Electronic control device, control method for electronic control device, and program

Abstract

To appropriately obtain the effect of restricting functions against vehicle theft. [Solution] The electronic control device 6 includes a function restriction setting unit 17a that sets function restrictions against vehicle theft, a release possibility determination unit 17e that determines whether the function restrictions set by the function restriction setting unit can be released based on priority, and a function restriction release unit 17g that releases the function restrictions set by the function restriction setting unit on the condition that the release possibility determination unit has determined that the function restrictions can be released.

Description

[Technical Field]

[0001] The present invention relates to an electronic control unit, a function restriction management system, a function restriction management method, and a function restriction management program. [Background technology]

[0002] Anti-theft devices for preventing vehicle theft have been available for some time. For example, Patent Document 1 discloses a system that allows a vehicle to travel when the vehicle is located within a predetermined area such as a valet parking lot, and restricts the vehicle's travel when the vehicle is located outside the predetermined area, thereby preventing the vehicle from leaving the predetermined area. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2010-922 Summary of the Invention [Problem to be solved by the invention]

[0004] In recent years, there have been features that aim not only to prevent vehicle theft but also to mitigate damage if the vehicle is stolen, by setting functional restrictions when the vehicle is stolen and then releasing the functional restrictions when the theft is resolved. However, even if the owner of a stolen vehicle sets functional restrictions, if the thief who stole the vehicle can release the functional restrictions, the functional restrictions will not be effective against vehicle theft.

[0005] The present invention has been made in consideration of the above-mentioned circumstances, and its purpose is to provide an electronic control device, a function restriction management system, a function restriction management method, and a function restriction management program that can appropriately obtain the effect of function restrictions against vehicle theft. [Means for solving the problem]

[0006] According to the invention described in claim 1, a function restriction setting unit (17a) sets function restrictions against vehicle theft. A priority setting unit (17b) sets priorities based on operation types corresponding to function restriction setting or release operations. A priority holding unit (17c) holds the priorities set by the priority setting unit. A priority update unit (17d) updates the priorities when a current priority indicated by a function restriction setting request is higher than the priority held in the priority holding unit. A release possibility determination unit (17e) determines whether the function restriction set by the function restriction setting unit can be released based on the priorities. A function restriction release unit (17g) releases the function restriction set by the function restriction setting unit on the condition that the release possibility determination unit has determined that the function restriction can be released. The priority setting unit sets priorities based on any of operation types including an operation from an external device via communication over a communication network, an operation from an external device via short-range wireless communication or wired communication, and an operation from an operation input unit. The release possibility determination unit determines whether the function restriction set by the function restriction setting unit can be released by comparing the priority of a function restriction setting request for each operation type with the priority of a function restriction release request for each operation type.

[0007] Whether or not a function restriction can be released is determined based on a priority, and the function restriction is released only if it is determined that the function restriction can be released. By setting a priority for determining whether or not a function restriction can be released, it is possible to prevent a situation in which a thief who has stolen a vehicle can release a function restriction that was set by the owner of the stolen vehicle. This allows the effect of the function restriction against vehicle theft to be appropriately achieved. [Brief explanation of the drawings]

[0008] [Figure 1] Functional block diagram showing the overall configuration of the first embodiment [Figure 2] Functional block diagram of electronic control unit [Figure 3] A diagram showing routes corresponding to setting or canceling function restrictions [Figure 4] Diagram showing the relationship between priority and cancellation possibility [Figure 5] Flowchart showing function restriction setting processing via the first route [Figure 6] Flowchart showing function restriction setting processing via the first route [Figure 7] Flowchart showing function restriction setting processing via the first route [Figure 8] Flowchart showing function restriction setting processing via the first route [Figure 9] Flowchart showing function restriction setting processing via a second route [Figure 10] Flowchart showing function restriction setting processing via a second route [Figure 11] Flowchart showing function restriction setting processing via a second route [Figure 12] Flowchart showing function restriction setting processing via a second route [Figure 13] Flowchart showing function restriction setting processing via a third route [Figure 14] Flowchart showing function restriction setting processing via a third route [Figure 15] Flowchart showing function restriction release processing [Figure 16] A diagram showing the display transition associated with setting function restrictions via the first route [Figure 17] A diagram showing the display transition associated with setting function restrictions via the first route [Figure 18] A diagram showing the display transition associated with setting function restrictions via the first route [Figure 19] A diagram showing the display transition associated with setting function restrictions via the first route [Figure 20] A diagram showing the display transition when the function restriction is released via the first route [Figure 21] A diagram showing the display transition when the function restriction is released via the first route [Figure 22] A diagram showing the display transition when the function restriction is released via the first route [Figure 23] A diagram showing the display transition when the function restriction is released via the first route [Figure 24] A diagram showing the display transition associated with setting function restrictions via the second route [Figure 25] A diagram showing the display transition associated with setting function restrictions via the second route [Figure 26] A diagram showing the display transition associated with setting function restrictions via the second route [Figure 27] A diagram showing the display transition associated with setting function restrictions via the second route [Figure 28] A diagram showing the display transition when the function restriction is released via the second route [Figure 29] A diagram showing the display transition when the function restriction is released via the second route [Figure 30] A diagram showing the display transition when the function restriction is released via the second route [Figure 31] A diagram showing the display transition when the function restriction is released via the second route [Figure 32] A diagram showing the display transitions associated with setting function restrictions via the third route [Figure 33] A diagram showing the display transitions associated with setting function restrictions via the third route [Figure 34] A diagram showing the display transitions associated with setting function restrictions via the third route [Figure 35] A diagram showing the display transition when functional restrictions are released via the third route [Figure 36] A diagram showing the display transition when functional restrictions are released via the third route [Figure 37] A diagram showing the display transition when functional restrictions are released via the third route [Figure 38] 10 is a flowchart showing a function restriction release process according to the second embodiment; [Figure 39] 10 is a flowchart showing a function restriction release process according to a third embodiment; [Figure 40] Flowchart showing function restriction release processing DETAILED DESCRIPTION OF THE INVENTION

[0009] Hereinafter, several embodiments will be described with reference to the drawings. In the following embodiments, the description of parts that overlap with the preceding embodiments will be omitted. (First embodiment)

[0010] The first embodiment will be described with reference to Figures 1 to 37. A function restriction management system 1 mounted on a vehicle is configured so that a vehicle system 2 mounted on the vehicle and a server 3 can communicate data via a communication network 4. The vehicle system 2 is configured so that an in-vehicle communication device (hereinafter referred to as a DCM (Data Communication Module)) 5, electronic control units (hereinafter referred to as ECUs (Electronic Control Units)) 6 to 9, and an HMI (Human Machine Interface) control unit (hereinafter referred to as an HCU (HMI Control Unit)) 10 can communicate data via an in-vehicle network 11.

[0011] The in-vehicle network 11 is, for example, a CAN (Controller Area Network) (registered trademark). The in-vehicle network 11 may be FLEXRAY (registered trademark), CXPI (Clock Extension Peripheral Interface) (registered trademark), Ethernet (registered trademark), or the like. In this embodiment, a configuration in which four ECUs 6 to 9 are connected to the in-vehicle network 11 is illustrated as an example, but the number of ECUs connected to the in-vehicle network 11 is arbitrary. Furthermore, the number of in-vehicle networks 11 is also arbitrary.

[0012] The DCM 5 is wirelessly connected to the server 3 via the communication network 4, and is also wirelessly connected to an external device 15 (described later) without using the communication network 4. The ECU 6 is a device that controls the setting and release of functional restrictions against vehicle theft. Functions against vehicle theft are functions that would cause disadvantage to the owner of a stolen vehicle, such as functions related to driving, and functions related to charges for using paid services or downloading paid apps.

[0013] Setting a function restriction means enabling the relevant function restriction and prohibiting the use of all or part of the function. For example, if the relevant function is related to driving, it means prohibiting engine start or motor start or limiting the driving speed to a low speed. For example, if the relevant function is related to charges such as the use of paid services or the download of paid apps, it means prohibiting the use of paid services or the download of paid apps in whole or in part.

[0014] Lifting a function restriction means disabling the relevant function restriction and allowing the use of all or part of a function that was previously prohibited. For example, if the relevant function is related to driving, it means allowing the engine or motor to start or lifting restrictions on driving speed. For example, if the relevant function is related to charges such as the use of paid services or the download of paid apps, it means allowing the use of paid services or the download of paid apps in whole or in part.

[0015] That is, by setting the function restrictions on the stolen vehicle by the owner of the stolen vehicle, even if the thief attempts to start the engine or start the motor, the thief can prohibit the engine or motor from starting. Even if the thief attempts to use a paid service that requires payment or download a paid app, the use of the paid service or the download of the paid app can be prohibited. After the theft is resolved, the owner of the vehicle can cancel the function restrictions, allowing the vehicle owner to start the engine or motor, for example. The use of paid services and the download of paid apps can also be permitted. The ECU 6 is connected to a battery power supply (+B) supplied from the vehicle battery and can operate even when the vehicle power is off.

[0016] The other ECUs 7 to 9 are, for example, a device that controls a drive system, a device that controls an ADAS (Advanced Driving Assistant System), a device that controls a multimedia system, and the like.

[0017] The HCU 10 is connected to a center information display (CID) 12, a meter device 13, and a head-up display (HUD) 14. The CID 12 is located in front of the driver's seat and displays, for example, a map used for the navigation function, camera images from the parking assist function, audio information related to the audio, and air conditioning information related to the air conditioning. The meter device 13 is located in front of the driver's seat and includes various indicators that display vehicle speed, shift position, remaining fuel, warnings, etc. The HUD 14 projects information such as vehicle speed, shift position, and route guidance onto the windshield as a virtual image in front of the driver's seat. Like the ECU 6 described above, the HCU 10 is also connected to a battery power supply (+B) supplied from the vehicle battery and can operate even when the vehicle power supply is off.

[0018] The external device 15 is capable of data communication with the vehicle system 2 by wirelessly connecting to the DCM 5 via the communication network 4. The external device 15 is a portable information terminal such as a smartphone or a tablet terminal that can be carried by the occupant, and is a terminal that can be used by the occupant inside or outside the vehicle.

[0019] An operation input unit 16 that can be operated and input by a driver is connected to the HCU 10. The operation input unit 16 is, for example, a touch panel of the CID 12, a steering switch disposed on the steering wheel, or the like.

[0020] As shown in FIG. 2 , the ECU 6 includes a control unit 17 and a CAN communication unit 18. The control unit 17 is mainly configured as a microcomputer having a CPU (Central Processing Unit), ROM (Read Only Memory), RAM (Random Access Memory), I / O (Input / Output), etc. The functions provided by the control unit 17 can be provided by software recorded in a physical memory device and a computer that executes the software, software alone, hardware alone, or a combination thereof. For example, when the control unit 17 is provided by an electronic circuit that is hardware, the electronic circuit can be provided by a digital circuit including a large number of logic circuits or an analog circuit. When the control unit 17 executes a program stored in a non-transitory physical recording medium, processing corresponding to the control program is performed, and a method corresponding to the program is executed.

[0021] The CAN communication unit 18 controls transmission and reception of CAN signals to and from the in-vehicle network 11 .

[0022] The control unit 17 includes a function restriction setting unit 17a, a priority setting unit 17b, a priority holding unit 17c, a priority updating unit 17d, a release possibility determination unit 17e, a determination result notification unit 17f, and a function restriction release unit 17g. The units 17a to 17g constitute a function restriction management program.

[0023] The function restriction setting unit 17a sets function restrictions against vehicle theft. The functions to be restricted may be selectable in advance by the vehicle owner, or may be set in advance when the vehicle is shipped from the factory or sold. For example, when setting a function restriction related to driving, the function restriction setting unit 17a transmits a function restriction setting signal to the ECU that controls engine start, the ECU that controls motor start, the ECU that controls driving, etc., and prohibits engine start or motor start or limits the driving speed to a low speed as described above. The priority setting unit 17b sets a priority, which will be described later, based on the operation type corresponding to the operation to set or release the function restriction. The operation type will be described later.

[0024] When the priority is set by the priority setting unit 17b, the priority holding unit 17c holds the set priority as priority information. The priority update unit 17d updates the priority information held by the priority holding unit 17c. That is, when the priority information is updated by the priority update unit 17d, the priority holding unit 17 holds the updated priority information. Priorities will also be described later.

[0025] The release possibility determination unit 17e determines whether the function restriction set by the function restriction setting unit 17a can be released based on the priority according to the operation type stored in the priority storage unit 17c. When the release possibility determination unit 17e determines whether the function restriction can be released, the determination result notification unit 17f notifies the determination result.

[0026] When the release possibility determination unit 17e determines whether the function restriction should be released, the function restriction release unit 17g does not release the function restriction set by the function restriction setting unit 17a. When the release possibility determination unit 17e determines whether the function restriction should be released, the function restriction release unit 17g releases the function restriction set by the function restriction setting unit 17a. When releasing a function restriction related to driving, for example, the function restriction release unit 17g transmits a function restriction release signal to the ECU that controls engine start, the ECU that controls motor start, the ECU that controls driving, etc., and allows engine start or motor start or releases the limit on driving speed as described above.

[0027] The following describes operation types corresponding to the setting or canceling of function restrictions. As shown in FIG. 3, there are three types of operation corresponding to the setting or canceling of function restrictions: an operation via communication from the external device 15 through the communication network 4 (hereinafter, this may be referred to as an operation via a first route), an operation via short-range wireless communication from the external device 15 (hereinafter, this may be referred to as an operation via a second route), and an operation from the operation input unit 16 (hereinafter, this may be referred to as an operation via a third route). The short-range wireless communication is communication in which the external device 15 and the DCM 5 are directly connected wirelessly, such as Bluetooth (registered trademark) or Wi-Fi (registered trademark). If the DCM 5 is configured to be connectable via a wire, the second route may be communication in which the external device 15 and the DCM 5 are directly connected via a wired interface, such as a USB (Universal Serial Bus) interface. Each operation will be described below.

[0028] The operation via the first route is an operation in which the vehicle owner operates external device 15 to transmit a function restriction setting request or a function restriction release request from external device 15 to HCU 10 of vehicle system 2 via server 3. Since the function restriction setting request or function restriction release request is transmitted from external device 15 to HCU 10 via server 3, user authentication is performed in three stages: external device 15, server 3, and vehicle system 2. In this case, it is assumed that, for example, the vehicle owner notices that the vehicle has been stolen some time after getting out of the vehicle, and external device 15 is unable to communicate with DCM 5 via short-range wireless communication.

[0029] For example, if the owner of a vehicle leaves the parking spot after parking and returns to the parking spot only to find that the vehicle that should have been parked is not there, the owner operates the external device 15 to wirelessly connect to the server 3 and cause the external device 15 to transmit a function restriction setting request to the server 3. When the server 3 receives the function restriction setting request from the external device 15, the server 3 transmits the received function restriction setting request to the DCM 5 associated with the external device 15 that sent the function restriction setting request. When the DCM 5 receives the function restriction setting request from the server 3, the DCM 5 transmits the received function restriction setting request to the HCU 10. That is, in an operation to set a function restriction via the first route, the function restriction setting request is transmitted from the external device 15 to the HCU 10 via the server 3. The above describes the operation to set a function restriction. The operation to release a function restriction is similar. In an operation to release a function restriction via the first route, the function restriction release request is transmitted from the external device 15 to the HCU 10 via the server 3. The operation via the first route performs user authentication in three stages, and therefore has the highest authentication accuracy.

[0030] The operation via the second route is an operation in which the vehicle owner operates the external device 15 to cause a function restriction setting request or a function restriction release request to be sent from the external device 15 to the HCU 10 of the vehicle system 2 without going through the server 3. Since the function restriction setting request or the function restriction release request is sent from the external device 15 to the HCU 10 without going through the server 3, user authentication is performed in two stages: the external device 15 and the vehicle system 2. In this case, it is assumed that the vehicle is stolen immediately after the vehicle owner parks or gets out of the vehicle, and that the external device 15 is capable of short-range wireless communication with the DCM 5.

[0031] For example, if the owner of the vehicle is threatened after parking and has to get out of the vehicle, the owner operates the external device 15 to cause the external device 15 to send a function restriction setting request to the DCM 5. When the DCM 5 receives the function restriction setting request from the server 3, it transmits the received function restriction setting request to the HCU 10. That is, in the operation to set a function restriction via the second route, the function restriction setting request is sent from the external device 15 to the HCU 10 without going through the server 3. The operation to set a function restriction has been described above, but the operation to release a function restriction is similar. In the operation to release a function restriction via the second route, the function restriction release request is sent from the external device 15 to the HCU 10 without going through the server 3. The operation via the second route performs user authentication in two stages, and therefore has the second highest authentication accuracy after the operation via the first route. Note that, for example, the owner of the vehicle may perform the operation to set a function restriction via the second route and then the operation to set a function restriction via the first route. By performing an operation to set function restrictions via the second route and then performing an operation to set function restrictions via the first route, it is possible to increase the accuracy of authentication.

[0032] The operation via the third route is an operation in which the vehicle owner operates the operation input unit 16 to directly transmit a function restriction setting request or a function restriction release request from the operation input unit 16 to the HCU 10. Since the function restriction setting request or the function restriction release request is transmitted from the operation input unit 16 to the HCU 10, user authentication is performed at a single stage in the vehicle system 2. In this case, it is assumed that the vehicle is stolen before the owner gets out of the vehicle, and that the operation input unit 16 is operable.

[0033] For example, if the vehicle owner is threatened before getting off the vehicle, the vehicle owner operates the operation input unit 16 to send a function restriction setting request from the operation input unit 16 to the HCU 10. That is, the function restriction setting request is sent directly from the operation input unit 16 to the HCU 10. The above describes the operation for setting a function restriction, but the operation for releasing a function restriction is similar. In the operation for releasing a function restriction via the third route, the function restriction release request is sent directly from the operation input unit 16 to the HCU 10. The operation via the third route performs user authentication in one step, and therefore has the lowest level of authentication accuracy. Note that, for example, the vehicle owner may perform the operation for setting a function restriction via the third route, and then the operation for setting a function restriction via the first route or the operation for setting a function restriction via the second route. By performing the operation for setting a function restriction via the third route, and then the operation for setting a function restriction via the first route or the operation for setting a function restriction via the second route, the accuracy of authentication can be increased. Furthermore, for example, the owner of the vehicle may park the vehicle and operate the operation input unit 16 to send a function restriction setting request from the operation input unit 16 to the HCU 10 before getting out of the vehicle, not just in cases where the owner has been threatened, as a preventive safety measure.

[0034] As described above, the priority setting unit 17b acquires information about the routes of the function restriction setting requests and function restriction release requests from the HCU 10, because the function restriction setting requests and function restriction release requests are aggregated to the HCU 10 regardless of the route. After acquiring the route-related information from the HCU 10, the priority setting unit 17b sets priorities for three routes corresponding to the function restriction setting or release operations. The priority setting unit 17b sets the priority of the first route to "1," the priority of the second route to "2," and the priority of the third route to "3." Here, the smaller the priority number, the higher the priority and the higher the priority should be, and the larger the priority number, the lower the priority and the lower the priority should be. Once the priorities are set by the priority setting unit 17b in this manner, the priority holding unit 17c holds the set priorities as priority information.

[0035] 4, the release possibility determination unit 17e determines whether or not the function restriction can be released by comparing the priority of the function restriction release request with the priority of the function restriction setting request for the function restriction setting request. When the release possibility determination unit 17e determines that the priority of the function restriction release request is higher than the priority of the function restriction setting request or that the priority of the function restriction release request matches the priority of the function restriction setting request, it determines whether or not the function restriction can be released. On the other hand, when it determines that the priority of the function restriction release request is lower than the priority of the function restriction setting request, it determines whether or not the function restriction can be released.

[0036] For example, if the function restriction setting request is the first route and the function restriction release request is the first route, the release possibility determination unit 17e determines that the priority of the function restriction release request matches the priority of the function restriction setting request, and specifies whether the function restriction set by the first route can be released. On the other hand, if the function restriction setting request is the first route and the function restriction release request is the second or third route, the release possibility determination unit 17e determines that the priority of the function restriction release request is lower than the priority of the function restriction setting request, and specifies whether the function restriction set by the first route can be released. In other words, if the owner of a stolen vehicle sets a function restriction by the first route, the function restriction will not be released even if the thief who stole the vehicle attempts to release the function restriction by the third route.

[0037] For example, if the function restriction setting request is via the second route and the function restriction release request is via the first or second route, the release possibility determination unit 17e determines that the priority of the function restriction release request is higher than the priority of the function restriction setting request or that the priority of the function restriction release request matches the priority of the function restriction setting request, and specifies whether the function restriction set via the second route can be released. On the other hand, if the function restriction setting request is via the second route and the function restriction release request is via the third route, the release possibility determination unit 17e determines that the priority of the function restriction release request is lower than the priority of the function restriction setting request, and specifies whether the function restriction set via the second route can be released. In other words, if the owner of a stolen vehicle sets a function restriction via the second route, the function restriction will not be released even if the thief who stole the vehicle attempts to release the function restriction via the third route.

[0038] In this way, the owner of a stolen vehicle can operate the external device 15 to set the function restriction via the first route or the second route, so that even if the theft victim operates the operation input unit 16 to release the function restriction via the third route, the function restriction can continue to be set without releasing the function restriction, thereby minimizing damage caused by the theft. Furthermore, after the theft is resolved, the owner of the vehicle can release the function restriction via the first route or the second route by operating the external device 15.

[0039] Next, the operation of the above-described configuration will be described with reference to Fig. 5 to Fig. 37. Here, the function restriction setting process according to the first route, the function restriction setting process according to the second route, the function restriction setting process according to the third route, and the function restriction release process will be described in order.

[0040] (1-1) Function restriction setting process via the first route (see Figures 5 to 8) The external device 15, the server 3, and the vehicle system 2 cooperate to perform a function restriction setting process according to the first route. When the vehicle owner activates an application for setting function restrictions on the external device 15, the external device 15 activates the application for setting function restrictions (S1), displays a password entry screen, for example, and waits for the password entry operation. When the vehicle owner enters the password, the external device 15 transmits authentication information required for user authentication, including the password entered by the vehicle owner, to the server 3 (S2).

[0041] When the server 3 receives authentication information from the external device 15, it compares the received authentication information with pre-registered registration information and determines whether the authentication is successful (S3). When the server 3 determines that the authentication information does not match the registration information and determines that the authentication has failed (S3: NO), it transmits authentication failure information indicating that the authentication has failed and the reason for the authentication failure to the external device 15 (S4). When the external device 15 receives the authentication failure information from the server 3, it displays that the authentication has failed and the reason for the authentication failure (S5).

[0042] The external device 15 determines whether to retry user authentication (S6). If it is determined that the vehicle owner has performed an operation on the external device 15 that does not retry user authentication, or that the vehicle owner has not performed an operation and the time has expired (S6: NO), the application that sets the function restriction is terminated, and the function restriction setting process via the first route is terminated.

[0043] If it is determined that the vehicle owner has performed an operation to retry user authentication on the external device 15 (S6: YES), the process returns to step S2, and the external device 15 displays, for example, a password input screen again and waits for the password input operation again. When the vehicle owner performs the password input operation again, the external device 15 repeats step S3 and subsequent steps. Note that the number of times user authentication is retried may be limited, and when the number of user authentication retries exceeds a predetermined number, the external device 15 may forcibly terminate the application that sets the function restriction and forcibly terminate the function restriction setting process by the first route.

[0044] When the server 3 determines that the authentication information matches the registration information and determines that the authentication has been successful (S3: YES), it transmits authentication success information indicating that the authentication has been successful to the external device 15 (S7).

[0045] When the external device 15 receives the authentication success information from the server 3, it displays a message that the authentication has been successful (S8). The external device 15 displays a function restriction setting screen and waits for a function restriction setting operation (S9). When the vehicle owner performs a function restriction setting operation, the external device 15 accepts the function restriction setting by the vehicle owner's setting operation (S10), and transmits a function restriction setting request indicating the accepted function restriction setting to the server 3 (S11).

[0046] The external device 15 determines whether the transmission of the function restriction setting request to the server 3 was successful (S12). If the external device 15 determines that the transmission of the function restriction setting request to the server 3 failed (S12: NO), for example, by determining that a timeout has occurred without receiving a response confirmation for the function restriction setting request from the server 3, the external device 15 displays a message that the transmission of the function restriction setting request failed (S13), terminates the application that sets the function restrictions, and terminates the function restriction setting process via the first route.

[0047] Furthermore, the external device 15 determines whether to retry sending the function restriction setting request to the server 3, and if it determines that the vehicle owner has performed an operation on the external device 15 that does not retry sending the function restriction setting request to the server 3, or that the vehicle owner has timed out without performing any operation, it may terminate the app that sets the function restrictions and end the function restriction setting process via the first route.

[0048] If it is determined that the vehicle owner has performed an operation on the external device 15 to retry sending the function restriction setting request to the server 3, the process may return to step S9 and repeat step S9 and subsequent steps. Alternatively, the number of retries may be limited, and if the number of retries exceeds a predetermined number, the external device 15 may forcibly terminate the application that sets the function restrictions and forcibly terminate the function restriction setting process via the first route.

[0049] For example, when the external device 15 determines that it has received a response confirmation of the function restriction setting request from the server 3 and determines that the transmission of the function restriction setting request to the server 3 was successful (S12: YES), it displays that the transmission of the function restriction setting request was successful.

[0050] When the server 3 receives a function restriction setting request from the external device 15, it transmits the received function restriction setting request to the DCM 5 associated with the external device 15 (S14). The server 3 determines whether the transmission of the function restriction setting request to the DCM 5 was successful (S15). If the server 3 determines that the transmission of the function restriction setting request to the DCM 5 failed (S15: NO), for example, by determining that a timeout has occurred without receiving a response confirmation for the function restriction setting request from the DCM 5, it transmits a transmission failure notice indicating a failure in the transmission of the function restriction setting request to the external device 15.

[0051] When the external device 15 receives the transmission failure notification from the server 3, it displays that the transmission of the function restriction setting request has failed (S16), terminates the application for setting the function restrictions, and terminates the function restriction setting process via the first route. Note that the external device 15 may determine whether to retry transmission of the function restriction setting request from the server 3 to the DCM 5, and if it determines that the vehicle owner has performed an operation in the external device 15 not to retry transmission of the function restriction setting request from the server 3 to the DCM 5, or that the vehicle owner has not performed an operation and a timeout has occurred, it may terminate the application for setting the function restrictions and terminate the function restriction setting process via the first route.

[0052] If it is determined that the vehicle owner has performed an operation in the external device 15 to retry transmission of the function restriction setting request from the server 3 to the DCM 5, the process may return to step S11 and repeat step S11 and subsequent steps. Alternatively, the number of retries may be limited, and when the number of retries exceeds a predetermined number, the external device 15 may forcibly terminate the application that sets the function restrictions and forcibly terminate the function restriction setting process via the first route.

[0053] For example, when the server 3 determines that it has received a response confirmation of the function restriction setting request from the DCM 5 and determines that the transmission of the function restriction setting request to the DCM 5 was successful (S15: YES), it transmits a transmission success notification indicating that the transmission of the function restriction setting request was successful to the external device 15. When the external device 15 receives the transmission success notification from the server 3, it displays that the transmission of the function restriction setting request was successful (S17).

[0054] When the DCM 5 receives a function restriction setting request from the server 3, the DCM 5 transmits the received function restriction setting request to the HCU 10. When the HCU 10 receives a function restriction setting request from the DCM 5, the HCU 10 transmits the received function restriction setting request to the ECU 6.

[0055] When the ECU 6 receives the function restriction setting request from the HCU 10, the ECU 6 determines whether or not it holds priority information at that time (S18). If the ECU 6 determines that it does not hold priority information (S18: NO), it sets function restrictions based on the received function restriction setting request (S19, which corresponds to the function restriction setting procedure), and determines whether or not the function restriction setting has been successful (S20).

[0056] For example, after transmitting a function restriction setting signal to the corresponding ECU, the ECU 6 determines that a timeout has occurred without receiving a response signal to the function restriction setting signal from the ECU, and when it determines that the function restriction setting has failed (S20: NO), it transmits a setting failure notice indicating that the function restriction setting has failed to the external device 15. When the external device 15 receives the setting failure notice from the ECU, it displays that the function restriction setting has failed (S21), terminates the application that sets the function restriction, and terminates the function restriction setting process via the first route.

[0057] For example, after transmitting a function restriction setting signal to the corresponding ECU, the ECU 6 determines that a response signal to the function restriction setting signal has been received from the ECU, and when it determines that the function restriction setting has been successful (S20: YES), it transmits a setting success notice indicating that the function restriction setting has been successful to the external device 15. When the external device 15 receives the setting success notice from the ECU, it displays that the function restriction setting has been successful (S22).

[0058] The ECU 6 determines the route of the function restriction setting request. If the ECU 6 determines that the function restriction setting request is the first route (S23: YES), it sets the priority information to "1" (S24). If the ECU 6 determines that the function restriction setting request is the second route (S25: YES), it sets the priority information to "2" (S26). If the ECU 6 determines that the function restriction setting request is the third route (S27: YES), it sets the priority information to "3" (S28).

[0059] When the ECU 6 sets the priority information, it transmits a priority setting notification indicating that the priority information has been set to the HCU 10, and also causes the DCM 5 to transmit it to the server 3. When the HCU 10 receives the priority setting notification from the ECU 6, it causes the CID 12 and the meter device 13 to display that the priority information has been set (S29). When the server 3 receives the priority setting notification from the DCM 5, it causes the received priority setting notification to be transmitted to the external device 15 (S30). When the external device 15 receives the priority setting notification from the server 3, it displays that the priority information has been set (S31), and ends the function restriction setting process via the first route.

[0060] On the other hand, if the ECU 6 determines that it holds priority information (S18: YES), it identifies the route of the function restriction setting request (S32), sets the priority of the identified route of the function restriction setting request as the current priority, and compares the current priority with the priority of the held priority information (S33). If the ECU 6 determines that the current priority is higher than the priority of the priority information (S33: YES), it updates the priority information to the current priority (S34), and performs step S29 and subsequent steps. If the ECU 6 determines that the current priority matches the priority of the priority information or that the current priority is lower than the priority of the priority information (S33: NO), it does not update the priority information to the current priority, and performs step S29 and subsequent steps.

[0061] (1-2) Function restriction setting process via the second route (see Figures 9 to 12) The external device 15 and the vehicle system 2 cooperate to perform the function restriction setting process via the second route. When the vehicle owner performs an operation to start an application for setting function restrictions on the external device 15, the external device 15 starts the application for setting function restrictions (S41), displays, for example, a password input screen, and waits for the password input operation. When the vehicle owner performs an operation to input the password, the external device 15 transmits authentication information required for user authentication, including the password input by the vehicle owner, to the DCM 5 (S42).

[0062] When the DCM 5 receives authentication information from the external device 15, it transmits the received authentication information to the HCU 10. When the HCU 10 receives the authentication information from the DCM 5, it compares the received authentication information with pre-registered registration information and determines whether the authentication is successful (S43). When the HCU 10 determines that the authentication information does not match the registration information and determines that the authentication has failed (S43: NO), it transmits authentication failure information to the DCM 5 indicating that the authentication has failed and indicating the reason for the authentication failure. When the DCM 5 receives the authentication failure information from the HCU 10, it transmits the received authentication failure information to the external device 15 (S44). When the external device 15 receives the authentication failure information from the DCM 5, it displays that the authentication has failed and the reason for the authentication failure (S45).

[0063] In this case, the external device 15 also determines whether to retry user authentication (S46). If it is determined that the vehicle owner has performed an operation on the external device 15 not to retry user authentication, or that the vehicle owner has not performed an operation and the time has expired (S46: NO), the application for setting function restrictions is terminated, and the function restriction setting process via the second route is terminated.

[0064] If it is determined that the vehicle owner has performed an operation to retry user authentication on the external device 15 (S46: YES), for example, the external device 15 displays the password input screen again and waits for the password input operation again. When the vehicle owner performs the password input operation again, the external device 15 returns to step S42 and repeats step S42 and subsequent steps. Note that the number of times user authentication is retried may be limited, and when the number of user authentication retries exceeds a predetermined number, the external device 15 may forcibly terminate the application that sets the function restriction and forcibly terminate the function restriction setting process by the second route.

[0065] When the HCU 10 determines that the authentication information matches the registration information and determines that the authentication has been successful (S43: YES), it transmits authentication success information indicating that the authentication has been successful to the DCM 5 (S47). When the DCM 5 receives the authentication success information from the HCU 10, it transmits the received authentication success information to the external device 15.

[0066] When the external device 15 receives the authentication success information from the DCM 5, it displays a message that the authentication has been successful (S48), displays a function restriction setting screen, and waits for a function restriction setting operation (S49).

[0067] When the vehicle owner performs a function restriction setting operation, the external device 15 accepts the function restriction setting by the setting operation from the vehicle owner (S50), and transmits a function restriction setting request indicating the accepted function restriction setting to the DCM 5 (S51).

[0068] The external device 15 determines whether the transmission of the function restriction setting request to the DCM 5 was successful (S52). If the external device 15 determines that the transmission of the function restriction setting request to the DCM 5 failed (S52: NO), it displays a message that the transmission of the function restriction setting request failed (S53), terminates the application that sets the function restrictions, and terminates the function restriction setting process via the second route. Note that the external device 15 may also determine whether to retry the transmission of the function restriction setting request to the DCM 5, and if it determines that the vehicle owner has performed an operation on the external device 15 that does not retry the transmission of the function restriction setting request to the DCM 5, or that a timeout has occurred without the vehicle owner performing any operation, it may terminate the application that sets the function restrictions and terminate the function restriction setting process via the second route.

[0069] If it is determined that the vehicle owner has performed an operation on the external device 15 to retry sending the function restriction setting request to the DCM 5, the process may return to step S51 and repeat step S51 and subsequent steps. Alternatively, the number of retries may be limited, and if the number of retries exceeds a predetermined number, the external device 15 may forcibly terminate the application that sets the function restrictions and forcibly terminate the function restriction setting process via the second route.

[0070] When the external device 15 determines that the transmission of the function restriction setting request to the DCM 5 has been successful (S52: YES), it displays a message indicating that the transmission of the function restriction setting request has been successful. After this, steps S55 to S65 are performed in the same manner as steps S18 to S28 described in the function restriction setting process via the first route.

[0071] When the priority information is set, the ECU 6 transmits a priority setting notification indicating that the priority information has been set to the HCU 10, and also causes the DCM 5 to transmit the notification to the external device 15. When the HCU 10 receives the priority setting notification from the ECU 6, it causes the CID 12 and the meter device 13 to display that the priority information has been set (S66). When the external device 15 receives the priority setting notification from the DCM 5, it displays that the priority information has been set (S67), and ends the function restriction setting process via the second route.

[0072] When it is determined that the priority information is held (S55: YES), the ECU 6 performs steps S68 to S70 in the same manner as steps S32 to S34 described in the function restriction setting process according to the first route.

[0073] (1-3) Function restriction setting process via the third route (see Figures 13 and 14) The vehicle system 2 independently performs the function restriction setting process via the third route. When the operation input unit 16 accepts the setting of a function restriction through a setting operation from the vehicle owner (S71), it transmits a function restriction setting request indicating the accepted function restriction setting to the HCU 10. When the HCU 10 receives the function restriction setting request from the operation input unit 16, it transmits the received function restriction setting request to the ECU 6. After this, steps S72 to S82 are performed in the same manner as steps S18 to S28 described in the function restriction setting process via the first route above. In this case, when the ECU 6 determines that the function restriction setting has failed (S74: NO), it transmits a setting failure notice indicating that the function restriction setting has failed to the HCU 10. When the HCU 10 receives the setting failure notice from the ECU, it displays on the CID 12 and the meter device 13 that the function restriction setting has failed (S75). When the ECU 6 determines that the setting of the function restriction has been successful (S74: YES), it transmits a setting success notification indicating that the setting of the function restriction has been successful to the HCU 10. When the HCU 10 receives the setting success notification from the ECU, it displays on the CID 12 and the meter device 13 that the setting of the function restriction has been successful (S76).

[0074] When the ECU 6 sets the priority information, it transmits a priority setting notification indicating that the priority information has been set to the HCU 10. When the HCU 10 receives the priority setting notification from the ECU 6, it causes the CID 12 and the meter device 13 to display that the priority information has been set (S83), and ends the function restriction setting process via the third route.

[0075] When it is determined that the priority information is held (S72: YES), the ECU 6 performs steps S84 to S86 in the same manner as steps S32 to S34 described in the function restriction setting process according to the first route.

[0076] (1-4) Function restriction release process (see Figure 15) The ECU 6 identifies the route of the function restriction release request (S91) and compares the priority of the identified route of the function restriction release request with the priority of the route of the function restriction setting request (S92, S93, corresponding to the release possibility determination step). If the ECU 6 determines that the priority of the route of the function restriction release request is higher than the priority of the route of the function restriction setting request (S92: YES), or if the ECU 6 determines that the priority of the route of the function restriction release request matches the priority of the route of the function restriction setting request (S93: YES), the ECU 6 releases the function restriction (S94, corresponding to the function restriction release step). The ECU 6 deletes the priority information (S95) and saves history information indicating that the function restriction has been released (S96).

[0077] The ECU 6 determines whether the DCM 5 can be wirelessly connected to the server 3 (S97). If the ECU 6 determines that the DCM 5 can be wirelessly connected to the server 3 (S97: YES), the ECU 6 wirelessly connects the DCM 5 to the server 3, causes the DCM 5 to transmit history information to the server 3 (S98), and ends the function restriction release process.

[0078] On the other hand, if ECU 6 determines that the priority of the route of the function restriction release request is lower than the priority of the route of the function restriction setting request (S92: NO, S93: NO), it does not release the function restriction, does not delete the priority information, and ends the function restriction release process. By comparing the priority of the route of the function restriction release request with the priority of the route of the function restriction setting request in this way, even if, for example, the owner of a stolen vehicle operates external device 15 to set function restriction using the first or second route, and then the thief who stole the vehicle operates operation input unit 16 to release function restriction using the third route, the function restriction setting continues without being released.

[0079] Next, the transition of the display will be described with reference to Fig. 16 to Fig. 37. Here, the transition of the display accompanying the setting of function restrictions by each route and the transition of the display accompanying the release of function restrictions will be described.

[0080] (1) Display transitions associated with setting function restrictions via the first route (see Figures 16 to 19) The external device 15 waits for the user to input an ID and password while displaying the login screen, and performs authentication when it receives the input of the ID and password. If authentication fails, the external device 15 displays a message saying "ID or password is incorrect." If the external device 15 cannot connect wirelessly to the server 3, it displays a message saying "Cannot connect wirelessly to the server. Please check your communication environment."

[0081] If the authentication is successful, the external device 15 displays a main menu screen, and when the function restriction management application is launched, the external device 15 displays a message saying "Do you want to set function restrictions?" and waits for an operation input. When the "YES" button is pressed, the external device 15 receives an operation input to set function restrictions, and displays a message saying "Setting function restrictions."

[0082] If the external device 15 fails to set the function restrictions due to an inability to connect wirelessly with the server 3, it displays a message saying "Failed to connect wirelessly with the server. Failed to set the function restrictions." If the external device 15 fails to set the function restrictions due to an inability to connect wirelessly between the server 3 and the DCM 5, it displays a message saying "Failed to connect wirelessly with the DCM. Failed to set the function restrictions." If the external device 15 fails to set the function restrictions due to an access error to the HCU 10 in the vehicle system 2, it displays a message saying "An error has occurred in the vehicle system. Failed to set the function restrictions." If the external device 15 fails to set the function restrictions because the function restrictions have already been set, it displays a message saying "Function restrictions have already been set."

[0083] If the external device 15 successfully sets the function restriction, it displays a message saying, "Function restriction has been set. If you want to cancel the function restriction, please perform the cancel operation." The HCU 10 also displays a message on the CID 12 saying, "A registered terminal has instructed you to set a function restriction. The function restriction has been set." For example, if a function restriction on the navigation function is set, the HCU 10 changes the navigation screen from a normal display to a grayed-out display, or if an icon indicating the function for which the function restriction has been set is displayed, it erases the icon. If a speed restriction is set, the HCU 10 displays a message saying, "The speed has been limited to XX km / h." Note that, for example, if a map screen is displayed while driving, graying out the map screen may affect driving, so the HCU 10 sets function restrictions for destination setting, route guidance, viewing registered addresses, etc. However, the map screen may continue to be displayed without setting a function restriction on the display of the map screen.

[0084] (2) Display transitions following the release of function restrictions via the first route (see Figures 20 to 23) The external device 15 waits for the user to input an ID and password while displaying the login screen, and performs authentication when it receives the input of the ID and password. If the authentication fails, the external device 15 displays the message "ID or password is incorrect," and if it cannot connect wirelessly to the server 3, it displays the message "Cannot connect wirelessly to the server. Please check your communication environment."

[0085] If the authentication is successful, the external device 15 displays a main menu screen, and when the function restriction management application is launched, the external device 15 displays a message saying "Do you want to release the function restriction?" and waits for an operation input. When the external device 15 receives an operation input to release the function restriction by pressing the "YES" button, it displays a message saying "Removing the function restriction."

[0086] If the external device 15 fails to remove the function restriction due to an inability to connect wirelessly with the server 3, it displays a message saying "Unable to connect wirelessly with the server. Unlocking of function restriction has failed." If the external device 15 fails to remove the function restriction due to an inability to connect wirelessly between the server 3 and the DCM 5, it displays a message saying "Unable to connect wirelessly with the DCM. Unlocking of function restriction has failed." If the external device 15 fails to remove the function restriction due to an access error to the HCU 10 in the vehicle system 2, it displays a message saying "An error has occurred in the vehicle system. Unlocking of function restriction has failed." If the external device 15 fails to remove the function restriction because the function restriction has already been removed, it displays a message saying "The function restriction has been removed."

[0087] When the external device 15 has successfully released the function restriction, it displays the message "The function restriction has been released. If you want to set the function restriction, please perform the setting operation." In addition, the HCU 10 displays the message "A registered terminal has instructed to release the function restriction. The function restriction has been released" on the CID 12, and, for example, when the function restriction on the navigation function has been released, it returns the navigation screen from a grayed-out display to a normal display, when an icon indicating the function for which the function restriction has been released has been erased, it displays the icon, and when the driving speed restriction has been released, it displays the message "The driving speed restriction has been released."

[0088] (3) Display transitions associated with setting function restrictions via the second route (see Figures 24 to 27) In this case, the part related to the server 3 is omitted from the explanation of "(1) Transition of display accompanying setting of function restriction by the first route" above, but the rest is the same.

[0089] (4) Display transitions associated with the release of function restrictions via the second route (see Figures 28 to 31) In this case, the part related to the server 3 is omitted from the explanation of "(2) Transition of display when functional restriction is released via the first route" above, but the rest is the same.

[0090] (5) Display transitions associated with setting function restrictions via the third route (see Figures 32 to 34) The HCU10 displays the message "Do you want to set function restrictions?" on the CID12 and waits for an operation input from the operation input unit 16. When the "YES" button is pressed and the operation input unit 16 accepts an operation input to set function restrictions, the HCU10 displays the message "Setting function restrictions" on the CID12.

[0091] If the HCU10 fails to set the function restrictions due to an access error to the HCU10 in the vehicle system 2, it displays the message "An error has occurred in the vehicle system. Setting of function restrictions has failed" on the CID 12. If the HCU10 fails to set the function restrictions because the function restrictions have already been set, it displays the message "Function restrictions have already been set" on the CID 12.

[0092] When the HCU10 has successfully set the function restriction, it displays the message "Function restriction has been set. If you want to cancel the function restriction, please perform the cancel operation" on the CID 12. In this case, as in the above-mentioned "(1) Display transition accompanying setting of function restriction by the first route," for example, when a function restriction on the navigation function is set, the HCU10 changes the navigation screen from a normal display to a grayed-out display, when an icon indicating the function for which the function restriction has been set is displayed, it erases the icon, and when a driving speed limit is set, it displays the message "Driving speed has been limited to XX km / h."

[0093] (6) Display transitions associated with setting function restrictions via the third route (see Figures 35 to 37) The HCU10 displays the message "Do you want to release the function restriction?" on the CID12 and waits for an operation input from the operation input unit 16. When the "YES" button is pressed and the operation input unit 16 receives an operation input indicating that the function restriction is to be released, the HCU10 displays the message "Removing the function restriction" on the CID12.

[0094] If the HCU10 fails to release the function restriction due to an access error to the HCU10 in the vehicle system 2, it displays the message "An error occurred in the vehicle system. Release of function restriction failed" on the CID 12. If the HCU10 fails to release the function restriction because the function restriction has already been released, it displays the message "The function restriction has been released" on the CID 12.

[0095] When the HCU10 has successfully released the function restriction, it displays the message "Function restriction has been released. If you want to set a function restriction, please perform the setting operation" on the CID 12. In this case, the HCU10 may, for example, return the navigation screen from a grayed-out display to a normal display when the function restriction on the navigation function has been released, display the icon indicating the function for which the function restriction has been released if the icon has been erased, or display the message "Speed ​​restriction has been released" when the driving speed restriction has been released.

[0096] The ECU 6 may store the date and time when a function restriction is set or released as history information in association with the route, and may display the history information on the external terminal 15, CID 12, etc. Alternatively, the display outside the vehicle and the display inside the vehicle, i.e., the display on the external terminal 15 and the display on CID 12, etc., may be synchronized. For example, when a function restriction is set or released via the first or second route by operating the external terminal 15, the CID 12, etc. may be notified of the setting or release. Alternatively, when a function restriction is set or released via the third route by operating the operation input unit 16, the external terminal 15 may be notified of the setting or release. It may also be possible to select whether or not to synchronize the display on the external terminal 15 and the CID 12, etc. The setting or release of a function restriction may be notified in any manner. Instead of or in addition to the display on the external terminal 15 and CID 12, an indicator on the meter device 13 may be displayed. Alternatively, instead of or in addition to a visual notification, an audio notification may be used.

[0097] According to the first embodiment described above, the following advantageous effects can be obtained. The ECU 6 determines whether or not a function restriction can be released based on a priority, and releases the function restriction only if it is determined that the function restriction can be released. By setting a priority for determining whether or not a function restriction can be released, it is possible to prevent a situation in which a thief who has stolen a vehicle can release a function restriction set by the owner of the stolen vehicle. This makes it possible to appropriately obtain the effect of the function restriction against vehicle theft.

[0098] A priority is set based on the operation type corresponding to the operation for setting or releasing the function restriction, and whether or not the function restriction can be released is determined based on the priority according to the operation type. By associating the operation type with the priority, it is possible to determine whether or not the function restriction can be released by determining the operation type.

[0099] Priorities are set by setting an operation from external device 15 via communication over communication network 4 as a first route, an operation from external device 15 via short-range wireless communication as a second route, and an operation from operation input unit 16 as a third route. Whether the function restriction is to be released can be determined by determining whether the route is the first, second, or third route.

[0100] For example, by setting a function restriction through the setting operation of the setting restriction via the second route and then setting a function restriction through the setting operation of the setting restriction via the first route, the accuracy of authentication can be increased, and a situation in which a thief who has stolen a vehicle can disable the function restriction can be more appropriately prevented.

[0101] Whether or not to release the function restriction is determined by comparing the priority of the function restriction setting request for each route with the priority of the function restriction release request for each route. By assigning the priority of the function restriction setting request for each route and the priority of the function restriction setting request, it is possible to determine whether or not to release the function restriction.

[0102] When the priority of the function restriction release request is higher than the priority of the function restriction setting request, or when the priority of the function restriction release request and the priority of the function restriction setting request match, it is determined that the function restriction can be released, and when the priority of the function restriction release request is lower than the priority of the function restriction setting request, it is determined that the function restriction can be released or not. For example, if the owner of a stolen vehicle sets a function restriction using the first or second route, even if the thief who stole the vehicle attempts to release the function restriction using the third route, the effect of the function restriction can be appropriately obtained by not releasing the function restriction.

[0103] (Second embodiment) The second embodiment will be described with reference to Fig. 38. The second embodiment differs from the first embodiment in that additional authentication is performed even when the priority of the route of the function restriction release request is lower than the priority of the route of the function restriction setting request.

[0104] (2-1) Function restriction release process (see Figure 38) When the ECU 6 determines that the priority of the route of the function restriction release request is lower than the priority of the route of the function restriction setting request (S92: NO, S93: NO), it determines whether or not additional authentication, for example, by password input, is required (S101). When the ECU 6 determines that additional authentication is not required (S101: NO), it terminates the function restriction release process. When the ECU 6 determines that additional authentication is required (S101: YES), it determines whether or not the additional authentication was successful (S102). When the ECU 6 determines that the additional authentication was unsuccessful (S102: NO), it terminates the function restriction release process. When the ECU 6 determines that the additional authentication was successful (S102: YES), it performs step S94 and subsequent steps.

[0105] That is, even if the priority of the route of the function restriction release request is lower than the priority of the route of the function restriction setting request, if the ECU 6 determines that the additional authentication is successful, the ECU 6 releases the function restriction in the same way as when it determines that the priority of the route of the function restriction release request is higher than the priority of the route of the function restriction setting request or that the priority of the route of the function restriction release request matches the priority of the route of the function restriction setting request. Note that the additional authentication may be, for example, a one-time password or the like.

[0106] According to the second embodiment described above, the following advantageous effects can be obtained. In the ECU 6, even if the priority of the route of the function restriction release request is lower than the priority of the route of the function restriction setting request, the function restriction is released on the condition that the additional authentication is successful. For example, even if there is a request to release the function restriction from a route with a low priority due to a mistake on the part of the vehicle owner, the function restriction can be released if the additional authentication is successful.

[0107] (Third embodiment) The third embodiment will be described with reference to Figures 39 and 40. The third embodiment differs from the first embodiment in that additional authentication is performed when the route priority of the function restriction setting request is "3".

[0108] (3-1) Function restriction release process (see Figures 39 and 40) When the ECU 6 determines that the priority of the route of the function restriction release request is higher than the priority of the route of the function restriction setting request (S92: YES), or when the ECU 6 determines that the priority of the route of the function restriction release request matches the priority of the route of the function restriction setting request (S93: YES), the ECU 6 determines whether the priority of the route of the function restriction setting request is "3" (S201). When the ECU 6 determines that the priority of the route of the function restriction setting request is not "3" (S201: NO), the ECU 6 performs step S94 and subsequent steps.

[0109] When the ECU 6 determines that the priority of the route of the function restriction setting request is "3" (S201: YES), it determines whether or not additional authentication, such as password entry, is required (S202). When the ECU 6 determines that additional authentication is not required (S202: NO), it releases the function restriction in a limited manner (S204) and terminates the function restriction release process. Release of the function restriction in a limited manner means releasing the function restriction and then re-setting it a certain time later, releasing the function restriction and then re-setting it after the number of times the corresponding function has been used reaches a predetermined number of times, or releasing part of the function restriction, for example, releasing the function restriction not related to driving while not releasing the function restriction related to driving.

[0110] If the ECU 6 determines that additional authentication is necessary (S202: YES), it determines whether the additional authentication was successful (S203). If the ECU 6 determines that the additional authentication was unsuccessful (S203: NO), it also releases the function restriction in a limited manner (S204) and ends the function restriction release process. If the ECU 6 determines that the additional authentication was successful (S203: YES), it performs step S94 and subsequent steps.

[0111] That is, when the priority of the route of the function restriction release request is higher than the priority of the route of the function restriction setting request, or when the priority of the route of the function restriction release request matches the priority of the route of the function restriction setting request and the priority of the route of the function restriction setting request is "3," the ECU 6 releases the function restriction in a limited manner if it determines that additional authentication is not necessary or that additional authentication is necessary but failed, and releases the function restriction without any limited conditions if it determines that the additional authentication was successful. Note that in this case as well, the additional authentication may be a one-time password or the like.

[0112] According to the third embodiment described above, the following advantageous effects can be obtained. When the ECU 6 releases a function restriction through an operation from the operation input unit 16, the function restriction is released on the condition that the additional authentication is successful. By adding the additional authentication, it is possible to prevent a situation in which a function restriction set through a setting operation via the third route is unconditionally released through a release operation via the third route, and it is possible to more appropriately prevent a situation in which a thief who has stolen a vehicle can release the function restriction. Furthermore, when the vehicle owner properly performs the additional authentication, the function restriction can be appropriately released.

[0113] In the ECU 6, when the function restriction is released by operation from the operation input unit 16, additional authentication is not required or if the additional authentication fails, the function restriction is released in a limited manner. By releasing the function restriction in a limited manner, even if a thief who has stolen the vehicle is able to release the function restriction, the damage caused by releasing the function restriction can be reduced by setting limited conditions.

[0114] In addition to the claims, the present disclosure also includes the following inventions. [1] a function restriction setting unit (17a) for setting a function restriction against vehicle theft; a release possibility determination unit (17e) that determines whether or not the function restriction set by the function restriction setting unit can be released based on a priority; An electronic control device (6) comprising: a function restriction release unit (17g) that releases the function restriction set by the function restriction setting unit on the condition that the release possibility determination unit has determined that the function restriction can be released.

[0115] [2] a priority setting unit (17b) that sets a priority based on an operation type corresponding to a function restriction setting operation or a function restriction release operation; a priority holding unit (17c) that holds the priority set by the priority setting unit, The electronic control device according to [1], wherein the release possibility determination unit determines whether or not the function restriction set by the function restriction setting unit can be released based on the priority held by the priority holding unit.

[0116] [3] The electronic control device described in [2], wherein the priority setting unit sets the priority based on one of the following operation types: operation via communication over a communication network from an external device, operation via short-range wireless communication or wired communication from an external device, and operation from an operation input unit.

[0117] [4] The electronic control device according to claim [2] or [3], further comprising a priority update unit (17d) that updates the priorities held by the priority holding unit.

[0118] [5] The electronic control device described in any one of [2] to [4], wherein the release possibility determination unit determines whether the function restriction set by the function restriction setting unit can be released by comparing the priority of the function restriction setting request for each operation type with the priority of the function restriction release request for each operation type.

[0119] [6] The electronic control device described in [5], wherein the release possibility determination unit determines whether the function restriction can be released when it determines that the priority of the function restriction release request is higher than the priority of the function restriction setting request, or that the priority of the function restriction release request matches the priority of the function restriction setting request.

[0120] [7] The electronic control device according to [5] or [6], wherein the release possibility determination unit determines whether to release the function restriction when it determines that the priority of the function restriction release request is lower than the priority of the function restriction setting request.

[0121] [8] An electronic control device described in any one of [5] to [7], wherein the release possibility determination unit determines whether the function restriction can be released, provided that the authentication result is positive, even if it determines that the priority of the function restriction release request is lower than the priority of the function restriction setting request.

[0122] [9] An electronic control device described in any one of [3] to [8], wherein the function restriction release unit releases the function restriction when the function restriction is released by operation from the operation input unit, provided that the authentication result is positive.

[0123]

[10] The electronic control device according to any one of [3] to [9], wherein the function restriction release unit releases the function restriction in a limited manner when the function restriction is released by operation from the operation input unit.

[0124]

[11] a determination result notification unit (17f) that notifies the determination result of the release determination unit; An electronic control device described in any one of [1] to

[10] , wherein the judgment result notification unit notifies the reason for whether or not the function restriction should be lifted when the liftability determination unit determines whether or not the function restriction should be lifted.

[0125] (Other embodiments) Although the present disclosure has been described with reference to the embodiments, it is understood that the present disclosure is not limited to the embodiments or structures. The present disclosure also encompasses various modifications and modifications within the scope of equivalents. In addition, various combinations and forms, as well as other combinations and forms including only one element, more than one element, or less than one element, are also within the scope and spirit of the present disclosure.

[0126] The control unit and the method described herein may be implemented by a special-purpose computer configured by configuring a processor and memory programmed to perform one or more functions embodied in a computer program. Alternatively, the control unit and the method described herein may be implemented by a special-purpose computer configured by configuring a processor with one or more dedicated hardware logic circuits. Alternatively, the control unit and the method described herein may be implemented by one or more special-purpose computers configured by combining a processor and memory programmed to perform one or more functions with a processor configured with one or more hardware logic circuits. Furthermore, the computer program may be stored as instructions executed by a computer on a computer-readable non-transitory tangible storage medium. [Explanation of symbols]

[0127] In the drawing, 1 is a function restriction management system, 6 is an ECU, 15 is an external device, 16 is an operation input unit, 17 is a control unit, 17a is a function restriction setting unit, 17b is a priority setting unit, 17c is a release possibility determination unit, 17d is a determination result notification unit, and 17e is a function restriction release unit.

Claims

1. A setting unit (17a) for setting vehicle function restrictions, An electronic control device comprising: a control unit (17) that, when the setting unit sets the function restriction based on instructions from an external device different from the vehicle, restricts the release of the function restriction by operation on the vehicle, and releases the function restriction upon instruction from the external device.

2. The electronic control device according to Claim 1, wherein the function restriction is the prohibition of starting the engine or motor of the vehicle, or the restriction of the vehicle's driving speed.

3. The electronic control device according to Claim 1, wherein when the control unit sets the function restriction based on instructions from the external device via the communication network, it restricts the release of the function restriction by instructions from the external device not via the communication network, and releases the function restriction by instructions from the external device via the communication network.

4. The electronic control device according to claim 2, wherein the instruction from the external device that is not via the communication network is an instruction via short-range communication from the external device.

5. The electronic control device according to Claim 2, wherein when the setting unit sets the function restriction based on an instruction from the external device not via the communication network, the control unit restricts the release of the function restriction by operation in the vehicle, releases the function restriction by an instruction from the external device not via the communication network, and releases the function restriction by an instruction from the external device via the communication network.

6. The electronic control device according to Claim 1, wherein the setting of the function restriction by the setting unit based on instructions from the external device is set when authentication is successful.

7. The electronic control device according to Claim 1, wherein the control unit, when the setting unit sets the function restriction based on an operation from the vehicle, releases the function restriction by an operation in the vehicle and releases the function restriction by an instruction from an external device.

8. The electronic control device according to Claim 1, wherein when the control unit sets the function restriction based on instructions from the external device, and an operation to release the function restriction is performed in the vehicle, the function restriction is released in accordance with the success of the authentication.

9. The electronic control device according to claim 1, wherein the control unit releases the function restriction in a limited manner when the function restriction is released by an operation in the vehicle.

10. Set a limit on the function of the vehicle, A control method for an electronic control unit, which, when the function restriction is set based on instructions from an external device different from the vehicle, restricts the release of the function restriction by operation on the vehicle, and releases the function restriction based on instructions from the external device.

11. The control unit (17) of the electronic control device (6) which includes a setting unit (17a) for setting the function limits of the vehicle, A program that, when the function restriction is set based on instructions from an external device other than the vehicle, restricts the removal of the function restriction by operation on the vehicle, and causes a procedure to be executed to remove the function restriction based on instructions from the external device.

Images