Start control device and start control program for drive mechanism

Abstract

This start control device (7) for a drive mechanism comprises: a key authentication unit (21) which carries out key authentication through an electronic key; a key authentication result determination unit (22) which determines an authentication result of the key authentication; a behavior authentication unit (23) which carries out behavior authentication for a driver; a behavior authentication result determination unit (24) which determines an authentication result of the behavior authentication; and a start control unit (27) which permits the start of the drive mechanism when both the authentication result of the key authentication and the authentication result of the behavior authentication are determined to be positive and which suppresses the start of the drive mechanism when at least one of the authentication result of the key authentication and the authentication result of the behavior authentication is determined to be negative.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS

[0001] This application is based on Japanese Application No. 2021-105739 filed on June 25, 2021, the contents of which are incorporated herein by reference. [Technical field]

[0002] The present disclosure relates to a start control device and a start control program for a drive mechanism. [Background technology]

[0003] In recent years, unintentional start of a drive mechanism such as an engine due to relay attacks, information leaks, illegal acquisition, etc., resulting in damage caused by vehicle theft, has become a social problem. For example, Patent Document 1 discloses a configuration that combines key authentication using an electronic key with biometric authentication using biometric information, and allows the start of a drive mechanism if both key authentication and biometric authentication are successful. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Patent Publication No. 2021-46741 Summary of the Invention

[0005] In Patent Document 1, for example, a user other than the vehicle owner can start the drive mechanism without the owner's permission by registering a face image in advance. However, in cases where the faces of a parent and child are similar, for example, even a user who has not registered a face image in advance may be able to start the drive mechanism if a user who has a similar face to the user has registered a face image in advance, and starting of the drive mechanism cannot be appropriately suppressed.

[0006] The present disclosure aims to appropriately suppress the starting of a drive mechanism such as an engine.

[0007] According to one aspect of the present disclosure, the key authentication unit performs key authentication using an electronic key. The key authentication result determination unit determines the authentication result of the key authentication. The behavior authentication unit performs behavior authentication of the driver. The behavior authentication result determination unit determines the authentication result of the behavior authentication. The face authentication unit performs face authentication of the driver. The face authentication result determination unit determines the authentication result of the face authentication. When it is determined that the authentication result of the key authentication, the authentication result of the behavior authentication, and the authentication result of the face authentication are all positive because authentication was performed in the order of key authentication, behavior authentication, and face authentication, the start control unit allows the start of the drive mechanism, and when it is determined that at least one of the authentication result of the key authentication, the authentication result of the behavior authentication, and the authentication result of the face authentication is negative, the start control unit suppresses the start of the drive mechanism. The start-up control unit of the drive mechanism allows the start-up of the drive mechanism when it is determined that the authentication results of the key authentication, the behavioral authentication, and the face authentication are all positive during a first specified time period, and allows the start-up of the drive mechanism when it is determined that the authentication result of the key authentication is positive during a second specified time period different from the first specified time period.

[0008] The authentication result of the key authentication is not used to determine whether to permit or inhibit the start of the drive mechanism, but is used to determine whether to permit or inhibit the start of the drive mechanism. 、 Behavioral authentication results , Face recognition result This is used to determine whether to allow or inhibit the start of the drive mechanism. This prevents the drive mechanism from being started due to unauthorized key authentication. vinegar Therefore, starting of the drive mechanism can be appropriately suppressed. [Brief description of the drawings]

[0009] The above and other objects, features and advantages of the present disclosure will become more apparent from the following detailed description taken in conjunction with the accompanying drawings, in which: [Figure 1] FIG. 1 is a functional block diagram of a driver condition monitoring system according to a first embodiment of the present invention. [Diagram 2] FIG. 2 is a flow chart; [Diagram 3] FIG. 3 is a diagram showing a behavior authentication guidance screen; [Figure 4] FIG. 4 is a diagram showing an error notification screen. [Diagram 5] FIG. 5 is a flowchart illustrating a second embodiment; [Figure 6]FIG. 6 is a diagram showing an error notification screen. [Figure 7] FIG. 7 is a functional block diagram of a driver state monitoring system according to a third embodiment. [Figure 8] FIG. 8 is a flow chart; [Figure 9] FIG. 9 is a flowchart showing a retry notification screen. [Figure 10] FIG. 10 is a diagram showing an error notification screen. [Figure 11] FIG. 11 is a flowchart illustrating the fourth embodiment. [Figure 12] FIG. 12 is a diagram showing the engine start inhibition screen. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] Several embodiments will be described below with reference to the drawings. In each of the embodiments described below, parts corresponding to those described in the preceding embodiments are given the same reference numerals, and duplicated descriptions may be omitted. Although the description will be given of a case where the invention is applied to a vehicle equipped with an engine as a drive mechanism, the invention can also be applied to a vehicle equipped with a motor as a drive mechanism, or to a vehicle equipped with both an engine and a motor as drive mechanisms. In other words, the drive mechanism may be at least one of an engine and a motor.

[0011] (First embodiment) The first embodiment will be described with reference to FIGS. A vehicle is equipped with a driver status monitoring system including a Driver Status Monitor (registered trademark) (hereinafter referred to as DSM (Driver Status Monitor)) as an occupant status monitoring system that monitors the status of the occupant. The driver status monitoring system judges whether the driver is looking away, closing the eyes, drowsiness, etc. based on the degree of drooping of the eyelids, the degree of pupil opening, the direction of gaze, the speed of gaze movement, etc. from a facial image, and judges whether the driver is in a suitable driving state or an unsuitable driving state based on the judgment result. When the driver status monitoring system determines that the driver is in an unsuitable driving state, it activates, for example, a driver abnormality response system (hereinafter referred to as EDSS (Emergency Driving Stop System)) or disables driving by automatic driving or driving by advanced driving assistance system.

[0012] 1, the driver state monitoring system 1 includes a control device 2, a driver state recognition device 3, a vehicle information recognition device 4, a driving environment recognition device 5, and an HMI (Human Machine Interface) 6. The engine start control device 7 is configured as a part of the driver state monitoring system 1, and includes the control device 2 and the driver state recognition device 3. The engine start control device 7 corresponds to a start control device for a drive mechanism.

[0013] The driver state recognition device 3 includes a driver camera 31, an LED 32, a buckle sensor 33, and a seating sensor 34. The driver camera 31 is a camera having an image sensor such as a CCD (Charge Coupled Device) or a CMOS (Complementary Metal Oxide Semiconductor), and is disposed on the upper surface of the instrument panel, the meter panel, the rearview mirror, the steering column, or the like. The driver camera 31 captures an image of the area around the headrest of the driver's seat, and outputs the captured image to the control device 2. There may be more than one driver camera 31, and the multiple driver cameras 31 may be configured to perform the image capturing operation in synchronization.

[0014] The LED 32 emits near-infrared light around the headrest of the driver's seat. That is, when the driver is seated in the driver's seat, the near-infrared light emitted from the LED 32 is irradiated around the driver's face, and the area around the driver's face irradiated with the near-infrared light is captured by the driver camera 31. The number of the LEDs 32 may be more than one, and a configuration in which the multiple LEDs 32 perform illumination operations in synchronization may also be used.

[0015] The buckle sensor 33 detects whether the convex portion on the seat belt is inserted into the concave portion on the buckle, and outputs the detection result to the control device 2. The seating sensor 34 detects the pressure distribution on the driver's seat, and outputs the detected pressure distribution to the control device 2.

[0016] The vehicle information recognition device 4 includes a vehicle speed sensor 41, a steering angle sensor 42, an accelerator sensor 43, and a brake sensor 44. The vehicle speed sensor 41 detects the vehicle speed and outputs the detected vehicle speed to the control device 2. The steering angle sensor 42 detects the steering angle of the steering wheel and outputs the detected steering angle to the control device 2. The accelerator sensor 43 detects the amount of operation of the accelerator pedal and outputs the detected amount of operation to the control device 2. The brake sensor 44 detects the amount of operation of the brake pedal and outputs the detected amount of operation to the control device 2.

[0017] The driving environment recognition device 5 includes a front camera 51, a rear camera 52, a front sensor 53, a rear sensor 54, a navigation device 55, and a G sensor 56. The front camera 51 captures an image in front of the vehicle, including markings painted on the road surface, and outputs the captured image to the control device 2. The rear camera 52 captures an image in the rear of the vehicle and outputs the captured image to the control device 2. The front sensor 53 is a sensor such as a millimeter wave sensor, radar, or LiDAR (Light Detection and Ranging, Laser Imaging Detection and Ranging), and detects objects such as a leading vehicle or pedestrian in front of the vehicle and outputs the detection result to the control device 2. The rear sensor 54 is a sensor such as a millimeter wave sensor, radar, or LiDAR, and detects objects such as a following vehicle or pedestrian behind the vehicle and outputs the detection result to the control device 2. The driving environment recognition device 5 calculates the relative speed with respect to the forward vehicle based on the distance to the forward vehicle detected by the forward sensor 53, and calculates the relative speed with respect to the rear vehicle based on the distance to the following vehicle detected by the rear sensor 54.

[0018] The navigation device 55 performs navigation processing such as determining the current vehicle position by measuring GPS position coordinates based on a GPS signal transmitted from a GPS (Global Positioning System) satellite, calculating a route from the determined current vehicle position to a destination, and guiding along the calculated route. Note that the satellite positioning system is not limited to GPS, and various GNSS (Global Navigation Satellite Systems) such as GLONASS, Galileo, BeiDou, and IRNSS can be adopted. The G sensor 56 detects three-dimensional acceleration in the forward / rearward, left / right, and up / down directions of the vehicle, and outputs the detection results to the control device 2. The G sensor 56 may be a sensor provided in the navigation device 55, or a sensor installed for other purposes.

[0019] The HMI 6 includes a display 61, a speaker 62, and a cancel switch 63. The display 61 has a flat display such as a liquid crystal display or an organic EL (Electro-Luminescence) display, and a touch panel is formed on the front surface of the flat display. When the display 61 detects a touch operation on the touch panel by the driver or passenger, it performs screen control such as switching the screen or displaying an icon on the screen in response to the touch operation.

[0020] As one of the pieces of information to be displayed, the display 61 displays a status indicating the degree of the driver's posture deterioration in five stages. The lower the status number, the lower the degree of deterioration, the driver's posture is normal, and the driver is in an appropriate driving state suitable for driving, while the higher the status number, the higher the degree of deterioration, the driver's posture is abnormal, and the driver is in an unsuitable driving state suitable for driving. The control device 2 outputs a driver status signal indicating the driver's status to the display 61, thereby causing the status to be displayed on the display 61. The driver can grasp his or her own driving posture by viewing the status displayed on the display 61.

[0021] The speaker 62 is a speaker shared with the navigation device 55, an audio device, etc. The control device 2 outputs a driver state signal indicating the state of the driver to the speaker 62, thereby causing the speaker 62 to output the status as audio. The driver can grasp his / her driving posture by listening to the status being output as audio from the speaker 62.

[0022] The cancel switch 63 is a switch that temporarily stops detection of the driver's condition. When the cancel switch 63 is operated before a trip, detection of the driver's condition is stopped for the period of one trip immediately following the operation. In addition, when the cancel switch 63 is operated during a trip, detection of the driver's condition is stopped for the period during which the cancel switch 63 is operated or for a certain period of time (about several seconds) after the cancel switch 63 is operated. In other words, for example, by operating the cancel switch 63 in advance when the driver is about to pick up an object, the driver will not be erroneously detected as being in an unfit state for driving even if his / her posture becomes distorted.

[0023] The control device 2 is composed of a microcomputer having a CPU (Central Processing Unit), ROM (Read Only Memory), RAM (Random Access Memory) and I / O (Input / Output). The microcomputer executes a computer program stored in a non-transient tangible storage medium, thereby performing processing corresponding to the computer program and controlling the overall operation of the driver state monitoring system 1. The microcomputer has the same meaning as a processor. In the driver state monitoring system 1, the non-transient tangible storage medium may share hardware with other computer resources.

[0024] The control device 2 is capable of data communication with the above-mentioned driver state recognition device 3, vehicle information recognition device 4, driving environment recognition device 5, and HMI 6 via a wired connection such as CAN (Controller Area Network) (registered trademark) or a wireless connection such as wireless LAN or Bluetooth (registered trademark).

[0025] The control device 2 includes a key authentication unit 21, a key authentication result determination unit 22, a behavior authentication unit 23, a behavior authentication result determination unit 24, a face authentication unit 25, a face authentication result determination unit 26, a start control unit 27, and an error notification unit 28. Each of these units 21 to 28 corresponds to a function executed by an engine start control program. That is, the control device 2 performs the functions of each of the units 21 to 28 by executing the engine start control program.

[0026] The key authentication unit 21 compares the authentication information transmitted from the electronic key with pre-registered authentication information and performs key authentication using the electronic key. When the key authentication unit 21 performs key authentication using the electronic key, the key authentication result determination unit 22 determines the authentication result of the key authentication unit 21. That is, if the key authentication result determination unit 22 determines that the authentication information transmitted from the electronic key matches the pre-registered authentication information, it determines that the authentication result of the key authentication unit 21 is positive, and if it determines that the authentication information does not match, it determines that the authentication result of the key authentication unit 21 is negative.

[0027] The behavior authentication unit 23 analyzes the image of the driver captured by the driver camera 31, compares the behavior pattern of the driver with the previously registered behavior pattern, and performs behavior authentication of the driver. The behavior authentication unit 23 performs behavior authentication of the driver, for example, for the behavior of the driver sitting in the driver's seat and performing near the window of the driver's seat, the behavior of the driver touching the equipment in the vehicle cabin, and the behavior of the driver using the electronic key. That is, the behavior authentication unit 23 uses the driver camera 31, which originally captures an image for determining whether the driver is in a suitable or unsuitable state for driving, and uses the image of at least the upper body of the driver captured by the driver camera 31 for behavior authentication before starting the engine. In this case, the LED 32 is linked, and the LED 32 performs a lighting operation while the driver camera 31 is performing an imaging operation.

[0028] When the behavior authentication unit 23 performs behavior authentication of the driver, the behavior authentication result determination unit 24 determines the authentication result of the behavior authentication unit 23. That is, when the behavior authentication result determination unit 24 determines that the behavior pattern performed by the driver matches a pre-registered behavior pattern, it determines that the authentication result of the behavior authentication unit 23 is positive, and when it determines that the two do not match, it determines that the authentication result of the behavior authentication unit 23 is negative.

[0029] For example, in the case where a behavior pattern of making multiple hand signs in a predetermined order near the driver's seat window while sitting in the driver's seat is registered in advance, if the driver makes the same multiple hand signs in the same predetermined order near the driver's seat window as the registered behavior pattern, the behavior authentication result determination unit 24 determines that the authentication result of the behavior authentication unit 23 is positive. If the hand signs made by the driver near the driver's seat window are different from the registered hand signs, the order of the hand signs is different, or the driver makes hand signs outside the driver's seat, the behavior authentication result determination unit 24 determines that the authentication result of the behavior authentication unit 23 is negative. In this case, by making the driver's seat window being fully closed a constraint condition for behavior authentication, it is possible to prevent spoofing in which a malicious third party reaches into the vehicle interior from outside the vehicle interior to perform behavior authentication.

[0030] For example, when a behavior pattern in which the driver touches multiple equipment items such as a seat belt, rearview mirror, headrest, steering wheel, shift lever, and display 61 in a predetermined order is registered in advance, if the driver touches the same multiple registered equipment items in the same predetermined order, the behavior authentication result determination unit 24 determines that the authentication result of the behavior authentication unit 23 is positive. If the equipment items touched by the driver are different from the registered equipment items or the order in which the equipment items are touched is different from the registered order, the behavior authentication result determination unit 24 determines that the authentication result of the behavior authentication unit 23 is negative.

[0031] For example, when a behavior pattern in which the driver holds an electronic key in his / her hand and pauses the hand holding the electronic key at at least one specific position in the vehicle interior space is registered in advance, if the driver performs the same registered behavior, the behavior authentication result determination unit 24 determines that the authentication result of the behavior authentication unit 23 is positive. If the position where the driver pauses the hand holding the electronic key is different from the registered position or if the driver pauses the hand without holding the electronic key, the behavior authentication result determination unit 24 determines that the authentication result of the behavior authentication unit 23 is negative. In this case, the electronic key may be given a distinctive pattern or may be illuminated so that the driver camera 31 can easily recognize the electronic key.

[0032] In addition to the above-mentioned hand signs, actions of touching accessories, and actions of using an electronic key, driver behavior authentication may also be a combination of facial expression changes such as opening and closing eyes, opening and closing mouth, gaze movement, mouth movement without vocalization, etc. Also, some of the behavior patterns such as making multiple hand signs in a predetermined order, touching multiple accessories in a predetermined order, using an electronic key, and patterns of facial expression changes may be combined.

[0033] The face authentication unit 25 performs face authentication of the driver by comparing the face image of the driver with a face image registered in advance. That is, the face authentication unit 25 uses the driver camera 31 that originally captures an image for determining whether the driver is in a suitable driving state or an unsuitable driving state, and uses the face image of the driver captured by the driver camera 31 for face authentication before starting the engine. In this case, the LED 32 is also linked, and the LED 32 performs a lighting operation while the driver camera 31 is performing an imaging operation.

[0034] When the face authentication unit 25 performs face authentication of the driver, the face authentication result determination unit 26 determines the authentication result of the face authentication unit 25. That is, when the face authentication result determination unit 26 determines that the face image of the driver and the face image registered in advance match, it determines that the authentication result of the face authentication unit 25 is positive, and when it determines that the face image and the face image registered in advance do not match, it determines that the authentication result of the face authentication unit 25 is negative. The face authentication result determination unit 26 extracts facial feature points such as eyes, nose, mouth, eyebrows, etc., and when it determines that the matching rate of the feature points between the face image of the driver and the face image registered in advance is equal to or higher than a predetermined rate, it determines that the authentication result of the face authentication unit 25 is positive, and when it determines that the matching rate is not equal to or higher than the predetermined rate, it determines that the authentication result of the face authentication unit 25 is negative.

[0035] The start control unit 27 determines whether to permit or prohibit the start of the engine based on the determination result of the key authentication result determination unit 22, the determination result of the behavior authentication result determination unit 24, and the determination result of the face authentication result determination unit 26. When the start control unit 27 determines to permit the start of the engine, it outputs an engine start signal to the engine ECU 8 to start the engine.

[0036] When the behavior authentication result determination unit 24 determines that the determination result is negative, the error notification unit 28 causes the display 61 to display an error notification screen indicating that the behavior pattern performed by the driver is different from the pre-registered behavior pattern and that an error has occurred.

[0037] Next, the operation of the above-mentioned configuration will be described with reference to FIGS. When the engine is stopped, the control device 2 waits for the reception of authentication information transmitted from the electronic key. When the control device 2 receives the authentication information transmitted from the electronic key and the start condition for the engine start control process is satisfied, the control device 2 starts the engine start control process.

[0038] When the control device 2 starts the engine start control process, it performs key authentication using the electronic key (S1, which corresponds to the key authentication procedure). The control device 2 judges the authentication result of the key authentication (S2, which corresponds to the key authentication result judgment procedure), and if it determines that the authentication information transmitted from the electronic key matches the pre-registered authentication information, it judges that the authentication result of the key authentication is positive and that the key authentication has been successful (S2: YES). On the other hand, if the control device 2 determines that the authentication information transmitted from the electronic key does not match the pre-registered authentication information, it judges that the authentication result of the key authentication is negative and that the key authentication has failed (S2: NO), and ends the engine start control process.

[0039] When the control device 2 determines that the key authentication is successful, it unlocks the door (S3). The driver can get in the vehicle by unlocking the door. The control device 2 waits for the driver to perform an engine start operation and presses the start button (S4). When the control device 2 determines that the driver has pressed the start button (S4: YES), it issues a behavior authentication guidance (S5). As shown in FIG. 3, the control device 2 displays a behavior authentication guidance screen on the display 61 to prompt the driver to perform behavior authentication, and outputs a behavior authentication guidance voice from the speaker 62. The driver can understand that behavior authentication should be performed by the behavior authentication guidance screen being displayed on the display 61 and the behavior authentication guidance voice being output from the speaker 62.

[0040] Furthermore, when the control device 2 determines that the driver has pressed the start button, it drives the driver camera 31 and the LED 32. By driving the driver camera 31 and the LED 32, even before the engine is started, light emitted from the LED 32 is irradiated on the driver, and the driver can be imaged by the driver camera 31. Note that the control device 2 may drive the driver camera 31 and the LED 32 after the driver unlocks the door, rather than after the driver presses the start button.

[0041] The control device 2 performs behavior authentication of the driver using an image captured by the driver camera 31 (S6, corresponding to the behavior authentication procedure). The control device 2 judges the authentication result of the behavior authentication (S7, corresponding to the behavior authentication result judgment procedure), and if it is determined that the behavior pattern performed by the driver matches the pre-registered behavior pattern, it judges that the authentication result of the driver's behavior authentication is positive and the driver's behavior authentication is successful (S7: YES). On the other hand, if it is determined that the behavior pattern performed by the driver does not match the pre-registered behavior pattern, it judges that the authentication result of the driver's behavior authentication is negative and the driver's behavior authentication has failed (S7: NO).

[0042] When the control device 2 determines that the driver's behavior authentication is successful, it determines whether or not to permit the engine to start (S8, which corresponds to the start permission procedure), outputs an engine start signal to the engine ECU 8, starts the engine (S9), and ends the engine start control process. On the other hand, when the control device 2 determines that the driver's behavior authentication is unsuccessful, it determines whether or not to prohibit the engine from starting (S10, which corresponds to the start inhibition procedure), notifies the driver of an error (S11), and ends the engine start control process. As shown in FIG. 4, the control device 2 displays an error notification screen indicating the failure of the driver's behavior authentication on the display 61 and outputs an error notification sound from the speaker 62. The driver can understand that the engine is not started due to the failure of the driver's behavior authentication by the error notification screen being displayed on the display 61 and the error notification sound being output from the speaker 62.

[0043] In addition, the configuration is not limited to performing driver behavior authentication every time the driver gets in the vehicle, and whether or not to perform behavior authentication may be classified according to time period. That is, in a first predetermined time period, driver behavior authentication may be required, and engine start permission may be determined on condition that key authentication and driver behavior authentication are both successful, while in a second predetermined time period, driver behavior authentication may not be required, and engine start permission may be determined on condition that key authentication is only successful.

[0044] The above has been an example of displaying various screens on the display 61 and outputting various sounds from the speaker 62 as notifications to the driver, but it is also possible to only display various screens on the display 61 or only output various sounds from the speaker 62.

[0045] As described above, according to the first embodiment, the following advantageous effects can be obtained. In the engine start control device 7, instead of using only the authentication result of the key authentication to determine whether to permit or prohibit engine start, the authentication result of the key authentication and the authentication result of the driver's behavior authentication are used to determine whether to permit or prohibit engine start. This makes it possible to prevent engine start due to unauthorized key authentication, and appropriately suppress engine start. In addition, since behavior authentication is performed using the driver camera 31 and LED 32, which are originally used to determine whether the driver is in a suitable or unsuitable state for driving, it can be realized without adding a new camera or LED just for behavior authentication.

[0046] Second embodiment The third embodiment will be described with reference to Fig. 5 and Fig. 6. The first embodiment is configured to perform key authentication and driver behavior authentication, while the second embodiment is configured to perform driver face authentication in addition to key authentication and driver behavior authentication.

[0047] When the control device 2 determines that the driver's behavior authentication is successful (S7: YES), it performs face authentication of the driver (S21). The control device 2 determines the authentication result of the face authentication (S22), and when it determines that the driver's face image matches the pre-registered face image, it determines that the authentication result of the driver's face authentication is correct and that the driver's face authentication is successful (S22: YES). When the control device 2 determines that the face authentication is successful, it decides to permit the engine to start (S8), outputs an engine start signal to the engine ECU 8, starts the engine (S9), and ends the engine start control process.

[0048] On the other hand, when the control device 2 determines that the driver's face image does not match the preregistered face image, it determines that the driver's face authentication result is negative and that the driver's face authentication has failed (S22: NO). It decides to prohibit engine start (S10, corresponding to the start suppression procedure), notifies an error (S11), and ends the engine start control process. In this case, as shown in FIG. 6, the control device 2 displays an error notification screen indicating the failure of the driver's behavior authentication on the display 61 and outputs an error notification sound from the speaker 62. The driver can understand that the engine will not start due to the failure of the driver's face authentication by the error notification screen being displayed on the display 61 and the error notification sound being output from the speaker 62.

[0049] As described above, according to the second embodiment, in addition to the key authentication and the driver's behavior authentication, the driver's face authentication is performed, and permission to start the engine is determined on the condition that the key authentication, the driver's behavior authentication, and the driver's face authentication are successful. By adding the driver's face authentication, the level of security can be increased. That is, although behavior authentication may be imitated by a malicious third party, the level of security can be increased by adding the face authentication that collates facial features.

[0050] Third embodiment The third embodiment will be described with reference to Fig. 7 to Fig. 10. In the first embodiment, when it is determined that the driver's behavior authentication has failed, the engine start prohibition is immediately determined, whereas in the third embodiment, an opportunity to retry the driver's behavior authentication is given.

[0051] The control device 2 includes a retry notification unit 29 in addition to the units 21 to 28. When the determination result of the behavior authentication result determination unit 24 is determined to be negative, the retry notification unit 29 issues a behavior authentication retry notification.

[0052] When the control device 2 determines that the driver's behavior authentication has failed (S7: NO), it does not immediately decide to prohibit engine start, but increments the number of retries (S31) and determines whether the incremented number of retries has reached a specified number (e.g., several times) (S32). When the control device 2 determines that the incremented number of retries has not reached the specified number (S32: NO), it notifies the driver of a retry (S33). As shown in FIG. 9, the control device 2 displays a retry notification screen on the display 61 to prompt the driver to retry the behavior authentication, and outputs a retry notification sound from the speaker 62. The driver can understand that he should retry the behavior authentication by the retry notification screen being displayed on the display 61 and the retry notification sound being output from the speaker 62.

[0053] On the other hand, when the control device 2 determines that the incremented number of retries has reached the specified number (S32: YES), it decides to prohibit engine start (S10), notifies an error (S11), and ends the engine start control process. As shown in Fig. 10, the control device 2 causes an error notification screen indicating that the number of failures in the driver's behavior authentication has reached the specified number to be displayed on the display 61, and causes an error notification sound to be output from the speaker 62. The driver can understand that the engine cannot be started because the number of failures in the driver's behavior authentication has reached the specified number by seeing the error notification screen displayed on the display 61 and the error notification sound output from the speaker 62.

[0054] As described above, according to the third embodiment, when it is determined that the driver's behavior authentication has failed, the engine start is not immediately prohibited, but an opportunity to retry the driver's behavior authentication is given. This increases the possibility of allowing the engine to start, and provides a realistic usage pattern.

[0055] (Fourth embodiment) The fourth embodiment will be described with reference to Fig. 11 and Fig. 12. The first embodiment is configured to determine whether or not to prohibit engine start when it is determined that the driver's behavior authentication has failed, whereas the fourth embodiment is configured to determine whether or not to permit engine start by applying a restriction.

[0056] When the control device 2 determines that the driver's behavior authentication has failed (S7: NO), it imposes a restriction and determines whether or not to permit the engine to start (S41, which corresponds to the start suppression procedure), notifies the user of an error (S11), and ends the engine start control process. As shown in FIG. 12, the control device 2 displays an error notification screen indicating the failure of the driver's behavior authentication on the display 61 and outputs an error notification voice from the speaker 62. The driver can understand that the engine will be started with a restriction imposed due to the failure of the driver's behavior authentication by seeing the error notification screen displayed on the display 61 and the error notification voice output from the speaker 62. The imposed restriction is, for example, turning on an acceleration suppression function when the accelerator pedal is suddenly operated, fixing the timing of collision damage mitigation braking (AEB (Autonomous Emergency Braking)) to an early mode, and the like.

[0057] As described above, according to the fourth embodiment, even if the driver's behavior authentication fails, it is possible to impose restrictions and permit engine start.

[0058] (Other embodiments) Although the present disclosure has been described based on the embodiment, it is understood that the present disclosure is not limited to the embodiment or structure. The present disclosure also includes various modifications and modifications within the equivalent range. In addition, various combinations and forms, as well as other combinations and forms including only one element, more than one element, or less than one element, are also within the scope and concept of the present disclosure.

[0059] Any combination of some of the first to fourth embodiments may be used. For example, the second and third embodiments may be combined to adopt a configuration in which face recognition is performed and a configuration in which an opportunity to retry the driver's behavior recognition may be further adopted.

[0060] The control unit and the method described in the present disclosure may be realized by a special-purpose computer provided by configuring a processor and a memory programmed to execute one or more functions embodied in a computer program. Alternatively, the control unit and the method described in the present disclosure may be realized by a special-purpose computer provided by configuring a processor with one or more dedicated hardware logic circuits. Alternatively, the control unit and the method described in the present disclosure may be realized by one or more special-purpose computers configured by a combination of a processor and a memory programmed to execute one or more functions and a processor configured with one or more hardware logic circuits. Also, the computer program may be stored in a computer-readable non-transitory tangible recording medium as instructions executed by a computer.

Claims

1. A key authentication unit (21) for performing key authentication using an electronic key; a key authentication result determination unit (22) for determining an authentication result of the key authentication; A behavior authentication unit (23) for authenticating the behavior of a driver; a behavior authentication result determination unit (24) that determines an authentication result of the behavior authentication; A face authentication unit (25) for authenticating the face of a driver; A face authentication result determination unit (26) that determines an authentication result of the face authentication; a start control unit (27) that permits start of a drive mechanism when it is determined that all of the authentication results of the key authentication, the behavior authentication, and the face authentication are positive as a result of authentication being performed in the order of the key authentication, the behavior authentication, and the face authentication, and that inhibits start of the drive mechanism when it is determined that at least one of the authentication results of the key authentication, the behavior authentication, and the face authentication is negative; The start-up control unit of the drive mechanism allows the start-up of the drive mechanism when it is determined that the authentication result of the key authentication, the authentication result of the behavior authentication, and the authentication result of the face authentication are all positive during a first specified time period, and allows the start-up of the drive mechanism when it is determined that the authentication result of the key authentication is positive during a second specified time period different from the first specified time period.

2. An error notification unit (28) for notifying an error, The start control device for a drive mechanism according to claim 1 , wherein the error notification unit issues the error notification when the authentication result of the key authentication is determined to be positive but the authentication result of the behavior authentication is determined to be negative.

3. A retry notification unit (29) for issuing a retry notification, The start control device for a drive mechanism as described in claim 1 , wherein the retry notification unit issues the retry notification when the authentication result of the key authentication is determined to be positive but the authentication result of the behavior authentication is determined to be negative.

4. An error notification unit (28) for notifying an error, The start control device for a drive mechanism according to claim 3 , wherein the error notification unit issues the error notification when the number of times that the authentication result of the behavior authentication is determined to be negative reaches a prescribed number.

5. A start control device for a drive mechanism described in any one of claims 1 to 4, wherein the start control unit of the drive mechanism suppresses the start of the drive mechanism, thereby prohibiting the start of the drive mechanism.

6. The start control device for a drive mechanism according to claim 1 , wherein the start control section for the drive mechanism suppresses the start of the drive mechanism, and permits the start of the drive mechanism with a restriction.

7. A start control device for a drive mechanism described in any one of claims 1 to 6, wherein the behavior authentication unit performs the behavior authentication on actions performed by a driver near the window of the driver's seat while seated in the driver's seat.

8. The start control device for a drive mechanism according to claim 1 , wherein the behavior authentication unit performs the behavior authentication on a behavior of the driver touching an equipment inside the vehicle.

9. The start control device for a drive mechanism according to claim 1 , wherein the behavior authentication unit performs the behavior authentication on the driver's behavior using the electronic key.

10. A start control device (7) for a drive mechanism, a key authentication procedure for performing key authentication using an electronic key; a key authentication result determination procedure for determining an authentication result of the key authentication procedure; A behavior authentication procedure for authenticating a driver's behavior; a behavior authentication result determination procedure for determining an authentication result of the behavior authentication procedure; A facial recognition procedure for performing facial recognition of the driver; a face authentication result determination step for determining an authentication result of the face authentication step; a start permission procedure for permitting the start of the drive mechanism when it is determined that the authentication results of the key authentication result determination procedure, the behavior authentication result determination procedure, and the face authentication are all positive because authentication has been performed in the order of the key authentication, the behavior authentication, and the face authentication during a first predetermined time period, and for permitting the start of the drive mechanism when it is determined that the authentication result of the key authentication is positive during a second predetermined time period different from the first predetermined time period; A start-up control program for a drive mechanism that executes a start-up suppression procedure for suppressing the start-up of the drive mechanism when it is determined that at least one of the authentication results of the key authentication, the authentication result of the behavior authentication, and the authentication result of the face authentication is negative.

Images