Control device, control method, and control program

Abstract

To provide a control device which enables control from an external device over a vehicle with its security being guaranteed.SOLUTION: A control device 10 includes: a confirmation unit 101 which confirms a secure state; an acceptance unit 102 which accepts a control request from an external device; and a control unit 103 which, when the acceptance unit 102 has accepted the control request, performs at least any of the control to start or close an in-vehicle network and the control to turn on or off the ignition on the basis of the control request, provided that the secure state is confirmed by the confirmation unit 101.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present invention relates to a control device, a control method, and a control program. [Background technology]

[0002] Patent Document 1 discloses a keyless entry system that aims to realize a configuration related to an engine start operation in an emergency at low cost and without reducing the degree of freedom of layout inside the vehicle. As described above, there is a technology for turning the ignition on and off by operating a button provided in the vehicle. This technology is used, for example, when a worker inspects a vehicle or rewrites software in a vehicle maintenance factory. The worker turns the ignition on by pressing a button provided in the vehicle, and when the worker wants to interrupt work or when the worker has completed work, he or she presses the button to turn the ignition off. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2006-273025 A Summary of the Invention [Problem to be solved by the invention]

[0004] Repeated vehicle control, such as turning the ignition on and off with a button, causes the process takt time to be extended. Also, if the line stops with the vehicle suspended, workers cannot get into the vehicle, making it difficult to control the vehicle. On the other hand, allowing easy control of the vehicle from outside is not appropriate, considering the possibility of being attacked by malicious third parties.

[0005] An object of the present invention is to provide a control device, a control method, and a control program that enable control of a vehicle from an external device while ensuring security. [Means for solving the problem]

[0006] A control device according to a first aspect of the present invention includes a confirmation unit that confirms that a secure state is being established, a reception unit that receives a control request from an external device, and a control unit that, when the reception unit receives the control request, performs at least one of control to start or stop an in-vehicle network and control to turn an ignition on or off based on the control request, provided that the confirmation unit has determined that the state is secure.

[0007] In the control device according to the first aspect, the confirmation unit confirms that the vehicle is in a secure state, the acceptance unit accepts a control request from an external device, and when the control request is accepted, the control unit performs at least one of control to start or stop the in-vehicle network and control to turn the ignition on or off based on the control request, provided that the vehicle is in a secure state. According to the control device according to the first aspect, the control based on the control request is performed, provided that the vehicle is in a secure state, so that the control device enables control of the vehicle from an external device while ensuring security.

[0008] A control device according to a second aspect of the present invention is the control device according to the first aspect, in which the confirmation unit determines that the vehicle is in a secure state when the vehicle is in a specific predetermined location. According to the control device according to the second aspect, it is determined that security is guaranteed when the vehicle is in the specific location, and it is possible to control the vehicle from an external device.

[0009] A control device according to a third aspect of the present invention is the control device according to the second aspect, wherein the confirmation unit determines that the vehicle is in a secure state if the vehicle is connected to a network environment at the specific location. According to the control device according to the third aspect, the control device determines that security is guaranteed if the vehicle is connected to a network environment at the specific location, and enables control of the vehicle from an external device.

[0010] A control device according to a fourth aspect of the present invention is the control device according to any one of the first to third aspects, and the control unit performs control based on the control request on the condition that the vehicle is not in a locked state. According to the control device according to the fourth aspect, if the vehicle is not in a locked state, it is possible to control the vehicle from an external device.

[0011] A control device according to a fifth aspect of the present invention is the control device according to any one of the first to fourth aspects, in which, when the control unit performs control to start up an in-vehicle network, the control unit transitions to a state in which it operates with lower power consumption than when the control unit performs the control. According to the control device according to the fifth aspect, it is possible to suppress power consumption after starting up the in-vehicle network.

[0012] A control device according to a sixth aspect of the present invention is the control device according to any one of the first to fifth aspects, wherein the control unit further performs control to turn an engine on or off based on the control request.

[0013] A control method according to a seventh aspect of the present invention includes a processor that confirms that the vehicle is in a secure state, accepts a control request from an external device, and, if the control request is accepted, performs at least one of control to start or stop the in-vehicle network and control to turn on or off the ignition based on the control request, provided that the vehicle is in a secure state. According to the control method according to the sixth aspect, control based on the control request is performed, provided that the vehicle is in a secure state, thereby enabling control of the vehicle from an external device while ensuring security.

[0014] A control program according to an eighth aspect of the present invention causes a computer to execute a process of confirming that the vehicle is in a secure state, accepting a control request from an external device, and, if the control request is accepted, performing at least one of control to start or stop an in-vehicle network and control to turn on or off an ignition based on the control request, provided that the vehicle is in a secure state. According to the control program according to the seventh aspect, control based on the control request is performed, provided that the vehicle is in a secure state, thereby enabling control of the vehicle from an external device while ensuring security. Effect of the Invention

[0015] According to the present invention, it is possible to provide a control device, a control method, and a control program that enable control of a vehicle from an external device while ensuring security. [Brief description of the drawings]

[0016] [Figure 1] 1 is a diagram showing a schematic configuration of an in-vehicle system according to an embodiment of the present invention; [Diagram 2] FIG. 2 is a block diagram showing a hardware configuration of a control device. [Diagram 3] 2 is a block diagram showing an example of a functional configuration of a control device. FIG. [Figure 4] 4 is a flowchart showing a flow of a control process performed by the control device. [Diagram 5] 4 is a flowchart showing a flow of a control process performed by the control device. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0017] Hereinafter, an example of an embodiment of the present invention will be described with reference to the drawings. In each drawing, the same or equivalent components and parts are given the same reference numerals. In addition, the dimensional ratios of the drawings are exaggerated for the convenience of explanation and may differ from the actual ratios.

[0018] FIG. 1 is a diagram showing a schematic configuration of an in-vehicle system according to this embodiment.

[0019] 1 includes a control device 10, an ignition switch 20, a communication unit 30, an engine ECU 40, an engine 50, and a verification ECU 55. The control device 10, the ignition switch 20, the communication unit 30, the engine ECU 40, and the verification ECU 55 are connected by a CAN bus 60.

[0020] The control device 10 controls each part included in the in-vehicle system based on a control request from an external device 100 outside the in-vehicle system. The external device 100 is connected to the control device 10 via a DLC (Data Link Connector). The control device 10 is, for example, a central gateway ECU (Electronic Control Unit). In this embodiment, the ignition switch 20, the communication unit 30, and the engine ECU 40 are shown as objects to be controlled by the control device 10, but the objects to be controlled by the control device 10 are not limited to these examples.

[0021] The ignition switch 20 is a switch for starting the engine of a vehicle in which the in-vehicle system is installed and for controlling other electrical systems. The ignition switch 20 controls the on / off of the ignition and other electrical systems in response to a control request from the control device 10.

[0022] The communication unit 30 controls an in-vehicle network through which communication between the various components of the in-vehicle system is performed. The communication unit 30 controls the on / off of the in-vehicle network in response to a control request from the control device 10.

[0023] The engine ECU 40 is an ECU that controls the operation of the engine 50. The engine ECU 40 controls the on / off of the engine 50 in response to a control request from the control device 10.

[0024] 1 is mounted on a hybrid vehicle, an HEV (Hybrid Electric Vehicle) ECU is provided instead of the engine ECU 40, and a hybrid system is provided instead of the engine 50. In this case, the HEV ECU controls the on / off of READY (a state in which the vehicle can be driven by the hybrid system) instead of the on / off of the engine.

[0025] 1 is mounted on a plug-in hybrid vehicle, a PHEV (Plug-in Hybrid Electric Vehicle) ECU is provided instead of the engine ECU 40, and a plug-in hybrid system is provided instead of the engine 50. In this case, the PHEV ECU controls the on / off of READY (a state in which the vehicle can be driven by the plug-in hybrid system) instead of the on / off of the engine.

[0026] 1 is mounted on a fuel cell vehicle, an FCEV (Fuel Cell Electric Vehicle) ECU is provided instead of the engine ECU 40, and a vehicle drive system is provided instead of the engine 50. In this case, the FCEV ECU controls the on / off of READY (a state in which the vehicle can be driven by the vehicle drive system) instead of the on / off of the engine.

[0027] 1 is installed in an electric automobile, a BEV (Battery Cell Electric Vehicle) ECU is provided instead of the engine ECU 40, and a vehicle drive system is provided instead of the engine 50. In this case, the BEV ECU controls the on / off of READY (a state in which the vehicle can be driven by the vehicle drive system) instead of the on / off of the engine.

[0028] The verification ECU 55 performs a predetermined verification process by communicating with a smart key (not shown), and if the verification is successful, it transmits a signal permitting control to the ignition switch 20, the communication unit 30, and the engine ECU 40. The predetermined verification process includes equipment verification, key verification, biometric authentication, etc., and one or more of the above verification processes are performed. Through the verification process, the control device 10 can control the on / off of the ignition, on the condition that the predetermined verification is successful, in addition to various conditions described below.

[0029] The control device 10 according to this embodiment controls each part included in the in-vehicle system based on a control request from the external device 100, on the condition that the vehicle equipped with the in-vehicle system is in a secure state. The control device 10 controls each part included in the in-vehicle system on the condition that the vehicle equipped with the in-vehicle system is in a secure state, thereby enabling the external device to control the vehicle while ensuring security.

[0030] FIG. 2 is a block diagram showing the hardware configuration of the control device 10. As shown in FIG.

[0031] 2, the control device 10 includes a CPU (Central Processing Unit) 11, a ROM (Read Only Memory) 12, a RAM (Random Access Memory) 13, a storage 14, an input unit 15, a display unit 16, and a communication interface (I / F) 17. Each component is connected to each other via a bus 19 so as to be able to communicate with each other.

[0032] The CPU 11 is a central processing unit, and executes various programs and controls each part. That is, the CPU 11 reads a program from the ROM 12 or the storage 14, and executes the program using the RAM 13 as a working area. The CPU 11 controls each of the above components and performs various arithmetic processing according to the program recorded in the ROM 12 or the storage 14. In this embodiment, the ROM 12 or the storage 14 stores a control program that controls the in-vehicle system.

[0033] The ROM 12 stores various programs and various data. The RAM 13 temporarily stores programs or data as a working area. The storage 14 is configured with a storage device such as a hard disk drive (HDD), a solid state drive (SSD), or a flash memory, and stores various programs including an operating system, and various data.

[0034] The input unit 15 includes a pointing device such as a mouse, and a keyboard, and is used to perform various input operations.

[0035] The display unit 16 is, for example, a liquid crystal display, and displays various information. The display unit 16 may function as the input unit 15 by adopting a touch panel system.

[0036] The communication interface 17 is an interface for communicating with other devices such as the ignition switch 20, the communication unit 30, and the engine ECU 40, and uses standards such as Ethernet (registered trademark), FDDI, Wi-Fi (registered trademark), and CAN (Controller Area Network).

[0037] When executing the above control programs, the control device 10 realizes various functions using the above hardware resources. The functional configuration realized by the control device 10 will be described.

[0038] Next, the functional configuration of the control device 10 will be described.

[0039] FIG. 3 is a block diagram showing an example of a functional configuration of the control device 10. As shown in FIG.

[0040] 3, the control device 10 has, as its functional components, a confirmation unit 101, a reception unit 102, and a control unit 103. Each functional component is realized by the CPU 11 reading and executing a control program stored in the ROM 12 or the storage 14.

[0041] The confirmation unit 101 confirms whether the in-vehicle system is in a secure state. The confirmation unit 101 may determine that the in-vehicle system is in a secure state if the in-vehicle system is in a predetermined specific location such as a vehicle factory. The confirmation unit 101 may determine that the in-vehicle system is in a predetermined specific location on the condition that the in-vehicle system is connected to a predetermined network. For example, the confirmation unit 101 may determine whether the in-vehicle system is connected to a predetermined network by an encrypted Wi-Fi SSID or an Ethernet MAC address.

[0042] Furthermore, the confirmation unit 101 may determine that the in-vehicle system is in a secure state when an operation is performed by a worker who has the authority to maintain the vehicle. The confirmation unit 101 may determine whether the worker has the authority by identifying a terminal equipped with a biometric authentication or personal authentication function (personal authentication by encrypted communication using an encryption key assigned to a specific worker).

[0043] The confirmation unit 101 enables the determination flag only when the vehicle is located at a predetermined specific location such as a vehicle factory. The determination flag can be stored in a secure area (Hardware Security Module, HSM) in the control device 10 to prevent external tampering. The determination flag may be set to disabled when shipped from the vehicle factory, and may be an irreversible setting that cannot be changed from disabled to enabled.

[0044] The reception unit 102 receives a control request for the in-vehicle system from the external device 100. The control request for the in-vehicle system is, for example, a control request for at least one of the ignition switch 20, the communication unit 30, and the engine ECU 40.

[0045] When the reception unit 102 receives a control request from the external device 100, the control unit 103 controls the in-vehicle system based on the received control request on condition that the in-vehicle system is in a secure state by the confirmation unit 101. The control unit 103 controls at least one of the ignition switch 20, the communication unit 30, and the engine ECU 40.

[0046] The control unit 103 may further control the in-vehicle system based on the received control request, on the condition that the in-vehicle system is in an unlocked state. The unlocked state means that the control device 10 is in a security unlocked state. Specifically, the control unit 103 may refer to the state of a lock flag stored in a secure area (secure memory) in the control device 10 to determine whether the in-vehicle system is in an unlocked state. The lock flag may be set from an unlocked state to a locked state at the time of shipment from the vehicle factory, and may be an irreversible setting that cannot be changed from the locked state to the unlocked state.

[0047] The control device 10 has the functional configuration shown in Fig. 3, and therefore can control each part included in the in-vehicle system based on a control request from the external device 100, on condition that the vehicle equipped with the in-vehicle system is in a secure state. The control device 10 has the functional configuration shown in Fig. 3, and therefore can control the vehicle from the external device while ensuring security.

[0048] Next, the operation of the control device 10 will be described.

[0049] 4 is a flowchart showing the flow of control processing by the control device 10. The CPU 11 reads a control program from the ROM 12 or storage 14, loads it into the RAM 13, and executes it, thereby performing the control processing.

[0050] First, the CPU 11 sets the state of the control device 10 to a normal control mode (step S101). The normal control mode is a mode in which no control request from the external device 100 is accepted.

[0051] Following step S101, the CPU 11 determines whether the in-vehicle system is in a specific secure state (step S102). As described above in the description of the confirmation unit 101, the CPU 11 may determine that the in-vehicle system is in a secure state if the in-vehicle system is in a specific predetermined location such as a vehicle factory.

[0052] As a result of the determination in step S102, if it is determined that the in-vehicle system is not in a specific secure state (step S102; No), the CPU 11 returns to the normal control mode in step S101.

[0053] On the other hand, if it is determined in step S102 that the in-vehicle system is in a specific secure state (step S102; Yes), the CPU 11 checks the security lock state of the in-vehicle system (step S103).

[0054] If it is confirmed in step S103 that the in-vehicle system is in a locked state (step S103; No), the CPU 11 returns to the normal control mode in step S101.

[0055] On the other hand, if it is confirmed in step S103 that the in-vehicle system is in an unlocked state (step S103; Yes), the CPU 11 sets the state of the control device 10 to a vehicle state control mode (step S104). The vehicle state control mode is a mode in which a control request from the external device 100 is accepted.

[0056] Following step S104, the CPU 11 determines whether or not a predetermined time has elapsed since the mode was changed to the vehicle state control mode (step S105).

[0057] If it is determined in step S105 that a predetermined time has elapsed since the mode was switched to the vehicle state control mode (step S105; Yes), the CPU 11 returns to the normal control mode in step S101.

[0058] On the other hand, if it is determined in step S105 that the predetermined time has not elapsed since the mode was changed to the vehicle state control mode (step S105; No), the CPU 11 determines whether or not a control request has been received from the external device 100 (step S106).

[0059] If it is determined in step S106 that there is no control request from the external device 100 (step S106; No), the CPU 11 returns to the vehicle state control mode in step S104.

[0060] On the other hand, if it is determined in step S106 that there is a control request from the external device 100 (step S106; Yes), the CPU 11 determines the control target according to the control request from the external device 100 (step S107).

[0061] If the control target in response to the control request from the external device 100 is the in-vehicle network, the CPU 11 controls the communication unit 30 to turn on or off the in-vehicle network (step S108).

[0062] If the control target in response to the control request from the external device 100 is the ignition switch, the CPU 11 controls the ignition switch 20 to turn the ignition switch 20 on or off (step S109).

[0063] The control device 10 executes the series of operations shown in Fig. 4, and is able to control each part included in the in-vehicle system based on a control request from the external device 100, on condition that the vehicle equipped with the in-vehicle system is in a secure state. By executing the series of operations shown in Fig. 4, the control device 10 is able to control the vehicle from the external device while ensuring security.

[0064] In the control process shown in Fig. 4, the CPU 11 checks the locked state of the in-vehicle system (security locked state of the control device 10) after determining whether the in-vehicle system is in a specific secure state, but the present invention is not limited to this example. The CPU 11 may check the locked state of the in-vehicle system, and if it is unlocked, determine whether the in-vehicle system is in a specific secure state. By first performing the locked state confirmation process, which has a relatively light processing load compared to the process of determining whether the in-vehicle system is in a specific secure state, the processing load of the control device 10 can be reduced.

[0065] 5 is a flowchart showing the flow of control processing by the control device 10. The CPU 11 reads a control program from the ROM 12 or storage 14, loads it into the RAM 13, and executes it, thereby performing the control processing.

[0066] FIG. 5 shows a flow of control processing by the control device 10 when performing on / off control of the engine in addition to on / off control of the in-vehicle network and the ignition switch.

[0067] The control process up to step S106 is the same as that shown in FIG.

[0068] As a result of the determination in step S106, if there is a control request from the external device 100 (step S106; Yes), the CPU 11 determines the control target according to the control request from the external device 100 (step S107).

[0069] If the control target in response to the control request from the external device 100 is the in-vehicle network, the CPU 11 controls the communication unit 30 to turn on or off the in-vehicle network (step S108).

[0070] If the control target in response to the control request from the external device 100 is the ignition switch, the CPU 11 first controls the vehicle stop state or release state (step S111). Next, the CPU 11 controls the ignition switch 20 to turn the ignition switch 20 on or off (step S109).

[0071] If the control target in response to the control request from the external device 100 is the engine, the CPU 11 first performs control to hold or release the vehicle stopped state (step S112). Next, the CPU 11 controls the engine ECU 40 to turn on or off the engine 50 (step S113).

[0072] If the control target in response to the control request from the external device 100 is something else, the CPU 11 controls the other thing (step S114).

[0073] In the control process of FIG. 4 and FIG. 5, after the CPU 11 has performed control to start up the in-vehicle network, the CPU 11 may return to the normal control mode instead of the vehicle state control mode.

[0074] 4 and 5, after the CPU 11 performs control to terminate the in-vehicle network, the CPU 11 may transition to a sleep mode instead of the vehicle state control mode. The sleep mode is a mode that consumes less power than the vehicle state control mode and the normal control mode.

[0075] The triggers for transitioning from the sleep mode to the normal control mode, checking whether the in-vehicle system is in a specific secure state as shown in step S101, and checking the locked state as shown in step S102 are, for example, as follows: It is assumed that the battery in which the in-vehicle system is mounted has some remaining capacity.

[0076] The control device 10 may transition from the sleep mode to the normal control mode, for example, when it recognizes that the ignition switch 20 is turned on by operating a button on the vehicle or the like, or that an accessory of the vehicle is turned on.

[0077] Furthermore, the control device 10 may transition from the sleep mode to the normal control mode when, for example, it detects that an ECU or the like connected to the control device 10 via the CAN bus 60 has started transmitting a CAN message. In this case, the control device transitions to the normal control mode while the ignition switch 20 remains in the off state. In this case, if there is communication from the DLC, the control device 10 does not transition to the normal control mode. The reason for excluding the DLC is to avoid the occurrence of battery exhaustion due to communication or noise from outside the vehicle causing the control device 10 to be unable to transition to the sleep mode.

[0078] Furthermore, the control device 10 may transition from the sleep mode to the normal control mode, for example, when a dominant (voltage change) occurs on the CAN bus 60 connected to the control device 10. In this case, the control device transitions to the normal control mode while the ignition switch 20 remains in the off state. In this case, if there is a DLC dominant, the control device 10 does not transition to the normal control mode. The reason for excluding DLC ​​is to avoid the battery running out due to communication or noise from outside the vehicle causing the control device 10 to be unable to transition to the sleep mode.

[0079] The control device 10 may transition to the normal control mode even if the DLC is dominant only in the vehicle state control mode. This allows the communication unit 30 to be turned on through the control device 10 from outside the vehicle even when the control device 10 is in a sleep state, thereby putting the vehicle into a communication-enabled state.

[0080] In addition, the control process executed by the CPU by reading the software (program) in each of the above embodiments may be executed by various processors other than the CPU. In this case, examples of the processor include a PLD (Programmable Logic Device) such as an FPGA (Field-Programmable Gate Array) whose circuit configuration can be changed after manufacture, and a dedicated electric circuit such as an ASIC (Application Specific Integrated Circuit) which is a processor having a circuit configuration designed exclusively for executing a specific process. In addition, the control process may be executed by one of these various processors, or may be executed by a combination of two or more processors of the same or different types (for example, a plurality of FPGAs, a combination of a CPU and an FPGA, etc.). In addition, the hardware structure of these various processors is, more specifically, an electric circuit that combines circuit elements such as semiconductor elements.

[0081] In addition, in each of the above embodiments, the control processing program is pre-stored (installed) in a ROM or storage, but the present invention is not limited to this. The program may be provided in a form recorded on a non-transitory recording medium such as a CD-ROM (Compact Disk Read Only Memory), a DVD-ROM (Digital Versatile Disk Read Only Memory), or a USB (Universal Serial Bus) memory. The program may also be downloaded from an external device via a network. [Explanation of symbols]

[0082] 10 Control device 20 Ignition switch 30 Communication Unit 40 Engine ECU 50 Engine 60 CAN Bus

Claims

1. A control device, a verification unit for verifying that the state is secure; a reception unit that receives a control request from an external device; a control unit that, when the reception unit receives the control request, performs at least one of a control to start or terminate an in-vehicle network and a control to turn on or off an ignition based on the control request, on condition that the confirmation unit has determined that the in-vehicle network is in a secure state; and Equipped with the confirmation unit determines that the control device is in a secure state if the control device is connected to a network environment in a specific location; The specific location is a factory that ships vehicles having the in-vehicle network, the control device.

2. The control device according to claim 1 , wherein the control unit performs the control based on the control request on a further condition that the vehicle is not in a locked state.

3. The control device according to claim 1 , wherein, when the control unit performs control to terminate the in-vehicle network, the control unit transitions to a state in which the control unit operates with lower power consumption than when the control unit does not perform the control.

4. 4. The control device according to claim 1, wherein the control unit further performs control to turn an engine on or off based on the control request.

5. A control method for a control device, comprising: The processor: Make sure it's secure, Accepts control requests from external devices, When the control request is received, on the condition that the control device is connected to a network environment in a specific location and thus in a secure state, at least one of control for starting or ending an in-vehicle network and control for turning on or off an ignition is performed based on the control request; The specific location is a factory that ships vehicles having the in-vehicle network. Control methods.

6. A control program for a control device, On the computer, Make sure it's secure, Accepts control requests from external devices, When the control request is received, on the condition that the control device is connected to a network environment in a specific location and thus in a secure state, at least one of control for starting or ending an in-vehicle network and control for turning on or off an ignition is performed based on the control request; The specific location is a factory that ships vehicles having the in-vehicle network. A control program that executes processing.

Images