [Problem to be solved by the invention]

[0004] Some digital key systems prevent the vehicle from being locked if a device storing digital key information is present inside the vehicle, preventing the vehicle from being locked out. However, in a digital key system that allows the vehicle to be operated from multiple devices, it is inconvenient that the vehicle cannot be locked at all times unless all devices storing digital key information are outside the vehicle. [Means for solving the problem]

[0005] A vehicle that solves the above problem is a vehicle that can communicate with multiple devices that store information about a digital key. The vehicle is equipped with a locking unit. When a vehicle locking request is made through communication with a device, if the device that initiated the locking request is outside the vehicle and there is another device inside the vehicle that stores information about the vehicle's digital key, the locking unit checks the information from the other device and determines whether to lock the vehicle based on the information from the other device.

[0006] A control method for solving the above problem is a control method for controlling locking in a vehicle that has a locking means and is capable of communicating with multiple devices that store information about a digital key. This control method includes a step of, when a locking request for the vehicle is made through communication with one of the devices, having the locking means check information about the other device if the device that initiated the locking request is outside the vehicle and there is another device inside the vehicle that stores information about the digital key for the vehicle. This control method also includes a step of having the locking means determine whether to lock the vehicle based on the checked information about the other device.

[0007] A control program for solving the above problem is a control program executed by a vehicle equipped with a locking means and capable of communicating with multiple devices that store information about a digital key. When a request to lock the vehicle is made through communication with a device, if the device that initiated the locking request is outside the vehicle and there is another device inside the vehicle that stores information about the vehicle's digital key, the control program causes the locking means to check information about the other device. This control method causes the locking means to determine whether to lock the vehicle based on the checked information about the other device.

[0008] The digital key system for solving the above problem includes multiple devices that store information about the digital key and a vehicle that can communicate with the multiple devices. When a vehicle lock request is made through communication with a device, if the device that initiated the lock request is outside the vehicle and there is another device inside the vehicle that stores information about the vehicle's digital key, the digital key system checks the information from the other device and determines whether to lock the vehicle based on the information from the other device. [Effects of the Invention]

[0009] According to the above-described vehicle, control method, control program, and digital key system, a user can lock a vehicle even if there is a device inside the vehicle that stores information about a digital key. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 1 is a schematic diagram showing a digital key system according to one embodiment. [Figure 2] FIG. 2 is a schematic diagram showing owner key information in the digital key system of FIG. [Figure 3] FIG. 3 is a schematic diagram showing shared key information in the digital key system of FIG. [Figure 4] FIG. 4 is a schematic diagram showing data in a database in the digital key system of FIG. [Figure 5] FIG. 5 is an explanatory diagram showing a series of processes performed by the digital key system of FIG. 1 when an owner key is registered. [Figure 6] FIG. 6 is an explanatory diagram showing a series of processes performed by the digital key system of FIG. 1 when a friend key is registered. [Figure 7] FIG. 7 is an explanatory diagram showing a series of processes performed by the digital key system of FIG. 1 when a non-friend key is registered. [Figure 8] FIG. 8 is a schematic diagram showing a manner in which a vehicle is requested to be locked through communication with a device in the digital key system of FIG. [Figure 9] FIG. 9 is a schematic diagram showing a state in which the device in the digital key system of FIG. 1 is removed from the vehicle. [Figure 10] FIG. 10 is a flowchart showing a series of processes executed when the vehicle control device locks the vehicle in the digital key system of FIG. [Figure 11] FIG. 11 is a schematic diagram showing a combination of devices inside and outside the vehicle in the digital key system of FIG. 1 in a first example. [Figure 12] FIG. 12 is a schematic diagram showing a combination of devices inside and outside the vehicle in the digital key system of FIG. 1 in a second example. [Figure 13] FIG. 13 is a schematic diagram showing a combination of devices inside and outside the vehicle in the digital key system of FIG. 1 in a third example. [Figure 14] FIG. 14 is an explanatory diagram showing a series of processes performed by the digital key system of FIG. 1 when a specific device is designated. [Figure 15] FIG. 15 is a schematic diagram showing a state in which the vehicle management device starts the engine in the digital key system of FIG. [Figure 16] FIG. 16 is a flowchart showing a series of processes executed when the vehicle control device starts the engine in the digital key system of FIG. DETAILED DESCRIPTION OF THE INVENTION

[0011] An embodiment of a digital key system will be described below with reference to FIGS. <Outline of Digital Key System 10> As shown in FIG. 1, a digital key system 10 manages multiple digital keys that can be used for a vehicle 20. The Car Connectivity Consortium (CCC) standard exists for digital keys. The digital key-related aspects of this embodiment comply with the CCC. The digital key system 10 includes a vehicle 20, multiple devices 30, a device server 60, and a management server 70.

[0012] The vehicle 20 has, as communication modules, a wireless communication device 21, an HMI 22, a BLE module 23, a UWB module 24, and an NFC module 25. The vehicle 20 also has a vehicle management device 26, a locking mechanism 29, and an engine 38. HMI stands for Human Machine Interface. BLE stands for Bluetooth Low Energy. UWB stands for Ultra Wide Band. NFC stands for Near Field Communication.

[0013] The wireless communication device 21 communicates with the management server 70 via a wireless communication network. The HMI 22 includes an input device that accepts operations by the user of the vehicle 20 and a presentation device that presents information to the user using images, audio, etc. The presentation device is, for example, a monitor and a speaker.

[0014] The BLE module 23 performs short-range communication with the device 30 using BLE communication. The UWB module 24 communicates with the device 30 using UWB communication, which is communication using UWB. The UWB module 24 measures the distance between the device 30 and the vehicle 20. The NFC module 25 performs short-range communication with the device 30 using NFC communication.

[0015] The locking mechanism 29 is a mechanism that locks and unlocks the vehicle 20. The locking mechanism 29 is installed in the doors, trunk, back door, etc. of the vehicle 20, for example. The vehicle management device 26 is mounted on the vehicle 20. The vehicle management device 26 manages the digital key of the vehicle 20. The vehicle management device 26 is, for example, a digital key ECU. The vehicle management device 26 has an execution device 27 and a storage device 28.

[0016] The storage device 28 stores a vehicle program PV, authentication information AT, a control program PC, and device information DD. The vehicle program PV is executed by the execution device 27, causing the execution device 27 to store and delete authentication information AT. The authentication information AT is information for authenticating the digital key so that the vehicle 20 can be controlled using the digital key when it is used. The authentication information AT is provided for each digital key to be authenticated. The execution device 27 is a CPU. The execution device 27 executes the vehicle program PV to perform processes related to the storage and deletion of the authentication information AT. The authentication information AT is information related to the digital key.

[0017] Note that authenticating a digital key means enabling the vehicle 20 to be controlled by the digital key. For example, when the vehicle management device 26 authenticates the digital key, the vehicle management device 26 enables the vehicle 20 to be unlocked. Also, for example, when the vehicle management device 26 authenticates the digital key, the vehicle management device 26 enables the vehicle 20 to be started.

[0018] The vehicle management device 26 controls the locking mechanism 29 in response to the digital key, thereby realizing locking and unlocking of the vehicle 20 using the digital key. In this way, the vehicle management device 26 is a locking means. Furthermore, the vehicle management device 26 controls the engine 38 in response to the digital key, thereby realizing control of the engine 38 using the digital key.

[0019] The control program PC, when executed by the execution device 27, causes the execution device 27 to control the locking mechanism 29. In addition, the control program PC, when executed by the execution device 27, causes the execution device 27 to control the engine 38. The manner in which the vehicle management device 26 controls the locking mechanism 29 and the engine 38 will be described later.

[0020] The device information DD is information that indicates a specific device 30 among the devices 30. The device information DD will be described later. The device 30 is a mobile information terminal such as a smartphone, and includes a wireless communication device 31, an HMI 32, a BLE module 33, a UWB module 34, an NFC module 35, an execution device 36, and a storage device 37.

[0021] The wireless communication device 31 communicates with the device server 60 via a wireless communication line. The HMI 32 includes an input device that accepts operations by the user of the device 30, and a presentation device that presents information to the user using images, audio, etc. The presentation device is, for example, a monitor and a speaker.

[0022] The BLE module 33 performs short-range communication with the vehicle 20 by BLE communication. The UWB module 34 communicates with the vehicle 20 by UWB communication, which is communication using UWB. The NFC module 35 performs short-range communication with the vehicle 20 by NFC communication.

[0023] The storage device 37 stores a device program PD and key information DK. The device program PD is executed by the execution device 36, causing the execution device 36 to store and delete the key information DK. The key information DK is information indicating a digital key.

[0024] The device program PD includes, for example, a device application and a digital key framework. The device application is an application for storing and deleting key information DK. The digital key framework is a program that provides the functions of pairing devices 30 and sharing digital keys using APIs provided by the OS. The execution unit 36 ​​executes the device program PD to perform processes related to the storage and deletion of key information DK. The key information DK is information related to the digital key.

[0025] The multiple devices 30 include an owner device 40 and multiple shared devices 50. The owner device 40 stores owner key information DKO indicating an owner key KO as key information DK. Only one owner key KO can be registered to one vehicle 20. Therefore, only one owner key KO exists for one vehicle 20. The owner device 40 belongs to the owner of the vehicle 20.

[0026] 2, the owner key information DKO has owner key structure information STO. The owner key structure information STO includes vehicle identification information ST1, in-device key identification information ST2, digital key identification information ST3, and slot identification information ST4. The owner key structure information STO also includes certificate information ST5, device public key information ST6, vehicle public key information ST7, and permission public key information ST8.

[0027] The vehicle identification information ST1 is information for identifying the vehicle 20 for which the digital key is to be set, for example, the ID of the vehicle 20. The intra-device key identification information ST2 is used to manage the digital key within the device 30. The intra-device key identification information ST2 is information that can identify the digital key within the application of the device 30.

[0028] The digital key identification information ST3 is used for managing the digital key in the management server 70. The slot identification information ST4 is information that can identify the digital key locally on the device 30.

[0029] Certificate information ST5 indicates a certificate that certifies the digital key. Device public key information ST6 indicates a device public key PKD, which is the public key of the device 30. Note that the device public key PKD in the owner key information DKO indicates the public key of the owner device 40. Vehicle public key information ST7 indicates a vehicle public key PKV, which is the public key of the vehicle 20. Authorization public key information ST8 indicates an already authorized vehicle public key PKV.

[0030] As shown in Fig. 1, the shared device 50 stores shared key information DKS indicating a shared key KS as key information DK. The shared device 50 is a device 30 separate from the owner device 40. The shared key KS is a digital key that can be registered in multiple numbers for one vehicle 20 when registering the digital key to enable use of the digital key. In other words, multiple shared keys KS can exist for one vehicle 20.

[0031] The multiple shared devices 50 include a friend device 51 and a non-friend device 52. The friend device 51 stores, as the shared key information DKS, friend key information DKF indicating a friend key KF. The non-friend device 52 stores, as the shared key information DKS, non-friend key information DKN indicating a non-friend key KN. In other words, the types of shared keys KS include a friend key KF and a non-friend key KN. The friend key KF is a shared key KS registered based on a registration request D21 directly from the owner device 40, as will be described later. The non-friend key KN is a shared key KS registered based on a registration request D31 from the friend device 51, as will be described later. In other words, the non-friend key KN is a shared key KS that is not a friend key KF, among the shared keys KS.

[0032] Note that when a digital key is registered, the digital key is usable. That is, when a digital key is registered, the vehicle 20 stores authentication information AT, and the device 30 stores key information DK. The authentication information AT is information related to the digital key. That is, when a digital key is registered, the vehicle 20 stores information related to the digital key. The key information DK is information related to the digital key. That is, when a digital key is registered, the device 30 stores information related to the digital key.

[0033] As shown in Fig. 3, the shared key information DKS has shared key structure information STS and an authentication package ATP. The shared key structure information STS includes vehicle identification information ST1, in-device key identification information ST2, digital key identification information ST3, and slot identification information ST4. The shared key structure information STS includes certificate information ST5, vehicle public key information ST7, and permission public key information ST8. In other words, the shared key structure information STS is information obtained by excluding device public key information ST6 from the owner key structure information STO.

[0034] The authentication package ATP includes signature information ATP1, password information ATP2, validity start time information ATP3, expiration date information ATP4, name information ATP5, and device public key information ATP6.

[0035] The signature information ATP1 indicates that the shared device 50 is a legitimate party with which the digital key is shared. For example, in the case of the friend device 51, it indicates a signature by the owner device 40. The owner signature information indicates that the owner device 40 has signed the device public key PKD of the friend device 51, which is indicated by the device public key information ATP6. Also, for example, in the case of the non-friend device 52, it indicates a signature by the friend device 51. The friend signature information indicates that the friend device 51 has signed the device public key PKD of the non-friend device 52, which is indicated by the device public key information ATP6.

[0036] The password information ATP2 indicates the pairing password PAS used to establish a secure channel when pairing the vehicle 20 and the owner device 40. The validity start time information ATP3 indicates the earliest date and time at which the shared key KS can be used. The expiration date information ATP4 indicates the latest date and time at which the shared key KS can be used. The name information ATP5 indicates a name that identifies the shared key KS. For example, it is set as an identifiable name for each shared device 50 by operation from the owner device 40.

[0037] 1, the device server 60 relays communication between the devices 30 and the management server 70. A device server 60 is provided for each type of device 30. That is, the device server 60 with which a first type of device 30 communicates is different from the device server 60 with which a second type of device 30 communicates. For example, the type refers to the model of the device 30, and a device server 60 is provided for each model of the device 30. For example, the type refers to the communication line used by the device 30, and a device server 60 is provided for each communication line used by the device 30.

[0038] Any of the device servers 60 relays communication with the management server 70, so that different types of devices 30 can communicate with the management server 70 via the device servers 60. Note that only one device server 60 is shown in FIG.

[0039] <Administration Server 70> The management server 70 manages the registration of digital keys. The management server 70 is capable of communicating with the vehicle 20 and multiple devices 30. The management server 70 includes an execution device 71, a storage device 72, and a wireless communication device 73. The wireless communication device 73 communicates with the device server 60 via a wireless communication line. The wireless communication device 73 is also capable of wireless communication with the wireless communication device 21 of the vehicle 20.

[0040] The storage device 72 stores a server program PS and a database DB. When the server program PS is executed by the execution device 71, the execution device 71 registers a digital key in the database DB and deletes a digital key from the database DB.

[0041] In the database DB, for each of a plurality of digital keys, the corresponding vehicle 20 and the registered device 30 are associated with each other. In the database DB, data DA is separated for each vehicle 20. When a digital key is registered, the management server 70 stores, in the data DA, information indicating the device 30 that stores key information DK indicating the digital key. The management server 70 manages the digital keys by saving the data DA in the database DB.

[0042] As shown in Figure 4, the data DA for one vehicle 20 includes the type of digital key registered to the vehicle 20, the registered devices 30, and the relationships between the registered devices 30. Hierarchical rankings are determined based on the type of digital key. From top to bottom, the hierarchy is arranged as follows: owner key KO, friend key KF, and non-friend key KN. The higher the hierarchy, the greater the authority set.

[0043] The authority may be, for example, the number of share keys KS that can be requested to be registered, the range of control of the vehicle 20 that can be achieved by authenticating the digital key, etc. The higher the hierarchy, the greater the authority, and therefore, for example, the greater the number of share keys KS that can be requested to be registered. More specifically, for example, the number of friend keys KF that the owner device 40 can request to be registered is greater than the number of non-friend keys KN that the friend device 51 can request to be registered.

[0044] Furthermore, for example, the higher the hierarchy, the greater the authority, and therefore the wider the controllable range of the vehicle 20. The controllable range of the vehicle 20 indicates, for example, the possible controls among starting control of the engine 38 of the vehicle 20, turning on the power of the vehicle 20, and unlocking and locking control of the doors of the vehicle 20. For example, if the controllable range of the vehicle 20 includes the above-mentioned three controls, the controllable range of the vehicle 20 is wider than if the controllable range of the vehicle 20 is only unlocking and locking control of the doors of the vehicle 20. More specifically, the controllable range of the vehicle 20 that the friend key KF can control is the above-mentioned three controls, while the controllable range of the vehicle 20 that the non-friend key KN can control is only unlocking and locking control of the doors of the vehicle 20.

[0045] The following describes a state in which digital keys are registered to seven devices 30 for one vehicle 20. The seven devices 30 are a first device 30A to a seventh device 30G. The digital keys registered in the first device 30A to the seventh device 30G, respectively, are referred to as a first digital key to a seventh digital key.

[0046] In the data DA, the device 30 whose type of digital key is registered as the owner key KO is the first device 30A. That is, the first device 30A is the owner device 40. That is, the first digital key is the owner key KO.

[0047] In the data DA, the devices 30 whose digital key type is registered as a shared key KS are the second device 30B, the third device 30C, the fourth device 30D, the fifth device 30E, the sixth device 30F, and the seventh device 30G. That is, the second device 30B, the third device 30C, the fourth device 30D, the fifth device 30E, the sixth device 30F, and the seventh device 30G are shared devices 50. That is, the second digital key to the seventh digital key are all shared keys KS.

[0048] More specifically, in the data DA, the devices 30 whose digital key type is registered as a friend key KF are the second device 30B and the fifth device 30E. That is, the second device 30B and the fifth device 30E are friend devices 51. In the data DA, the devices 30 whose digital key type is registered as a non-friend key KN are the third device 30C, the fourth device 30D, the sixth device 30F, and the seventh device 30G. That is, the fourth device 30D, the fifth device 30E, the sixth device 30F, and the seventh device 30G are non-friend devices 52.

[0049] In the data DA, the relationship between the second device 30B and the first device 30A is such that the friend key KF is registered in the second device 30B based on a registration request from the first device 30A. In other words, the second digital key is registered based on the first digital key.

[0050] In the data DA, the relationship between the fifth device 30E and the first device 30A is such that the friend key KF is registered in the fifth device 30E based on a registration request from the first device 30A. In other words, the fifth digital key is registered based on the first digital key.

[0051] In the data DA, the relationship between the third device 30C and the second device 30B is such that the non-friend key KN is registered in the third device 30C based on a registration request from the second device 30B. In other words, the third digital key is registered based on the second digital key.

[0052] In the data DA, the relationship between the fourth device 30D and the second device 30B is such that the non-friend key KN is registered in the fourth device 30D based on a registration request from the second device 30B. In other words, the fourth digital key is registered based on the second digital key.

[0053] In the data DA, the relationship between the sixth device 30F and the fifth device 30E is such that the non-friend key KN is registered in the sixth device 30F based on a registration request from the fifth device 30E. In other words, the sixth digital key is registered based on the fifth digital key.

[0054] In the data DA, the relationship between the seventh device 30G and the fifth device 30E is such that the non-friend key KN is registered in the seventh device 30G based on a registration request from the fifth device 30E. In other words, the seventh digital key is registered based on the fifth digital key.

[0055] In this way, the data DA stores the devices 30 registered as digital keys. When the device 30 is registered, information indicating the device 30 that made the request that caused the registration is linked to the device 30. The data DA also includes information indicating which digital key each digital key is registered under.

[0056] <Digital key registration> Next, a series of processes for registering a digital key in the digital key system 10 will be described. The digital key system 10 registers an owner key KO, a friend key KF, and a non-friend key KN as part of digital key registration. The following describes the series of processes that transition from an unregistered state to a registered state for each digital key. In the following description, the processes performed by the execution unit 27 will be described as processes performed by the vehicle 20, the processes performed by the execution unit 36 ​​as processes performed by the device 30, and the processes performed by the execution unit 71 as processes performed by the management server 70.

[0057] <Owner Key KO Registration> 5, the digital key system 10 performs a series of processes to register the owner key KO. Among the devices 30 that do not store the key information DK indicating the owner key KO, the device 30 that is to be designated as the owner device 40 is referred to as the first device 30A.

[0058] In the digital key system 10, when the owner key KO is registered, key information DK indicating the owner key KO is stored in the first device 30A. In the digital key system 10, when the owner key KO is registered, authentication information AT for authenticating the owner key KO is stored in the vehicle 20. As a result, the first device 30A becomes the owner device 40. Note that when registering the owner key KO, it is assumed that an application is installed in the first device 30A.

[0059] When the management server 70 receives a registration request D11 for the owner key KO from the first device 30A or the like, the management server 70 first performs the process of step S11. In step S11, the management server 70 generates a pairing password PAS. Then, the management server 70 transmits information indicating the pairing password PAS to the vehicle 20 and the first device 30A.

[0060] Thereafter, vehicle 20 receives pairing password PAS. After receiving pairing password PAS, vehicle 20 is set to pairing mode from HMI 22 and waits in a state in which it can receive a password from first device 30A. Then, vehicle 20 proceeds to step S12.

[0061] In step S12, the vehicle 20 performs pairing with the first device 30A. Once pairing is performed, the vehicle 20 establishes a secure channel for data communication with the first device 30A. The pairing is performed using a pairing password PAS transmitted from the management server 70 to the vehicle 20 and the first device 30A. Once pairing is complete, the vehicle 20 proceeds to step S13.

[0062] In step S13, the vehicle 20 generates a vehicle public key PKV, which is the public key of the vehicle 20, and a vehicle private key SKV, which is the private key of the vehicle 20. Then, the vehicle 20 transmits generation data DC for generating the owner key KO to the first device 30A via a secure channel. The generation data DC includes vehicle identification information ST1 and vehicle public key information indicating the vehicle public key PKV. Then, the first device 30A receives the generation data DC. Then, the first device 30A proceeds to step S14.

[0063] In step S14, the first device 30A generates owner key information DKO indicating the owner key KO. After that, the first device 30A advances the process to step S15. In step S15, the first device 30A stores the owner key information DKO. As a result, the first device 30A becomes the owner device 40. Thereafter, the first device 30A transmits, to the vehicle 20, certificate information ST5 related to the owner key KO and device public key information ST6 indicating the device public key PKD.

[0064] Thereafter, when vehicle 20 receives certificate information ST5 and device public key information ST6, vehicle 20 performs the process of step S16. In step S16, vehicle 20 verifies certificate information ST5. Then, when the verification of certificate information ST5 is completed, vehicle 20 proceeds to the process of step S17.

[0065] In step S17, the vehicle 20 stores the device public key information ST6 indicating the device public key PKD as the authentication information AT. Then, the vehicle 20 transmits a completion notification M11 to the first device 30A indicating that the storage of the authentication information AT has been completed.

[0066] Thereafter, when the first device 30A receives the completion notification M11, the first device 30A performs the process of step S18. In step S18, the first device 30A generates a key track request D12 for the owner key KO. The key track request D12 is a signal requesting the management server 70 to update the database DB. Then, the first device 30A transmits the key track request D12 for the owner key KO to the management server 70 via the device server 60.

[0067] Thereafter, upon receiving the key track request D12, the management server 70 performs processing in step S19. In step S19, the management server 70 performs registration management of the owner key KO. Specifically, the management server 70 stores the first device 30A as the device 30 registered as the owner key KO in the data DA of the vehicle 20 in the database DB. This completes the series of processes for the owner key KO in the digital key system 10.

[0068] <Friend Key KF Registration> 6, the digital key system 10 performs a series of processes to register a friend key KF. Among the devices 30 that do not store friend key information DKF, the device 30 that is designated as a friend device 51 through the series of processes is referred to as a second device 30B.

[0069] When an operation to request registration of a friend key KF is executed in the owner device 40, the owner device 40 first performs the process of step S21. In step S21, the owner device 40 transmits a friend key KF registration request D21 to a relay server (not shown). Thereafter, the owner device 40 proceeds to the process of step S22.

[0070] In step S22, the owner device 40 acquires invitation information IV1 for sharing the digital key from the relay server. The invitation information IV1 is, for example, a URL link. The URL link stores share information SH1 required for sharing the digital key. The owner device 40 then transmits the invitation information IV1 to the second device 30B.

[0071] After that, when the second device 30B receives the invitation information IV1, it performs the process of step S23. In step S23, the second device 30B acquires the share information SH1 based on the invitation information IV1. Specifically, the second device 30B downloads the share information SH1 from the link source of the URL link.

[0072] The share information SH1 includes, for example, share key structure information STS, password information ATP2, validity start time information ATP3, expiration date information ATP4, and name information ATP5. Note that the validity start time information ATP3, expiration date information ATP4, and name information ATP5 are set by the owner device 40. Thereafter, the second device 30B proceeds to step S24.

[0073] In step S24, the second device 30B uses the share information SH1 to generate unsigned friend key information DKFN. The unsigned friend key information DKFN is friend key information DKF that does not include signature information ATP1. Specifically, the second device 30B generates each piece of information included in the acquired share information SH1 as the unsigned friend key information DKFN. The second device 30B then transmits to the owner device 40 a completion notification M21 indicating that the generated unsigned friend key information DKFN has been uploaded to the URL link, and a signature request D22 requesting a signature.

[0074] Thereafter, the owner device 40 receives a completion notification M21 and a signature request D22 from the second device 30B. Upon receiving the completion notification M21, the owner device 40 acquires the unsigned friend key information DKFN. Upon receiving the signature request D22, the owner device 40 performs the process of step S25 in response to an operation of the owner device 40.

[0075] In step S25, the owner device 40 generates signature information ATP1. Specifically, the owner device 40 causes the HMI 32 to present the acquired unsigned friend key information DKFN, and accepts an operation by the user of the owner device 40 indicating consent to the registration of the friend key KF. When the operation is performed, the owner device 40 acquires a signature based on the operation. Thereafter, the owner device 40 proceeds to step S26.

[0076] In step S26, the owner device 40 adds the signature information ATP1 to the unsigned friend key information DKFN. As a result, the owner device 40 generates friend key information DKF. The owner device 40 then uploads the generated friend key information DKF to the URL link, which is the invitation information IV1. The owner device 40 then transmits a completion notification M22 to the second device 30B, indicating that the completed friend key information DKF has been uploaded to the URL link.

[0077] Thereafter, the second device 30B receives the completion notification M22. Then, the second device 30B performs the process of step S27. In step S27, the second device 30B downloads and stores the friend key information DKF. As a result, the second device 30B becomes a friend device 51. Then, the second device 30B proceeds to the process of step S28.

[0078] In step S28, the second device 30B generates a key track request D23 for the friend key KF, and then transmits the friend key information DKF and the key track request D23 for the friend key KF to the management server 70.

[0079] Thereafter, when the management server 70 receives a key track request D23 for the friend key KF, the management server 70 performs the process of step S29. In step S29, the management server 70 performs registration management of the friend key KF.

[0080] Specifically, the management server 70 verifies that the friend key KF that is the target of the key track request D23 is not on the reject list. The reject list is a list that indicates shared keys KS that include friend keys KF and non-friend keys KN for which a deletion request has already been received. If the friend key KF is on the reject list, the management server 70 sends a notification to the second device 30B that the key track request D23 cannot be fulfilled.

[0081] On the other hand, if the friend key KF that received the key track request D23 is not on the rejection list, the management server 70 registers the friend key KF that received the key track request D23 in the database DB. In detail, the management server 70 stores the second device 30B as a device 30 registered as a friend device 51 in the data DA of the vehicle 20 in the database DB. The management server 70 stores the relationship between the second device 30B and the owner device 40 by referring to the acquired friend key information DKF.

[0082] Thereafter, the management server 70 transmits the authentication package ATP of the friend key information DKF and a storage request D24 requesting storage of the authentication package ATP to the vehicle 20. That is, the management server 70 transmits device public key information ST6 indicating the device public key PKD of the friend device 51 to the vehicle 20. The management server 70 also notifies the vehicle 20 that the device public key PKD has been signed by the owner device 40.

[0083] Thereafter, when the vehicle 20 receives the storage request D24 and the authentication package ATP from the management server 70, it performs the process of step S30. In step S30, the vehicle 20 stores the received authentication package ATP as authentication information AT for authenticating the friend key KF.

[0084] After completing the registration management, the management server 70 transmits a key track completion notification M23 to the second device 30B. Thereafter, upon receiving the key tracking completion notification M23, the second device 30B performs the process of step S31. In the process of step S31, the second device 30B presents information indicating the completion of the registration of the friend key KF to the HMI 32. For example, the second device 30B displays an image indicating the completion of the registration of the friend key KF on the HMI 32. This causes the digital key system 10 to end the series of processes for registering the friend key KF.

[0085] <Registering a non-friend key KN> 7, the digital key system 10 performs a series of processes to register a non-friend key KN. Among the devices 30 that do not store non-friend key information DKN, the device 30 that is designated as a non-friend device 52 through the series of processes is referred to as a third device 30C.

[0086] When an operation to request registration of a non-friend key KN is executed in the friend device 51, the friend device 51 first performs the process of step S41. In step S41, the friend device 51 transmits a registration request D31 of the non-friend key KN to a relay server (not shown). Thereafter, the friend device 51 proceeds to the process of step S42.

[0087] In step S42, the friend device 51 acquires invitation information IV2 for sharing the digital key from the relay server. The invitation information IV2 is, for example, a URL link. The URL link stores share information SH2 required for sharing the digital key. The friend device 51 then transmits the invitation information IV2 to the third device 30C.

[0088] After that, when the third device 30C receives the invitation information IV2, it performs the process of step S43. In step S43, the third device 30C acquires the share information SH2 based on the invitation information IV2. Specifically, the third device 30C downloads the share information SH2 from the URL link.

[0089] The share information SH2 includes, for example, share key structure information STS, password information ATP2, validity start time information ATP3, expiration date information ATP4, and name information ATP5. Note that the validity start time information ATP3, expiration date information ATP4, and name information ATP5 are set by the friend device 51. Thereafter, the third device 30C proceeds to step S44.

[0090] In step S44, the third device 30C uses the share information SH2 to generate unsigned non-friend key information DKNN. The unsigned non-friend key information DKNN is non-friend key information DKN that does not include the signature information ATP1. Specifically, the third device 30C generates each piece of information included in the acquired share information SH2 as each piece of information in the unsigned non-friend key information DKNN. The third device 30C then transmits to the friend device 51 a completion notification M31 indicating that the generated unsigned non-friend key information DKNN has been uploaded to the URL link, and a signature request D32 requesting a signature.

[0091] Thereafter, the friend device 51 receives a completion notification M31 and a signature request D32 from the third device 30C. Upon receiving the completion notification M31, the friend device 51 acquires unsigned non-friend key information DKNN. Upon receiving the signature request D32, the friend device 51 performs the process of step S45 in response to an operation of the friend device 51.

[0092] In step S45, the friend device 51 generates signature information ATP1. Specifically, the friend device 51 causes the HMI 32 to present the acquired unsigned non-friend key information DKNN, and accepts an operation by the user of the friend device 51 indicating consent to the generation of the non-friend key KN. When the operation is performed, the friend device 51 acquires a signature based on the operation. Thereafter, the friend device 51 proceeds to step S46.

[0093] In step S46, the friend device 51 adds the signature information ATP1 to the unsigned non-friend key information DKNN. As a result, the friend device 51 generates non-friend key information DKN. Thereafter, the friend device 51 uploads the generated non-friend key information DKN to the URL link, which is the invitation information IV2. Then, the friend device 51 transmits a completion notification M32 to the third device 30C indicating that the completed non-friend key information DKN has been uploaded to the URL link.

[0094] The third device 30C then receives the completion notification M32. The third device 30C then performs the process of step S47. In step S47, the third device 30C downloads and stores the non-friend key information DKN. As a result, the third device 30C becomes a non-friend device 52. The third device 30C then proceeds to the process of step S48.

[0095] In step S48, the third device 30C generates a key track request D33 for the non-friend key KN, and then transmits the non-friend key information DKN and the key track request D33 for the non-friend key KN to the management server 70.

[0096] Thereafter, when the management server 70 receives a key track request D33 for the non-friend key KN, the management server 70 performs the process of step S49. In step S49, the management server 70 performs registration management of the non-friend key KN.

[0097] Specifically, the management server 70 confirms that the non-friend key KN that is the target of the key track request D33 is not on the reject list. If the non-friend key KN is on the reject list, the management server 70 sends a notification to the third device 30C that the key track request D33 cannot be fulfilled.

[0098] On the other hand, if the non-friend key KN is not on the rejection list, the management server 70 registers the non-friend key KN that is the subject of the key track request D33 in the database DB. Specifically, the management server 70 stores the third device 30C in the data DA of the vehicle 20 in the database DB as a device 30 registered as a non-friend device 52. The management server 70 stores the relationship between the third device 30C and the friend device 51 by referring to the acquired non-friend key information DKN. Specifically, the management server 70 stores the third device 30C as a device 30 having the non-friend key KN registered in response to the registration request D31 from the friend device 51.

[0099] Thereafter, the management server 70 transmits the authentication package ATP of the non-friend key information DKN and a storage request D34 requesting storage of the authentication package ATP to the vehicle 20. That is, the management server 70 transmits device public key information ST6 indicating the device public key PKD of the non-friend device 52 to the vehicle 20. The management server 70 also notifies the vehicle 20 that the device public key PKD is signed by the friend device 51.

[0100] Thereafter, when the vehicle 20 receives the authentication package ATP and the storage request D34, it performs the process of step S50. In step S50, the vehicle 20 stores the received authentication package ATP. That is, the vehicle 20 stores the authentication package ATP as authentication information AT for authenticating the non-friend key KN.

[0101] After completing the registration management, the management server 70 transmits a key track completion notification M33 to the third device 30C. Thereafter, upon receiving the key tracking completion notification M33, the third device 30C performs the process of step S51. In the process of step S51, the third device 30C presents information indicating the completion of registration of the non-friend key KN to the HMI 32. For example, the third device 30C displays an image indicating the completion of registration of the non-friend key KN on the HMI 32. This causes the digital key system 10 to end the series of processes for registering the non-friend key KN.

[0102] <Locked by the vehicle 20> By registering a digital key in the manner shown in FIGS. 5 to 7, the registered digital key becomes capable of controlling the vehicle 20.

[0103] The registered digital key can then be used to lock the vehicle 20. Below, the manner in which the digital key locks the vehicle 20 will be described with reference to FIGS. Among the drawings from Figure 8 onwards, there are drawings in which directions are indicated by arrows. In the drawings in which directions are indicated by arrows, Fr indicates the forward direction of the vehicle 20. In the drawings in which directions are indicated by arrows, Rr indicates the rearward direction of the vehicle 20. In the drawings in which directions are indicated by arrows, Rh indicates the right side as seen by a passenger facing the front of the vehicle 20. In the drawings in which directions are indicated by arrows, Lh indicates the left side as seen by a passenger facing the front of the vehicle 20.

[0104] <Effective Range of UWB Communication Between Vehicle 20 and Device 30> When a locking request is made through communication with the device 30, the vehicle management device 26 responds to the locking request and locks the vehicle 20. Fig. 8 shows a state in which information about the vehicle 20 and the digital key is stored and a user of the device 30 makes a request to lock the vehicle 20 through communication with the device 30 to which the digital key is registered.

[0105] 8 shows an exterior UWB effective range 91 and an interior UWB effective range 92. As described above, the vehicle 20 performs UWB communication with the device 30 via the UWB module 24. The vehicle 20 is equipped with a first UWB module 101, a second UWB module 102, a third UWB module 103, and a fourth UWB module 104 as the UWB module 24.

[0106] The exterior UWB effective range 91 is a range outside the vehicle 20 in which the device 30 can communicate with the vehicle 20 via UWB. Within the exterior UWB effective range 91 on the right side of the vehicle 20 in FIG. 8, the vehicle 20 communicates with the device 30 via UWB module 102. Within the exterior UWB effective range 91 on the left side of the vehicle 20 in FIG. 8, the vehicle 20 communicates with the device 30 via UWB module 103. Within the exterior UWB effective range 91 on the rear side of the vehicle 20 in FIG. 8, the vehicle 20 communicates with the device 30 via UWB module 104.

[0107] The in-vehicle UWB effective range 92 is a range within the vehicle 20 in which the device 30 can perform UWB communication with the vehicle 20. Within the in-vehicle UWB effective range 92, the vehicle 20 performs UWB communication with the device 30 through the first UWB module 101.

[0108] The vehicle 20 performs ranging through UWB communication with the device 30. When the device 30 is inside the vehicle 20, the vehicle 20 performs ranging based on the signal strength of UWB communication with the device 30 through the first UWB module 101. When the device 30 is on the right side of the vehicle 20, the vehicle 20 performs ranging based on the signal strength of UWB communication with the device 30 through the second UWB module 102. When the device 30 is on the left side of the vehicle 20, the vehicle 20 performs ranging based on the signal strength of UWB communication with the device 30 through the third UWB module 103. When the device 30 is on the rear side of the vehicle 20, the vehicle 20 performs ranging based on the signal strength of UWB communication with the device 30 through the fourth UWB module 104.

[0109] Vehicle 20 determines that device 30 is inside vehicle 20 when UWB communication is being performed with device 30 within in-vehicle UWB effective range 92. In other words, vehicle 20 determines that device 30 is inside vehicle 20 when UWB communication is being performed with device 30 through first UWB module 101.

[0110] Vehicle 20 determines that device 30 is outside vehicle 20 when UWB communication with device 30 is being performed within exterior UWB effective range 91. In other words, vehicle 20 determines that device 30 is outside vehicle 20 when UWB communication with device 30 is being performed through second UWB module 102, third UWB module 103, or fourth UWB module 104.

[0111] <Method of locking the vehicle 20 based on a lock request> 8 shows an external device 81 and an internal device 82 as devices 30 that store information about the digital key. The external device 81 is a device 30 that is outside the vehicle 20 when the vehicle management device 26 attempts to lock the vehicle 20. The internal device 82 is a device 30 that is inside the vehicle 20 when the vehicle management device 26 attempts to lock the vehicle 20.

[0112] The user of the device 30 can request the vehicle 20 to lock by operating the device 30 and transmitting a signal requesting locking from the device 30 to the vehicle 20. At this time, the device 30 transmits the signal requesting locking through BLE communication using the BLE module 33.

[0113] In this case, when the vehicle management device 26 receives a signal requesting locking, it first determines that a request has been made to lock the vehicle 20. Next, the vehicle management device 26 determines whether or not there is a device 30 storing information about a digital key inside the vehicle 20. At this time, the vehicle management device 26 determines whether or not there is a device 30 inside the vehicle 20 through UWB communication with the device 30.

[0114] When the vehicle management device 26 confirms that the device 30 storing information about the digital key is not inside the vehicle 20, it controls the locking mechanism 29 to lock the vehicle 20. For example, in FIG. 8 , even if the external device 81 transmits a signal requesting locking, the vehicle management device 26 does not lock the vehicle 20 when it confirms the presence of the internal device 82 through UWB communication. In this way, the vehicle management device 26 prevents the device 30 storing information about the digital key from being locked out.

[0115] A user of the device 30 that stores information about the digital key can also request that the vehicle 20 be locked by performing an operation to request that the vehicle 20 be locked while carrying the device 30 that stores information about the digital key. For example, the user of the vehicle 20 can request that the vehicle 20 be locked by touching the door handle of the vehicle 20 while carrying the device 30 that stores information about the digital key.

[0116] In this case, the vehicle management device 26 first performs UWB communication with the device 30 that stores information about the digital key. The vehicle management device 26 determines that a request to lock the vehicle 20 has been made when it confirms through UWB communication that the device 30 that stores information about the digital key is within the exterior UWB effective range 91. At this time, the vehicle management device 26 may determine that a request to lock the vehicle 20 has been made when it determines through ranging by UWB communication that the device 30 that stores information about the digital key is within the exterior UWB effective range 91 and within a predetermined distance from the vehicle 20.

[0117] Next, the vehicle management device 26 determines whether or not there is a device 30 storing information about the digital key inside the vehicle 20, just as it would if it received a signal requesting locking. For example, in Fig. 8, even if a user carrying the external device 81 performs an operation to request locking of the vehicle 20, the vehicle management device 26 will not lock the vehicle 20 if it confirms the presence of the internal device 82 through UWB communication.

[0118] <Method of locking the vehicle 20 based on distance measurement> The vehicle management device 26 locks the vehicle 20 when it detects, through UWB communication with the device 30 storing information about the digital key, that the device 30 has moved away from the vehicle 20 by a predetermined distance or more. At this time, the vehicle management device 26 also determines whether or not to lock the vehicle 20. Figure 9 shows a state in which the external device 81 moves away from the vehicle 20.

[0119] In determining whether to lock the vehicle 20, the vehicle management device 26 determines whether there is a device 30 in the vehicle 20 that stores information about the digital key, just as when there is a request to lock the vehicle 20. For example, even if the user of the external device 81 moves in the direction indicated by the white arrow in Fig. 9 and the external device 81 moves away from the vehicle 20 by a predetermined distance or more, the vehicle management device 26 will not lock the vehicle 20 when it confirms the presence of the internal device 82 through UWB communication.

[0120] 8 and 9, when locking the vehicle 20, the vehicle management device 26 locks the vehicle 20 if it confirms that there is no device 30 inside the vehicle 20 that stores information about the digital key. However, there are cases where the user wants to be able to lock the vehicle 20 even if there is a device 30 inside the vehicle that stores information about the digital key. Therefore, when certain conditions are met, the vehicle management device 26 locks the vehicle 20 even if there is a device 30 inside the vehicle 20 that stores information about the digital key.

[0121] 10 shows a series of processes executed by the vehicle control device 26 when locking the vehicle 20. The series of processes shown in FIG. 10 are executed by the execution device 27 based on the control program PC.

[0122] When attempting to lock the vehicle 20, the vehicle management device 26 executes the series of processes shown in Fig. 10. That is, as shown and explained in Fig. 8, when the vehicle management device 26 determines that a request to lock the vehicle 20 has been made, the vehicle management device 26 executes the series of processes shown in Fig. 10. Also, as shown and explained in Fig. 9, when the vehicle management device 26 detects that the device 30 storing information about the digital key has moved away from the vehicle 20 by a predetermined distance or more, the vehicle management device 26 executes the series of processes shown in Fig. 10.

[0123] First, a mode in which the vehicle control device 26 executes a series of processes shown in FIG. 10 when the vehicle control device 26 determines that a locking request has been made for the vehicle 20 will be described.

[0124] In the process of step S61, the vehicle management device 26 checks the placement status of the devices 30 around the vehicle 20. At this time, the vehicle management device 26 performs UWB communication with the devices 30 around the vehicle 20.

[0125] In the processing of step S61, the vehicle management device 26 performs UWB communication with the device 30 in the vicinity of the vehicle 20 to confirm whether the device 30 that performed the communication that triggered the locking request is inside or outside the vehicle 20.

[0126] When a locking request is made by transmitting a signal requesting locking, the device 30 that performed the communication that triggered the locking request is the device 30 that stores information about the digital key that transmitted the signal. The vehicle management device 26 confirms whether the device 30 that transmitted the signal requesting locking is inside or outside the vehicle 20 by performing UWB communication with the device 30.

[0127] When a locking request is made by an operation requesting that the vehicle 20 be locked, the device 30 that performed the communication that triggered the locking request is the device 30 that stores information about the digital key that performed UWB communication with the vehicle 20 within the exterior UWB effective range 91 after the operation. When a locking request is made by an operation requesting that the vehicle 20 be locked, the device 30 that performed the communication that triggered the locking request has already been confirmed to be outside the vehicle 20, so the vehicle management device 26 does not need to confirm the location of the device 30 that performed the communication that triggered the locking request.

[0128] In the processing of step S61, the vehicle management device 26 confirms information about the device 30 that performed the communication that triggered the locking request. Specifically, the vehicle management device 26 identifies the device 30 that performed the communication that triggered the locking request based on the authentication information AT. Then, the vehicle management device 26 confirms information about the device 30 that performed the communication that triggered the locking request, such as identification information about the device 30 and information indicating the owner of the device 30. Note that the information about the device 30 that performed the communication that triggered the locking request that the vehicle management device 26 can confirm is not limited to the information described above.

[0129] In the processing of step S61, the vehicle management device 26 performs UWB communication with devices 30 in the vicinity of the vehicle 20 to check whether there are any devices 30 in the vehicle 20 that store information about the digital key.

[0130] In the processing of step S61, if there is a device 30 in the vehicle 20 that stores information about the digital key, the vehicle management device 26 checks the information about that device. Specifically, the vehicle management device 26 identifies the device based on the authentication information AT. Then, the vehicle management device 26 checks the information about the device 30, such as the identification information of the device 30 and information indicating the owner of the device 30. Note that the information about the device 30 that the vehicle management device 26 can check is not limited to the information described above.

[0131] In the processing of the next step S62, the vehicle management device 26 determines whether or not the device 30 storing information about the digital key is inside the vehicle 20. In the processing of step S61, if the vehicle management device 26 has performed UWB communication with the device 30 storing information about the digital key within the in-vehicle UWB effective range 92, the vehicle management device 26 determines that the device 30 storing information about the digital key is inside the vehicle 20. On the other hand, if the vehicle management device 26 has not performed UWB communication with the device 30 storing information about the digital key within the in-vehicle UWB effective range 92 in the processing of step S61, the vehicle management device 26 determines that the device 30 storing information about the digital key is not inside the vehicle 20.

[0132] If the vehicle management device 26 determines in the processing of step S62 that there is no device 30 storing information about the digital key inside the vehicle 20 (step S62: NO), the processing proceeds to step S67. In the processing of step S67, the vehicle management device 26 controls the locking mechanism 29 to lock the vehicle 20. In this way, the vehicle management device 26 locks the vehicle 20 when there is no device 30 storing information about the digital key inside the vehicle 20. After locking the vehicle 20, the vehicle management device 26 ends the series of processes shown in FIG. 10.

[0133] If the vehicle management apparatus 26 determines in the process of step S62 that the device 30 storing information about the digital key is present in the vehicle 20 (step S62: YES), the process proceeds to step S63.

[0134] In the process of step S63, the vehicle management device 26 determines whether the device 30 that caused the locking is outside the vehicle 20. The device 30 that caused the locking is the device 30 that stores information about the digital key that performed the communication that triggered the locking request.

[0135] When a locking request is made by transmitting a signal requesting locking, the vehicle management device 26 determines in the processing of step S61 that the device 30 that transmitted the signal is outside the vehicle 20 if it has not communicated with the device 30 that transmitted the signal within the in-vehicle UWB effective range 92. On the other hand, the vehicle management device 26 determines in the processing of step S61 that the device 30 that transmitted the signal is not outside the vehicle 20 if it has communicated with the device 30 that transmitted the signal within the in-vehicle UWB effective range 92.

[0136] As mentioned above, when a locking request is made by an operation requiring locking, it is assumed that the device 30 that performed the communication that triggered the locking request is outside the vehicle 20, so the vehicle management device 26 determines that the device 30 that performed the communication that triggered the locking request is outside the vehicle 20.

[0137] If the vehicle management device 26 determines in the processing of step S63 that the device 30 that caused the locking is not outside the vehicle 20 (step S63: NO), the vehicle management device 26 ends the series of processing shown in Fig. 10. In other words, if there is a device 30 that stores information about the digital key inside the vehicle 20 and the device 30 that caused the locking is not outside the vehicle 20, the vehicle management device 26 ends the series of processing shown in Fig. 10 without locking the vehicle 20.

[0138] If the vehicle management device 26 determines in the processing of step S63 that the device 30 that caused the locking is outside the vehicle 20 (step S63: YES), the vehicle management device 26 proceeds to the processing of step S64. In other words, the vehicle management device 26 proceeds to the processing of step S64 if there is a device 30 that stores information about the digital key inside the vehicle 20 and the device 30 that caused the locking is outside the vehicle 20.

[0139] In step S64, the vehicle management device 26 determines whether or not the vehicle 20 can be locked. At this time, the vehicle management device 26 determines, based on predetermined criteria, whether or not the arrangement of the devices 30 around the vehicle 20 is such that the vehicle 20 can be locked. The specific criteria will be described later.

[0140] If the vehicle management device 26 determines in the process of step S64 that the vehicle 20 cannot be locked (step S64: NO), the vehicle management device 26 ends the series of processes shown in FIG. If the vehicle management device 26 determines in the processing of step S64 that the vehicle 20 can be locked (step S64: YES), the processing proceeds to step S65. In the processing of step S65, the vehicle management device 26 controls the locking mechanism 29 to lock the vehicle 20. After locking the vehicle 20, the vehicle management device 26 proceeds to the processing of step S66.

[0141] In the processing of step S66, the vehicle management device 26 stops the function of starting the engine 38. As will be described later, the vehicle management device 26 starts the engine 38 when an operation is performed by the user. After the processing of step S66, the vehicle management device 26 does not start the engine 38 even if an operation is performed by the user requesting the start of the engine 38. Thereafter, the vehicle management device 26 ends the series of processes shown in FIG. 10.

[0142] Next, we will explain how the vehicle management device 26 executes the series of processes shown in Figure 10 when it detects that the device 30 storing information about the digital key has moved away from the vehicle 20 by more than a predetermined distance.

[0143] In the process of step S61, the vehicle management device 26 checks the placement status of the devices 30 around the vehicle 20. At this time, the vehicle management device 26 performs UWB communication with the devices 30 around the vehicle 20.

[0144] In the processing of step S61, the vehicle management device 26 checks the information of the device 30 that stores information about the digital key that has moved away from the vehicle 20 by more than a predetermined distance. Specifically, the vehicle management device 26 identifies the device 30 that stores information about the digital key that has moved away from the vehicle 20 by more than a predetermined distance, based on the authentication information AT. Then, the vehicle management device 26 checks the information of the device 30 that stores information about the digital key that has moved away from the vehicle 20 by more than a predetermined distance, such as the identification information of the device 30 and information indicating the owner of the device 30. Note that the information that the vehicle management device 26 can check about the device 30 that stores information about the digital key that has moved away from the vehicle 20 by more than a predetermined distance is not limited to the information described above.

[0145] In the process of step S61, the vehicle management device 26 performs UWB communication with devices 30 in the vicinity of the vehicle 20 to check whether there are any devices 30 in the vehicle 20 that store information about the digital key. This process is the same as when the series of processes shown in Fig. 10 is executed in response to a locking request.

[0146] In the process of step S61, if there is a device 30 in the vehicle 20 that stores information about the digital key, the vehicle management device 26 checks the information of the device 30. This process is the same as when the series of processes shown in Fig. 10 is executed in response to a locking request.

[0147] In the next step S62, the vehicle management device 26 determines whether or not a device 30 storing information about the digital key is present inside the vehicle 20. This process is similar to the process shown in FIG. 10 when a locking request is received.

[0148] If the vehicle management device 26 determines in the processing of step S62 that there is no device 30 storing information about the digital key inside the vehicle 20 (step S62: NO), the processing proceeds to step S67. In the processing of step S67, the vehicle management device 26 controls the locking mechanism 29 to lock the vehicle 20. After locking the vehicle 20, the vehicle management device 26 ends the series of processing shown in FIG.

[0149] If the vehicle management apparatus 26 determines in the process of step S62 that the device 30 storing information about the digital key is present in the vehicle 20 (step S62: YES), the process proceeds to step S63.

[0150] In the process of step S63, the vehicle management apparatus 26 determines whether the device 30 that caused the locking is outside the vehicle 20. The device 30 that caused the locking is the device 30 that stores information about the digital key that has left the vehicle 20. Therefore, if the series of processes shown in FIG. 10 is being executed due to the device 30 that stores information about the digital key having left the vehicle 20, it is determined that the device 30 that caused the locking is outside the vehicle 20.

[0151] If the vehicle management device 26 determines in the process of step S63 that the device 30 that caused the locking is outside the vehicle 20 (step S63: YES), the process proceeds to step S64. In step S64, the vehicle management device 26 determines whether or not the vehicle 20 can be locked. This process is the same as when the series of processes shown in FIG. 10 is executed in response to a locking request.

[0152] If the vehicle management device 26 determines in the process of step S64 that the vehicle 20 cannot be locked (step S64: NO), the vehicle management device 26 ends the series of processes shown in FIG. If the vehicle management device 26 determines in the processing of step S64 that the vehicle 20 can be locked (step S64: YES), the processing proceeds to step S65. In the processing of step S65, the vehicle management device 26 controls the locking mechanism 29 to lock the vehicle 20. After locking the vehicle 20, the vehicle management device 26 proceeds to the processing of step S66.

[0153] In the process of step S66, the vehicle management device 26 stops the function of starting the engine 38. This process is the same as when the series of processes shown in Fig. 10 is executed in response to a locking request. Thereafter, the vehicle management device 26 ends the series of processes shown in Fig. 10.

[0154] After locking the vehicle 20, when a request is made to unlock the vehicle 20, the vehicle management device 26 controls the locking mechanism 29 to unlock the vehicle 20. If the vehicle management device 26 has executed the processing of step S66, the vehicle management device 26 releases the suspension of the function to start the engine 38 when the vehicle 20 is unlocked. This processing is executed whether the series of processing shown in FIG. 10 is executed in response to a locking request or whether the series of processing shown in FIG. 10 is executed in response to a device 30 that stores information about the digital key being separated from the vehicle 20.

[0155] <Decision Criteria in Step S64> In step S64, the vehicle management device 26 determines, based on predetermined criteria, whether the arrangement of the devices 30 around the vehicle 20 indicates that the vehicle 20 can be locked. FIGS. 11 to 13 show the arrangement of the devices 30 around the vehicle 20 confirmed by the vehicle management device 26 in the processing of step S61. The criteria used by the vehicle management device 26 in step S64 will be described below with reference to the examples in FIGS. 11 to 13.

[0156] 11 to 13, the external device 81 is the device 30 that stores information about the digital key that caused the locking. In other words, when the series of processes shown in FIG. 10 is executed in response to a locking request, the external device 81 is the device 30 that performed the communication that triggered the locking request. Also, when the series of processes shown in FIG. 10 is executed in response to the device 30 that stores information about the digital key leaving the vehicle 20, the external device 81 is the device 30 that stores information about the digital key that left the vehicle 20.

[0157] In the examples of FIGS. 11 to 13, the internal device 82 is the device 30 that stores information about the digital key that performed UWB communication with the vehicle management device 26 within the in-vehicle UWB effective range 92 in the process of step S61.

[0158] 11 shows the vehicle 20, the external device 81, and the internal device 82 in the first example. In the first example, the external device 81 and the internal device 82 belong to the same user. In the processing of step S64, the vehicle management apparatus 26 confirms the owner of the external device 81 and the owner of the internal device 82 based on the identification result of the device 30 in the processing of step S61.

[0159] When the owner of the external device 81 and the owner of the internal device 82 are the same person, the vehicle management device 26 determines that the arrangement status of the devices 30 around the vehicle 20 is such that the vehicle 20 can be locked. On the other hand, when the owner of the external device 81 and the owner of the internal device 82 are not the same person, the vehicle management device 26 determines that the arrangement status of the devices 30 around the vehicle 20 is such that the vehicle 20 cannot be locked.

[0160] 12 shows the vehicle 20, the external device 81, and the internal device 82 in the second example. In the second example, the internal device 82 is a specific device 30 that has been designated in advance not to be locked inside the vehicle 20. The specific device 30 is designated from among a plurality of devices 30 that store information about the digital key. In the processing of step S64, the vehicle management apparatus 26 confirms whether the internal device 82 is a specific device 30 that has been designated in advance not to be locked inside the vehicle 20.

[0161] The device information DD is information that indicates a pre-designated specific device 30. The vehicle management device 26 refers to the device information DD to confirm whether the internal device 82 is a pre-designated specific device 30 that is not to be confined inside the vehicle 20.

[0162] Specifically, the vehicle management device 26 compares the identification information of the internal device 82 confirmed in the processing of step S61 with the identification information of a specific device 30 that is included in the device information DD and that is pre-designated not to be confined inside the vehicle 20. If the identification information of the internal device 82 is included in the device information DD as the identification information of a specific device 30 that is pre-designated not to be confined inside the vehicle 20, the vehicle management device 26 determines that the internal device 82 is the specific device.

[0163] If the internal device 82 is not a specific device 30 that has been pre-designated not to be confined inside the vehicle 20, the vehicle management device 26 determines that the arrangement of the devices 30 around the vehicle 20 is such that the vehicle 20 can be locked. On the other hand, if the internal device 82 is a specific device 30 that has been pre-designated not to be confined inside the vehicle 20, the vehicle management device 26 determines that the arrangement of the devices 30 around the vehicle 20 is such that the vehicle 20 cannot be locked.

[0164] It is also possible that there are multiple internal devices 82. In this case, the vehicle management device 26 will not lock the vehicle 20 if at least one of the multiple internal devices 82 is a specific device 30 that has been designated in advance not to be locked inside the vehicle 20.

[0165] 13 shows the vehicle 20, the external device 81, and the internal device 82 in the third example. In the third example, the internal device 82 is a specific device 30 that has been designated in advance as a device that may be locked inside the vehicle 20. The specific device 30 is designated from among a plurality of devices 30 that store information about the digital key. In the processing of step S64, the vehicle management apparatus 26 confirms whether the internal device 82 is a specific device 30 that has been designated in advance as a device that may be locked inside the vehicle 20.

[0166] The vehicle management device 26 refers to the device information DD to check whether the internal device 82 is a specific device 30 that has been designated in advance as being allowed to be confined within the vehicle 20 . Specifically, the vehicle management device 26 compares the identification information of the internal device 82 confirmed in the processing of step S61 with the identification information of a specific device 30 that is included in the device information DD and that is pre-designated as being allowed to be confined inside the vehicle 20. If the identification information of the internal device 82 is included in the device information DD as the identification information of a specific device 30 that is pre-designated as being allowed to be confined inside the vehicle 20, the vehicle management device 26 determines that the internal device 82 is the specific device.

[0167] If the internal device 82 is a specific device 30 that has been pre-designated as being allowed to be locked inside the vehicle 20, the vehicle management device 26 determines that the arrangement of the devices 30 around the vehicle 20 is such that the vehicle 20 can be locked. On the other hand, if the internal device 82 is not a specific device 30 that has been pre-designated as being allowed to be locked inside the vehicle 20, the vehicle management device 26 determines that the arrangement of the devices 30 around the vehicle 20 is such that the vehicle 20 cannot be locked.

[0168] It is also possible that there are multiple internal devices 82. In this case, the vehicle management device 26 will not lock the vehicle 20 unless at least one of the multiple internal devices 82 is a specific device 30 that has been designated in advance as being allowed to be locked inside the vehicle 20.

[0169] The judgment criteria described with reference to Figures 11 to 13 are examples of judgment criteria that can be adopted by the vehicle management device 26. The vehicle management device 26 adopts, for example, one of the judgment criteria described with reference to Figures 11 to 13 as a judgment criterion. Furthermore, the vehicle management device 26 can also adopt multiple judgment criteria from the judgment criteria described with reference to Figures 11 to 13 in a manner that does not contradict each other.

[0170] 11 and the determination criteria shown and described in Fig. 12 at the same time. In this case, for example, even if the owner of the external device 81 and the owner of the internal device 82 are the same, the vehicle management device 26 will not lock the vehicle 20 if the internal device 82 is a specific device 30 that has been pre-designated to prevent a person from being locked inside the vehicle 20. Also, for example, even if the internal device 82 is not a specific device 30 that has been pre-designated to prevent a person from being locked inside the vehicle 20, the vehicle management device 26 will not lock the vehicle 20 if the owner of the external device 81 and the owner of the internal device 82 are different.

[0171] 11 and the determination criteria shown and described in Fig. 13 at the same time. In this case, for example, even if the owner of the external device 81 and the owner of the internal device 82 are the same, the vehicle management device 26 will not lock the vehicle 20 if the internal device 82 is not a specific device 30 that has been pre-designated as being allowed to be locked inside the vehicle 20. Also, for example, even if the owner of the external device 81 and the owner of the internal device 82 are different, the vehicle management device 26 will not lock the vehicle 20.

[0172] <Aspects of Designating a Specific Device 30> The specific device 30 shown in Figures 12 and 13 is designated by the owner of the vehicle 20. Figure 14 shows how the owner designates the specific device 30. In the following description, the process executed by the execution device 27 will be described as the process executed by the vehicle 20, and the process executed by the execution device 36 will be described as the process executed by the device 30.

[0173] 14 , the owner device 40 accepts the owner's designation of a specific device 30. For example, the owner device 40 accepts the owner's designation of a specific device 30 by having the owner input information indicating the specific device 30. In this way, the owner device 40 designates the specific device 30.

[0174] The owner device 40 that has accepted the designation of the specific device 30 executes the process of step S71. In the process of step S71, a storage request D41 is generated. The storage request D41 is a signal that requests the vehicle 20 to store the specific device 30 designated by the owner. The storage request D41 includes information indicating the designated specific device 30.

[0175] The owner device 40 that has generated the storage request D41 transmits the generated storage request D41 to the vehicle 20. In Fig. 14, the vehicle 20 and the owner device 40 communicate with each other through BLE communication.

[0176] Upon receiving the storage request D41, the vehicle 20 executes the process of step S72. In the process of step S72, the vehicle 20 stores the specific device 30 designated by the owner based on the storage request D41. At this time, the vehicle 20 recognizes the designated specific device 30 based on the storage request D41, and then adds the identification information of the specific device 30 to the device information DD.

[0177] In this way, the specific device 30 is designated through the owner device 40. Then, the vehicle 20 determines whether the specific device 30 is present in the vehicle 20 based on the information about the specific device 30 transmitted by the owner device 40.

[0178] <Mode in which the vehicle management device 26 controls the engine 38> The vehicle management device 26 controls not only the locking mechanism 29 but also the engine 38. The manner in which the vehicle management device 26 controls the engine 38 will be described below with reference to Figs.

[0179] 15 shows an example of the location of the device 30 when the vehicle management apparatus 26 starts the engine 38. In FIG. 15, the device 30 storing information about the digital key is within the in-vehicle UWB coverage area 92.

[0180] When an operation to request the start of the engine 38 is performed on the vehicle 20, the vehicle management device 26 starts the engine 38. An operation to request the start of the engine 38 is, for example, an operation to turn on the ignition switch.

[0181] When starting the engine 38, the vehicle management device 26 confirms that there is a device 30 in the vehicle 20 that stores information about the digital key before starting the vehicle 20. At this time, the device 30 that stores information about the digital key that the vehicle management device 26 confirms is the device 30 that stores information about the digital key that has the authority to start the engine 38.

[0182] When starting the engine 38, the vehicle management device 26 performs UWB communication with the device 30 in the vicinity of the vehicle 20. When the vehicle management device 26 determines as a result of the UWB communication that the device 30 storing information about the digital key is within the in-vehicle UWB effective range 92, the vehicle management device 26 starts the engine 38. On the other hand, when the vehicle management device 26 determines as a result of the UWB communication that the device 30 storing information about the digital key is not within the in-vehicle UWB effective range 92, the vehicle management device 26 does not start the engine 38.

[0183] <Processing performed when starting the engine 38> 16 shows a series of processes that the vehicle control device 26 executes when starting the engine 38. The series of processes shown in FIG. 16 are executed by the execution device 27 based on the control program PC.

[0184] 16 is executed when an operation is performed to request starting of the engine 38 of the vehicle 20. For example, the vehicle management device 26 executes the series of processes shown in FIG. 16 when the ignition switch is turned on.

[0185] In the processing of step S81, the vehicle management device 26 checks whether there is a device 30 storing information about the digital key inside the vehicle 20. At this time, the vehicle management device 26 performs UWB communication with the device 30 in the vicinity of the vehicle 20.

[0186] In the next step S82, the vehicle management device 26 determines whether a device 30 storing information about a digital key is present in the vehicle 20. At this time, the device 30 confirmed by the vehicle management device 26 is a device 30 storing information about a digital key that has the authority to start the engine 38.

[0187] In processing step S81, the vehicle management device 26 determines that there is a device 30 inside the vehicle 20 that stores information about a digital key that has performed UWB communication within the in-vehicle UWB effective range 92, and that device 30 has the authority to start the engine 38.

[0188] On the other hand, in the processing of step S81, when there is no device 30 that stores information about a digital key that has performed UWB communication within the in-vehicle UWB effective range 92, the vehicle management device 26 determines that there is no device 30 in the vehicle 20 that stores information about a digital key that has authority to start the engine 38. Also, in the processing of step S81, when there is a device 30 that stores information about a digital key that has performed UWB communication within the in-vehicle UWB effective range 92 but that device 30 does not have the authority to start the engine 38, the vehicle management device 26 determines that there is no device 30 in the vehicle 20 that stores information about a digital key that has authority to start the engine 38.

[0189] If, in the processing of step S82, the vehicle management device 26 determines that there is no device 30 in the vehicle 20 that stores information about a digital key authorized to start the engine 38 (step S82: NO), the vehicle management device 26 terminates the series of processing shown in Figure 16.

[0190] If the vehicle management device 26 determines in the processing of step S82 that a device 30 storing information about a digital key authorized to start the engine 38 is present in the vehicle 20 (step S82: YES), the vehicle management device 26 proceeds to the processing of step S83. In the processing of step S83, the vehicle management device 26 determines whether or not the engine 38 can be started.

[0191] 10, if the function for starting the engine 38 has been stopped, the vehicle management device 26 determines that the engine 38 cannot be started. On the other hand, if the function for starting the engine 38 has not been stopped, the vehicle management device 26 determines that the engine 38 can be started.

[0192] If the vehicle management device 26 determines in the process of step S83 that the engine 38 cannot be started (step S83: NO), the vehicle management device 26 ends the series of processes shown in FIG. If the vehicle management device 26 determines in the processing of step S83 that the engine 38 can be started (step S83: YES), the processing proceeds to step S84. In the processing of step S84, the vehicle management device 26 starts the engine 38. After starting the engine 38, the vehicle management device 26 ends the series of processing shown in FIG.

[0193] In this way, when a request to start the engine 38 is made, the vehicle management device 26 starts the engine 38 on the condition that the vehicle 20 contains a device 30 that stores information about a digital key that has the authority to start the engine 38. However, even if the vehicle 20 contains a device 30 that stores information about a digital key that has the authority to start the engine 38, the vehicle management device 26 will not start the engine 38 if the function to start the engine 38 is disabled.

[0194] <Operation of this embodiment> When a locking request is received through communication with a device 30 outside the vehicle that stores information about the digital key, the vehicle management device 26 of the vehicle 20 determines whether or not the vehicle 20 can be locked, even if there is another device 30 inside the vehicle that stores information about the digital key. In other words, if the vehicle management device 26 of the vehicle 20 determines that locking is possible, it locks the vehicle 20 even if there is another device 30 inside the vehicle that stores information about the digital key.

[0195] <Effects of this embodiment> (1) The user of the vehicle 20 can lock the vehicle 20 even if there is a device 30 inside the vehicle that stores information about the digital key.

[0196] (2) The vehicle 20 measures distance to the device 30 through UWB (Ultra Wideband) communication. When a locking request is made while another device 30 that stores information about the digital key of the vehicle 20 is inside the vehicle 20, the locking means confirms through distance measurement that the device 30 that made the communication that triggered the locking request is outside the vehicle 20.

[0197] When a vehicle 20 receives a request to lock the vehicle while there is a device 30 storing information about the digital key inside the vehicle, the vehicle 20 measures the distance to the device 30 that initiated the locking request through UWB communication. This allows the vehicle 20 to determine whether or not to lock the vehicle 20 after determining that the device 30 that initiated the locking request is outside the vehicle.

[0198] (3) The vehicle 20 measures distances through UWB (Ultra Wideband) communication with the device 30. In the vehicle 20, when the locking means confirms through distance measurement that the device 30 storing information about the digital key of the vehicle 20 is located a predetermined distance or more away from the vehicle 20 while another device 30 storing information about the digital key of the vehicle 20 is present inside the vehicle 20, the locking means confirms the information about the other device 30 and determines whether to lock the vehicle 20 based on the confirmed information about the other device 30.

[0199] In the vehicle 20, the vehicle management device 26 determines by distance measurement that the device 30 storing information about the digital key has left the vehicle 20. Then, when the vehicle management device 26 determines that the device 30 storing information about the digital key has left the vehicle 20, it determines whether or not the vehicle 20 needs to be locked, even if another device 30 storing information about the digital key is inside the vehicle 20. In other words, the vehicle 20 is locked not only by communication that triggers a lock request, but also by UWB distance measurement to the device 30 storing information about the digital key. This makes it possible to prevent the vehicle 20 from forgetting to lock the vehicle 20 when the device 30 storing information about the digital key is left inside the vehicle.

[0200] (4) When a request to start the engine 38 is made, the vehicle 20 starts the engine 38 on the condition that there is a device 30 inside the vehicle 20 that stores information about the digital key of the vehicle 20. When there is another device 30 inside the vehicle 20 that stores information about the digital key of the vehicle 20, and after the locking means has locked the vehicle 20 in accordance with a locking request, and there is a request to start the engine 38 before the locking means has unlocked the vehicle 20, the vehicle 20 does not start the engine 38 even if there is a device 30 inside the vehicle 20 that stores information about the digital key of the vehicle 20.

[0201] If the vehicle 20 is locked while another device 30 that stores information about the digital key is present inside the vehicle, the vehicle 20 does not permit the engine 38 to be started while the vehicle is locked. This prevents the engine 38 from being started when the user who locked the vehicle 20 is not present.

[0202] (5) In the vehicle 20, the locking means verifies the owner of the device 30 inside the vehicle 20 and the owner of the device 30 that made the communication that triggered the locking request, and if there is a device 30 inside the vehicle 20 that belongs to a user different from the owner of the device 30 that made the communication that triggered the locking request and that stores information about the digital key of the vehicle 20, it determines not to lock the vehicle 20.

[0203] When a user has multiple devices 30 when boarding the vehicle 20, there is a demand for locking the vehicle 20 while leaving some of the devices 30 inside the vehicle 20. In the vehicle 20, the vehicle management device 26 verifies the owner of the device 30 that stores information about the digital key inside the vehicle and the owner of the device 30 that stores information about the digital key outside the vehicle, and locks the vehicle 20 if they are the same. This prevents the vehicle 20 from locking a device 30 that stores information about a digital key of another person to whom the digital key is registered inside the vehicle 20 due to a locking request from the device 30 that stores information about the digital key outside the vehicle.

[0204] (6) The vehicle 20 is configured to be able to specify in advance a specific device 30 from among a plurality of devices 30 that store information about the digital key of the vehicle 20. When a locking request is made, if the specific device 30 is inside the vehicle 20, the locking means of the vehicle 20 determines not to lock the vehicle 20.

[0205] Depending on the combination of devices 30 inside and outside the vehicle 20 that store information about the digital key, it may be undesirable for the user to lock the vehicle 20 while leaving a device 30 that stores information about the digital key inside the vehicle 20. When a request to lock the vehicle 20 is received, the vehicle management device 26 will not lock the vehicle 20 if there is a predetermined device 30 inside the vehicle, even if there is a device 30 outside the vehicle that has communicated and triggered the locking request. This allows the user to select in advance the device 30 that stores information about the digital key that the user does not want locked inside the vehicle 20.

[0206] (7) The vehicle 20 is configured to be able to specify in advance a specific device 30 from among a plurality of devices 30 that store information about the digital key of the vehicle 20. When a locking request is made in the vehicle 20, if a device 30 other than the specific device 30 is present in the vehicle 20 among the plurality of devices 30 that store information about the digital key of the vehicle 20, the locking means determines not to lock the vehicle 20.

[0207] Depending on the combination of devices 30 inside and outside the vehicle 20 that store information about the digital key, it may be undesirable for the user to lock the vehicle 20 while leaving a device 30 that stores information about the digital key inside the vehicle 20. When a request to lock the vehicle 20 is received, the vehicle management device 26 will not lock the vehicle 20 if there is a device 30 inside the vehicle that stores information about a digital key other than a predetermined device 30, even if there is a device 30 outside the vehicle that has performed communication that triggers the locking request. This allows the user to prevent devices 30 that store information about digital keys other than the device 30 that the user has previously designated from being locked out.

[0208] (8) The specific device 30 is designated through the device 30. The vehicle 20 receives information about the specific device 30 transmitted from the device 30 that designated the specific device 30. In the vehicle 20, the locking means determines whether the specific device 30 is present in the vehicle 20 based on the received information about the specific device 30.

[0209] The vehicle 20 receives information about the specified specific device 30 from the device 30 that constitutes the digital key system. This allows the vehicle 20 to determine whether or not to lock the vehicle 20 based on the received information.

[0210] (9) When a locking request is made through communication with a device 30 outside the vehicle that stores information about the digital key, the above control method determines whether or not the vehicle 20 can be locked, even if there is another device 30 inside the vehicle that stores information about the digital key. In other words, if the control method determines that locking is possible, it locks the vehicle 20 even if there is another device 30 inside the vehicle that stores information about the digital key. This allows the user to lock the vehicle 20 even if there is a device 30 inside the vehicle that stores information about the digital key.

[0211] (10) When a locking request is received through communication with a device 30 outside the vehicle that stores information about the digital key, the control program PC determines whether or not the vehicle 20 can be locked, even if there is another device 30 inside the vehicle that stores information about the digital key. In other words, if the control program PC determines that locking is possible, it locks the vehicle 20 even if there is another device 30 inside the vehicle that stores information about the digital key. This allows the user to lock the vehicle 20 even if there is a device 30 inside the vehicle that stores information about the digital key.

[0212] (11) When a locking request is received through communication with an external device 30 that stores information about the digital key, the digital key system 10 determines whether the vehicle 20 can be locked, even if there is another device 30 inside the vehicle that stores information about the digital key. In other words, if the digital key system 10 determines that locking is possible, it locks the vehicle 20 even if there is another device 30 inside the vehicle that stores information about the digital key. This allows the user to lock the vehicle 20 even if there is a device 30 inside the vehicle that stores information about the digital key.

[0213] (12) The digital key system 10 is configured to allow a specific device 30 to be designated in advance from among multiple devices 30 that store information about the digital key of the vehicle 20. When a locking request is made and the specific device 30 is inside the vehicle 20, the digital key system 10 determines not to lock the vehicle 20.

[0214] Depending on the combination of devices 30 inside and outside the vehicle 20 that store information about the digital key, it may be undesirable for the user to lock the vehicle 20 with a device 30 that stores information about the digital key left inside the vehicle 20. When a request to lock the vehicle 20 is made, the digital key system 10 will not lock the vehicle 20 if there is a predetermined device 30 inside the vehicle, even if there is a device 30 outside the vehicle that has communicated and triggered the lock request. This allows the user to select in advance the device 30 that stores information about the digital key that they do not want locked inside the vehicle 20.

[0215] (13) The digital key system 10 is configured to allow a specific device 30 to be designated in advance from among the multiple devices 30 that store information about the digital key of the vehicle 20. When a locking request is received, the digital key system 10 determines not to lock the vehicle 20 if a device 30 other than the specified device 30 is present inside the vehicle 20 among the multiple devices 30 that store information about the digital key of the vehicle 20.

[0216] Depending on the combination of devices 30 inside and outside the vehicle 20 that store digital key information, it may be undesirable for the user to lock the vehicle 20 while leaving a device 30 that stores digital key information inside the vehicle 20. When a request to lock the vehicle 20 is made, the digital key system 10 will not lock the vehicle 20 if there is a device 30 inside the vehicle that stores digital key information other than the predetermined device 30, even if there is a device 30 outside the vehicle that has performed communication that triggers the lock request. This allows the user to prevent devices 30 that store digital key information other than the predetermined device 30 from being locked out.

[0217] (14) In the digital key system 10, a specific device 30 is designated through the device 30. This allows the user to designate a specific device 30.

[0218] <Example of change> This embodiment can be modified as follows: This embodiment and the following modifications can be combined and implemented within the scope of technical compatibility.

[0219] <Digital Key System 10> The vehicle 20 may not have all of the BLE module 23, the UWB module 24, and the NFC module 25. As long as the vehicle 20 has at least one module, it can perform short-range communication with the device 30. Furthermore, the vehicle 20 is not limited to these modules, and may have any module that performs short-range communication with the device 30.

[0220] The digital key-related matters in the above embodiments do not have to comply with the CCC. In the above vehicle 20, the locking means is the vehicle management device 26. The locking means provided in the vehicle 20 is not limited to the above embodiment. For example, the locking means may be a device that controls only the locking mechanism 29. For example, the locking means may be a unit that includes the locking mechanism 29 and a device that controls the locking mechanism 29.

[0221] The vehicle management device 26 is not limited to a digital key ECU. For example, it may be a central ECU that manages multiple ECUs in the vehicle 20. The vehicle management device 26 may be configured as a circuit including one or more processors that execute various processes according to a computer program (software). The vehicle management device 26 may also be configured as a circuit including one or more dedicated hardware circuits, such as an application-specific integrated circuit (ASIC), that execute at least some of the various processes, or a combination thereof. The processor includes a CPU and memory such as RAM and ROM. The memory stores program code or instructions configured to cause the CPU to execute the processes. The memory, i.e., computer-readable medium, includes any available medium that can be accessed by a general-purpose or dedicated computer. The same applies to the device 30 and the management server 70.

[0222] The vehicle management device 26 does not need to store the vehicle program PV. In this case, the vehicle management device 26 does not store or delete the authentication information AT. When the vehicle management device 26 receives a locking request from a device 30 that stores information about a digital key, it is sufficient that the vehicle management device 26 authenticates the device and determines whether or not to lock the vehicle.

[0223] The device 30 storing information about the digital key is not limited to a smartphone. It may be a smartwatch. The device 30 storing information about the digital key may also be a predetermined server. In this case, the predetermined server may include the device 30 storing information about the digital key. For example, if a rental business or a sharing business is the owner of the vehicle 20, the owner device 40 may be included in the predetermined server. Also, for example, the friend device 51 may be included in the predetermined server.

[0224] The share device 50 has a function to receive the share key KS as in the above embodiment. A device 30 having a function to receive a digital key, such as the share device 50, is sometimes called a receiver device.

[0225] In each of the above embodiments, digital keys have a hierarchy arranged in the order of owner key KO, friend key KF, and non-friend key KN, with the higher the hierarchy, the greater the authority. Digital keys do not necessarily have to be set so that the higher the hierarchy, the greater the authority. For example, the same authority level may be set for the three hierarchical levels of owner key KO, friend key KF, and non-friend key KN.

[0226] The device server 60 does not have to be provided for each type of device 30. It is sufficient that multiple devices 30 and the management server 70 are capable of wireless communication. The device server 60 may be omitted. It is sufficient that multiple devices 30 and the management server 70 are capable of direct wireless communication.

[0227] The management server 70 may be configured with multiple servers. For example, it may be configured with a server that stores the database DB and a server that executes the server program PS. Alternatively, it may be configured with a server that communicates with the vehicle 20 and a server that communicates with the device server 60, and these servers may be able to communicate with each other.

[0228] The management server 70 does not need to store the database DB. The management server 70 only needs to manage the combination of the key information DK of the device 30 and the authentication information AT of the vehicle management device 26 for each digital key in the digital key system 10.

[0229] <Various information> The authentication information AT is not limited to the examples of the above embodiments, as long as it is information for authenticating the digital key when using the digital key. For example, the authentication information AT may be a common key shared by the vehicle management device 26 and the device 30. Also, for example, the authentication information AT may be a common secret key.

[0230] The configuration of the information included in the key information DK is not limited to the example in the above embodiment. For example, the owner key information DKO does not have to include the slot identification information ST4. Also, for example, the key information DK may include information indicating the type of digital key. The type of digital key is, for example, information indicating one of the owner key KO, friend key KF, and non-friend key KN.

[0231] The database DB may include information indicating the type of the device 30. The type of the device 30 is information indicating, for example, a smartphone, a smartwatch, or a predetermined server as in the above-described modified example.

[0232] The structure of the data DA in the database DB is not limited to the examples in the above embodiments. The database DB only needs to contain the information necessary for the management server 70 in the digital key system 10 to manage it.

[0233] In the database DB, the authority may be set for each digital key, rather than being uniformly determined according to the type of digital key. Also, the authority may not be determined in the database DB.

[0234] The types of digital keys do not have to include non-friend keys KN. In other words, in the digital key system 10, the shared keys KS may only be friend keys KF.

[0235] <The process for registering a digital key> The series of processes for registering the owner key KO is not limited to the examples in the above embodiments. For example, the owner device 40 may store the owner key information DKO by transmitting and receiving information such as the generated data DC between the vehicle 20 and the first device 30A via the management server 70, even if pairing is not performed by the process of step S12. The series of processes for registering the owner key KO may be modified as appropriate to suit the structure of the information included in the owner key information DKO and the structure of the information included in the authentication information AT.

[0236] The series of processes for registering the friend key KF is not limited to the examples in the above embodiments. For example, the management server 70 may update the database DB by processing in step S29 after transmitting the authentication package ATP and the storage request D24 to the vehicle 20. The series of processes for registering the friend key KF may be modified as appropriate to suit the structure of the information contained in the friend key information DKF and the structure of the information contained in the authentication information AT.

[0237] The series of processes for registering a non-friend key KN is not limited to the examples in the above embodiments. The order of the processes for registering a friend key KF may be different. The series of processes for registering a non-friend key KN may be modified as appropriate to suit the structure of the information contained in the non-friend key information DKN and the structure of the information contained in the authentication information AT.

[0238] The types of digital keys do not have to include non-friend keys KN. In other words, in the digital key system 10, the shared keys KS may only be friend keys KF.

[0239] The non-friend device 52 may be able to send a request to register a new non-friend key KN. That is, the sharing device 50 may send a request to register a new non-friend key KN regardless of whether it is a friend device 51 or a non-friend device 52.

[0240] <Locked by the vehicle 20> The device 30 described above transmits a signal requesting locking through BLE communication using the BLE module 33. The manner in which the device 30 storing information about a digital key transmits a signal requesting locking is not limited to the above embodiment. For example, the device 30 storing information about a digital key may transmit a signal requesting locking through communication via a wireless communication network using the wireless communication device 31. For example, the device 30 storing information about a digital key may transmit a signal requesting locking through UWB communication using the UWB module 34. For example, the device 30 storing information about a digital key may transmit a signal requesting locking through NFC communication using the NFC module 35.

[0241] In the above embodiment, there are two methods by which the user of the device 30 storing information about the digital key can request locking through communication between the device 30 storing information about the digital key and the vehicle 20: a method of sending a signal requesting locking through the device 30 storing information about the digital key, and a method of performing an operation to request locking on the vehicle 20. The user of the device 30 storing information about the digital key can request locking through communication between the device 30 storing information about the digital key and the vehicle 20 using only one of the above methods.

[0242] In the above embodiment, the vehicle management device 26 locks the vehicle 20 when the device 30 storing information about the digital key is located at a predetermined distance or more. The vehicle 20 may be configured not to lock the vehicle 20 even when the device 30 storing information about the digital key is located at a predetermined distance or more.

[0243] In the above embodiment, the vehicle 20 measures distance to the device 30 storing information about the digital key through UWB communication. The method by which the vehicle 20 measures distance is not limited to the above embodiment. For example, the vehicle 20 may measure distance to the device 30 storing information about the digital key through BLE communication.

[0244] 10, the vehicle management device 26 identifies the device 30 that stores information about the digital key based on the authentication information AT. The method by which the vehicle management device 26 identifies the device 30 that stores information about the digital key is not limited to the above embodiment. For example, the vehicle management device 26 may receive information for identifying the device 30 when communicating with the device 30 that stores information about the digital key, and identify the device 30 that stores information about the digital key by checking the received information.

[0245] 11, the vehicle management device 26 does not lock the vehicle 20 when the external device 81 and the internal device 82 have different owners. The vehicle management device 26 may lock the vehicle 20 when the external device 81 and the internal device 82 have different owners. In this case, the vehicle management device 26 does not need to confirm the owner of the device 30 that stores information about the digital key.

[0246] 11, if it is determined that the device 30 storing information about the digital key is inside the vehicle 20 (step S62: YES), the vehicle management device 26 executes the process of step S63. The order in which the vehicle management device 26 executes the processes of steps S62 and S63 may be reversed. In this case, if it is determined in the process of step S63 that the device 30 that caused the locking is outside the vehicle 20 (step S63: YES), the vehicle management device 26 executes the process of step S62. Then, if it is determined in the process of step S62 that the device 30 storing information about the digital key is inside the vehicle 20 (step S62: YES), the vehicle management device 26 executes the process of step S64.

[0247] 11, the vehicle management device 26 locks the vehicle 20 when the external device 81 and the internal device 82 have the same owner. The vehicle management device 26 may be configured not to lock the vehicle 20 even when the external device 81 and the internal device 82 have the same owner.

[0248] The vehicle management device 26 executes the process of step S66 after executing the process of step S65 in Fig. 11. The order in which the vehicle management device 26 executes the process of step S65 and the process of step S66 may be reversed.

[0249] In the above embodiment, the vehicle 20 is configured to be able to designate in advance a specific device 30 that is pre-designated so as not to be trapped inside the vehicle 20. The vehicle 20 does not have to be configured to be able to designate in advance a specific device 30 that is pre-designated so as not to be trapped inside the vehicle 20.

[0250] In the above embodiment, the vehicle 20 is configured to be able to designate in advance a specific device 30 that is designated in advance as being allowed to be confined inside the vehicle 20. The vehicle 20 does not have to be configured to be able to designate in advance a specific device 30 that is designated in advance as being allowed to be confined inside the vehicle 20.

[0251] As shown in FIG. 14 , in the digital key system 10 described above, the owner designates a specific device 30. However, the user of the shared device 50 may designate a specific device 30 instead of the owner. In this case, for example, the user of the shared device 50 designates a specific device 30 via the shared device 50. The shared device 50 then transmits a storage request D41 to the vehicle 20.

[0252] 14, the owner device 40 and the vehicle 20 are performing BLE communication. The method of communication between the owner device 40 and the vehicle 20 is not limited to the above embodiment. For example, the owner device 40 may communicate with the vehicle 20 through communication via a wireless communication network using the wireless communication device 31. For example, the owner device 40 may communicate with the vehicle 20 through UWB communication using the UWB module 34. For example, the owner device 40 may communicate with the vehicle 20 through NFC communication using the NFC module 35.

[0253] In the above embodiment, the owner designates a specific device 30 through the owner device 40. The manner in which the owner designates a specific device 30 is not limited to the above embodiment. For example, the owner may designate a specific device 30 through the HMI 22 provided in the vehicle 20.

[0254] <Control of the engine 38 by the vehicle management device 26> When starting the engine 38, the vehicle management device 26 confirms that the vehicle 20 contains a device 30 that stores information about the digital key before starting the engine 38. The vehicle management device 26 may start the engine 38 without confirming whether the vehicle 20 contains a device 30 that stores information about the digital key.

[0255] In the above embodiment, if the vehicle 20 is locked with the device 30 inside the vehicle, the vehicle management device 26 does not start the engine 38 even if an operation requesting starting of the engine 38 is performed. The vehicle management device 26 may start the engine 38 in response to an operation requesting starting of the engine 38 even if the vehicle 20 is locked with the device 30 storing information about the digital key inside the vehicle.

[0256] In the above embodiment, when the vehicle 20 is locked with the device 30 storing information about the digital key inside the vehicle, the vehicle management device 26 determines not to start the engine 38 based on the processing of step S66 in Fig. 10. The manner in which the vehicle management device 26 does not start the engine 38 is not limited to the above embodiment.

[0257] For example, if the vehicle 20 is locked while a device 30 storing information about the digital key is present inside the vehicle, the authority of the device 30 storing information about the digital key inside the vehicle to start the engine 38 may be restricted. In this manner, the digital key system 10 can also restrict the vehicle management device 26 from starting the engine 38.

[0258] <Additional Notes> The technical ideas that can be understood from the above-described embodiment and modified examples will be described. [Appendix 1] A vehicle capable of communicating with multiple devices that store information about a digital key, equipped with a locking means, in which, when a request to lock the vehicle is made through communication with one of the devices, if the device that initiated the locking request is outside the vehicle and there is another device inside the vehicle that stores information about the vehicle's digital key, the locking means checks the information from the other device and determines whether to lock the vehicle based on the information from the other device.

[0259] [Appendix 2] A vehicle as described in Appendix 1, in which distance measurement is performed between the device and the other device through UWB (Ultra Wideband) communication, and when the locking request is made while the other device storing information about the digital key of the vehicle is inside the vehicle, the locking means confirms through the distance measurement that the device that communicated to trigger the locking request is outside the vehicle.

[0260] [Appendix 3] A vehicle as described in Appendix 1 or Appendix 2, in which distance measurement is performed with the device through communication with UWB (Ultra Wideband), and when the locking means confirms through the distance measurement that the device storing information about the digital key of the vehicle is located more than a predetermined distance away from the vehicle while the other device storing information about the digital key of the vehicle is inside the vehicle, the locking means confirms the information of the other device and determines whether to lock the vehicle based on the confirmed information of the other device.

[0261] [Appendix 4] A vehicle as described in any one of Appendices 1 to 3, wherein when a request to start the engine is made, the engine is started on the condition that the device storing information about the digital key of the vehicle is present in the vehicle, but when the other device storing information about the digital key of the vehicle is present in the vehicle and the locking means locks the vehicle in accordance with the locking request, and when a request to start the engine is made before the locking means unlocks the vehicle, the engine is not started even if the device storing information about the digital key of the vehicle is present in the vehicle.

[0262] [Appendix 5] A vehicle as described in any one of Appendices 1 to 4, wherein the locking means verifies the owner of the device inside the vehicle with the owner of the device that performed the communication that triggered the locking request, and determines not to lock the vehicle when a device that belongs to a user different from the owner of the device that performed the communication that triggered the locking request and that stores information about the digital key for the vehicle is present inside the vehicle.

[0263] [Appendix 6] A vehicle as described in any one of Appendices 1 to 5, configured so that a specific device can be designated in advance from among a plurality of devices that store information about the digital key of the vehicle, and when a locking request is made and the specific device is inside the vehicle, the locking means determines not to lock the vehicle.

[0264] [Appendix 7] A vehicle as described in any one of Appendices 1 to 6, which is configured to allow a specific device to be designated in advance from among a plurality of devices that store information about the digital key of the vehicle, and when a locking request is made, if a device other than the specific device is present in the vehicle among the plurality of devices that store information about the digital key of the vehicle, the locking means determines not to lock the vehicle.

[0265] [Appendix 8] A vehicle as described in Appendix 6 or Appendix 7, wherein the specific device is designated through the device, and information about the specific device transmitted from the device that designated the specific device is received, and the locking means determines whether the specific device is within the vehicle based on the received information about the specific device.

[0266] [Appendix 9] A digital key system comprising a plurality of devices that store information related to a digital key and a vehicle that can communicate with the plurality of devices, wherein when a request to lock the vehicle is made through communication with the plurality of devices, if the device that initiated the communication that triggered the locking request is outside the vehicle and there is another device inside the vehicle that stores information related to the digital key for the vehicle, the digital key system checks the information of the other device and determines whether to lock the vehicle based on the information of the other device that has been checked.

[0267] [Appendix 10] The digital key system described in Appendix 9 is configured to allow a specific device to be designated in advance from among the multiple devices that store information about the digital key of the vehicle, and when a locking request is made, if the specific device is inside the vehicle, it determines not to lock the vehicle.

[0268] [Appendix 11] A digital key system as described in Appendix 9 or Appendix 10, which is configured to allow a specific device to be designated in advance from among the multiple devices that store information about the digital key of the vehicle, and when the locking request is made, if a device other than the specified device is present in the vehicle among the multiple devices that store information about the digital key of the vehicle, the digital key system determines not to lock the vehicle.

[0269] [Appendix 12] The digital key system according to Appendix 10 or Appendix 11, wherein the specific device is designated through the device. [Explanation of symbols]

[0270] 10...Digital key system 20...Vehicle 26...Vehicle management device 27...Execution device 28…Storage device 29...Locking mechanism 30…Devices 36...Execution device 37…Storage device 38...Engine 40...Owner device 50...Shared devices 51...Friend Device 52...Non-Friendly Device 60...Device Server 70...Administration server 81...External Device 82...Internal device 91...Outside vehicle UWB effective range 92…In-car UWB effective range 101...First UWB module 102...Second UWB module 103...Third UWB module 104...4th UWB module AT…Authentication information DK...Key information DKO…Owner key information DKS…Share Key Information KF...Friend Key KN...Non-Friend Key KO…Owner key KS...Share Key PC: Control program

Claims

1. A vehicle capable of communicating with a plurality of devices that store information about the digital key, A locking means is provided, When a locking request is made to the vehicle through communication with the device, if the device that initiated the locking request is outside the vehicle and there is another device inside the vehicle that stores information about the digital key for the vehicle, The locking means checks the information of the other device and determines whether to lock the vehicle based on the checked information of the other device. vehicle.

2. Distance measurement is performed through communication with the device using UWB (Ultra Wideband), When the locking request is made while the other device storing information about the digital key of the vehicle is inside the vehicle, the locking means confirms through the distance measurement that the device that performed the communication that triggered the locking request is outside the vehicle. The vehicle of claim 1 .

3. Distance measurement is performed through communication with the device using UWB (Ultra Wideband), When the locking means confirms through the distance measurement that the device storing information about the digital key of the vehicle has moved away from the vehicle by a predetermined distance or more while the other device storing information about the digital key of the vehicle is inside the vehicle, The locking means checks the information of the other device and determines whether to lock the vehicle based on the checked information of the other device. The vehicle of claim 1 .

4. When an engine start is requested, the engine is started on the condition that the device storing information about the digital key of the vehicle is present in the vehicle; When the locking means locks the vehicle in accordance with the locking request while the other device storing information about the digital key of the vehicle is present in the vehicle, and then when a request to start the engine is made before the locking means unlocks the vehicle, the engine is not started even if the device storing information about the digital key of the vehicle is present in the vehicle. The vehicle of claim 1 .

5. The locking means verifies the owner of the device in the vehicle and the owner of the device that performed the communication that triggered the locking request, and determines not to lock the vehicle if the device belongs to a user different from the owner of the device that performed the communication that triggered the locking request and stores information about the digital key for the vehicle. The vehicle of claim 1 .

6. A specific device can be designated in advance from among the plurality of devices that store information about the digital key of the vehicle, When the locking request is made and the specific device is inside the vehicle, the locking means determines not to lock the vehicle. The vehicle of claim 1 .

7. A specific device can be designated in advance from among the plurality of devices that store information about the digital key of the vehicle, When the locking request is received, if there is a device other than the specific device among the plurality of devices that store information about the digital key of the vehicle in the vehicle, the locking means determines not to lock the vehicle. The vehicle of claim 1 .

8. the particular device is designated through the device; receiving information about the specific device transmitted from the device that specifies the specific device; The locking means determines whether the specific device is in the vehicle based on the received information about the specific device.

8. A vehicle according to claim 6 or claim 7.

9. A control method for controlling locking in a vehicle that has a locking unit and is capable of communicating with a plurality of devices that store information about a digital key, When a locking request is made to the vehicle through communication with the device, if the device that initiated the locking request is outside the vehicle and there is another device inside the vehicle that stores information about the digital key for the vehicle, a step of having the locking means confirm information about the other device; and causing the locking means to determine whether or not to lock the vehicle based on the confirmed information of the other device. Control method.

10. A control program executed by a vehicle locking unit that is capable of communicating with a plurality of devices that store information about a digital key, the control program comprising: When a locking request is made to the vehicle through communication with the device, if the device that initiated the locking request is outside the vehicle and there is another device inside the vehicle that stores information about the digital key for the vehicle, checking information of the other device; and determining whether to lock the vehicle based on the confirmed information of the other device. Control program.

11. a plurality of devices storing information about the digital keys; a vehicle capable of communicating with the plurality of devices; When a locking request is made to the vehicle through communication with the device, if the device that initiated the locking request is outside the vehicle and there is another device inside the vehicle that stores information about the digital key for the vehicle, Check the information of the other device; Determine whether to lock the vehicle based on the information of the other device that has been confirmed. Digital key system.

12. A specific device can be designated in advance from among the plurality of devices that store information about the digital key of the vehicle, When the locking request is made and the specific device is inside the vehicle, it is determined that the vehicle should not be locked. The digital key system according to claim 11.

13. A specific device can be designated in advance from among the plurality of devices that store information about the digital key of the vehicle, When the locking request is received, if there is a device other than the specific device among the plurality of devices storing information about the digital key of the vehicle in the vehicle, it is determined not to lock the vehicle. The digital key system according to claim 11.

14. The particular device is designated through the device 14. The digital key system according to claim 12 or 13.

Images