Secure method for starting a vehicle and corresponding vehicle

Abstract

The invention relates to a motor vehicle (1) comprising: - a parking brake (14); - a protection module (17) capable of authenticating an electronic key (5); - electronic command means (11) for controlling an actuator of a transmission chain, these means being capable of allowing a user command (20) to act on the actuator only upon receipt of a transmission authorization provided by the protection module (17); and - electronic control means (15) for controlling the parking brake (14), these means being capable of releasing the parking brake (14) only upon receipt of a wheel release authorization provided by the protection module (17), the protection module (17) being capable of sending the wheel release authorization and the transmission authorization only on positive authentication results for the electronic key (5), the electronic command means (11) and the electronic control means (15).

Description

Description Title of the invention: Safe method for starting a vehicle and corresponding vehicle

[0001] The present invention relates to the field of the automotive industry, and more specifically concerns a motor vehicle and a method of starting the vehicle, which meet the regulatory requirements for protection against unauthorized use of the vehicle.

[0002] UN Regulation (R116) No. 16 mandates an anti-theft system on private vehicles and light commercial vehicles to prevent them from being maneuvered and / or moved without the vehicle key. This regulation authorizes the use of several techniques, including locking the vehicle's parking brake, particularly an automatic or electric parking brake, which in modern vehicles replaces the manual parking brake. It also permits locking the vehicle's gearshift control or the steering column.

[0003] Current solutions therefore consist of a mechanical locking mechanism for the automatic or electric parking brake, the steering column, or the vehicle's gearbox. Generally, this locking is applied to only one of these components, and in such a way that the locked component cannot be easily unlocked without the key. In particular, when this unlocking mechanism uses a locking pin, the pin must not be easily accessible, and the locked component must not be easily interchangeable with an identical component from a vehicle of the same type.

[0004] These mechanical constraints are costly, as they require integrating into the vehicle a locking pin not initially present on the part to be locked, an actuator to activate or deactivate this locking pin, and a mechanical preventer for the removal of either the locking pin or the part to be locked. Furthermore, this last constraint is not always compatible with after-sales requirements.

[0005] The present invention aims to remedy at least in part the aforementioned disadvantages by providing a motor vehicle and a method for starting the vehicle, which effectively prohibit unauthorized driving of the vehicle, without costly mechanical integration and without blocking after-sales vehicle repairs.

[0006] To this end, the invention proposes a motor vehicle comprising at least: - a parking brake, - a vehicle protection module capable of authenticating an electronic vehicle access key, - electronic control means for an actuator of a vehicle's transmission chain, and - electronic means for controlling the parking brake, capable, when the vehicle is in a start-up phase, of maintaining the parking brake in the engaged position on a wheel of the vehicle and of releasing the parking brake only upon receipt of authorization to release the wheel provided by the vehicle protection module, the vehicle being characterized in that the electronic control means are capable of preventing, when the vehicle is in the start-up phase, a user command from acting on the actuator, and are capable of allowing the user command to act on the actuator only upon receipt of transmission authorization provided by the vehicle protection module, and in that the protection module is capable of sending the authorization to release the wheel and the transmission authorization only upon a positive result of an authentication of the electronic key,a positive result from an authentication of the electronic control means of the actuator and a positive result from an authentication of the electronic control means of the parking brake.

[0007] The start-up phase here refers to the necessary operations carried out in particular by the vehicle driver, and its computers, in order to deprotect and start the vehicle's engine.

[0008] Thanks to the invention, no mechanical locking finger integration is necessary, since the vehicle's parking brake is used, along with software to inhibit a user command, for example on a gearshift or steering column, to prevent the vehicle from moving and / or maneuvering. Although not specified, the parking brake is either automatic or electric.

[0009] Locking two components that control the vehicle's operation, rather than just one, to prevent unauthorized driving improves vehicle protection while minimizing the need for specific vehicle modifications and meeting type-approval testing requirements. Indeed, despite the absence of any additional hardware to the vehicle to provide this anti-theft protection, the invention requires a significant amount of time to bypass this protection. This is because it would necessitate changing the protection module, the electronic control devices, and the electronic command system in order to replay the authentication sequence required to unlock the vehicle's wheel and the transmission actuator.

[0010] It should be noted that the vehicle's electronic key here refers to an electronic key capable of communicating over a short-range radio link.

[0011] Furthermore, when a vehicle user has parked their vehicle in cold weather mode, the electronic parking brake control system is capable, during the start-up phase, of keeping the parking brake in the released position on the vehicle wheel. In this cold weather mode, receiving authorization to release the wheel via the electronic control system will not affect the vehicle's wheel, but the disengagement of the user command intended for the drivetrain actuator will always be contingent upon successful authentication of the electronic key, the electronic control system, and the electronic control unit. Thus, in cold weather mode, an unauthorized user may be able to move the vehicle but will not be able to turn the steering wheel or start the engine.

[0012] The drive unit actuator is, for example, an electric traction or propulsion machine for the vehicle. In this case, the user command is generated, for example, by a gear lever and corresponds to a command to shift from neutral to forward or reverse. Since the vehicle has a control unit for the electric machine, the electronic control system is designed, for example, during the vehicle start-up phase, to only activate the control unit and transmit a direction-of-rotation instruction for the electric machine, corresponding to the user command, upon receiving transmission authorization. This implementation has the advantage of preventing unauthorized users from starting the vehicle without requiring significant software changes to the electric machine's control system.

[0013] Of course, the invention is not limited to a vehicle with an electric traction or propulsion machine. Alternatively, the actuator could be, for example, the vehicle's internal combustion engine. In yet another variant, the user command is generated by an electronically controlled steering column. In this case, the actuator would be an active steering actuator.

[0014] Furthermore, in one embodiment of the invention, the protection module is implemented in a computer separate from at least one computer implementing the electronic control means for the actuator and the electronic control means for the parking brake. Preferably, the protection module is implemented in a computer separate from, on the one hand, a transmission computer implementing the electronic control means for the actuator, and on the other hand, a parking brake computer implementing the electronic control means for the parking brake. Thus, each of the transmission or parking brake computers must authenticate separately with the protection module's control unit. If the actuator is an electric machine and the vehicle has an electric machine control unit, the control unit may be separate from the transmission control unit, or identical to it. When the control unit is separate from the transmission control unit, it must also authenticate with the protection module's control unit.

[0015] The protection module's control unit is, for example, a master control unit, and at least one other control unit, or the parking brake and transmission control units, are slave control units. Thus, it is the protection module's control unit that wakes up the other two control units after the vehicle's electronic key is authenticated, adding an extra layer of protection against unauthorized driving, since this renders the electronic control and monitoring systems inoperative until the vehicle's electronic key is authenticated.

[0016] The invention also relates to a method for starting a vehicle, the vehicle comprising: - a vehicle protection module, - a parking brake, - electronic means for controlling the parking brake, - an actuator for a vehicle's transmission chain, and - electronic control means for the actuator, the start-up process comprising the following steps: - maintaining the parking brake in the engaged position on one wheel of the vehicle, using electronic parking brake control systems - Inhibition of user commands intended for the actuator by electronic control means, - authentication of an electronic vehicle access key by the protection module, then once the electronic key has been authenticated: - authentication of the actuator's electronic control means by the protection module, - authentication of the electronic means of controlling the parking brake by the protection module, - sending by the protection module an authorization to unlock the wheel to the electronic control means and an authorization to transmit to the electronic control means, only when the authentications of the electronic control means and the electronic control means are successful.

[0017] When the authentication of the electronic control means and electronic monitoring means is successful, the sending step is followed by a step of unlocking the wheel by electronic control means and a step of disinhibiting user commands intended for the actuator.

[0018] To limit the execution time of the process, the authentication steps for the electronic control means and the electronic control means are, for example, performed in parallel by the protection module. Alternatively, the authentication of the actuator's electronic control means by the protection module takes place before the authentication of the parking brake's electronic control means by the protection module. In another variant, the authentication of the parking brake's electronic control means by the protection module takes place before the authentication of the actuator's electronic control means by the protection module.

[0019] Furthermore, in an embodiment where the actuator is an electric machine and the vehicle includes a control unit for the electric machine, the sending step is followed by a step of receiving transmission authorization via the electronic control means, and then by a step of disabling user commands intended for the actuator. This disabling step involves activating the control unit via the electronic control means and authenticating the control unit by the protection module. In other words, the control unit is separate from the transmission control unit and is activated by the transmission control unit as soon as the latter receives transmission authorization.

[0020] Furthermore, the start-up procedure according to the invention includes a preliminary step of pairing the protection module with both the electronic control means and the electronic command means. This preliminary step enables the authentication of the control units with each other and is carried out securely at the factory or at a dealership using a remote server provided by the vehicle manufacturer. In other words, this step cannot be performed with blank control units outside of a secure environment established by the vehicle manufacturer.

[0021] Other features and advantages of the invention will become apparent from the following description on the one hand, and from several illustrative and non-limiting examples of embodiments given with reference to the attached schematic drawings on the other hand, in which:

[0022] [Fig. 1] represents a motor vehicle according to the invention, in an embodiment of the invention, as well as various communications between entities of the vehicle cooperating to authorize driving the vehicle upon opening of doors controlled by an electronic key of the vehicle,

[0023] [Fig. 2] illustrates steps in a starting procedure according to the invention, for the vehicle of [Fig. 1], in one embodiment of the invention, and

[0024] [Fig.3] details some steps in the start-up process of [Fig.2], involving the vehicle's electronic key and computers performing a chain of authentications.

[0025] According to one embodiment of the invention shown [Fig. 1], a motor vehicle 1 according to the invention comprises, in particular: - a parking brake 14, comprising a motor acting on a caliper capable of locking a wheel of vehicle 1, and - electronic control means 15 of the parking brake 14, implemented in a parking brake control unit, and capable of sending commands 26 to the brake motor 14 to close or open the brake caliper 14, i.e., to apply or release the parking brake 14 on the wheel of vehicle 1; in other words, the electronic control means 15 of the parking brake 14 are capable of locking or unlocking the wheel of vehicle 1. Of course, the electronic control means 15 of the parking brake can optionally control the locking or unlocking of several of the wheels of vehicle 1.

[0026] Furthermore, in this embodiment of the invention, the vehicle 1 comprises an electric traction or propulsion machine 12, and a control unit 13 for the electric machine 12. The control unit 13 is capable of receiving a direction of rotation command 22 from the electric machine 12, and therefore from the wheels of the vehicle 1, sent by a transmission control unit implementing electrical control means 11 for the electric machine 12. These electrical control means 11 are connected to a gear lever 10 of the vehicle 1. The positions selected by a user of the vehicle on the gear lever 10, when the use of the vehicle 1 is authorized, are translated into user commands 20 and sent to the electrical control means 11 via a wired connection.

[0027] More specifically, gear lever 10 includes: - a neutral position N, corresponding to a user command 20 requesting the stopping of the drive wheels of the vehicle 1 by the electric machine 12; This neutral position N is the default position of the gear lever 10 when the vehicle is stopped and asleep; - a forward driving position D, corresponding to a user command 20 requesting the electric machine 12 to move the vehicle 1 forward; and - a reverse position R, corresponding to a user command 20 asking the electric machine 12 to reverse the vehicle 1.

[0028] The user commands 20 corresponding to the forward D and reverse R positions are converted by the electrical control means 11, when The use of vehicle 1 is authorized, with opposing direction instructions 22. These direction instructions 22 are sent to the control unit 13 via a wired connection. The control unit 13 then sends control signals 24 via a wired connection to an inverter (not shown), which supplies power to the electric machine 12.

[0029] It should be noted that the parking brake 14 is automatically activated when vehicle 1 is stationary, but the vehicle also has a parking brake 14 activation button that can be deactivated in cold weather mode. This activation button is, for example, located on the gear lever 10 of vehicle 1. Alternatively, cold weather mode is automatically activated by the vehicle based on data it has acquired.

[0030] Finally, vehicle 1 includes a protection module 17, implemented in software within a dedicated computer. This protection module 17 includes a wireless communication module, enabling it to communicate with an electronic key 5 of vehicle 1. The protection module 17 is thus capable of authenticating the electronic key 5 through radio message exchanges 30. It is also capable of authenticating the electronic control devices 15 through message exchanges 34 over a wired connection, and of authenticating the electronic control devices 11 through message exchanges 32 over a wired connection. Of course, other types of connections are possible, such as Bluetooth® wireless connections.

[0031] It should be noted that in this embodiment of the invention, the authentication of the electronic control means 15 by the protection module 17 amounts to the authentication of the parking brake control unit by the control unit of the protection module 17, and that the authentication of the electronic control means 11 by the protection module 17 amounts to the authentication of the transmission control unit by the control unit of the protection module 17. Furthermore, in this embodiment of the invention, the control unit of the protection module 17 is a master control unit, and the transmission and parking brake control units are slave control units.

[0032] In normal operation, that is, outside of extreme cold weather conditions, when vehicle 1 is stationary and the engine is off, the parking brake 14 locks the wheel of vehicle 1, and the gear lever 10 is deactivated, meaning that the user controls 20 of the gear lever 10 are disabled. The invention prevents an unauthorized user from easily unlocking the wheel and the user controls 20 of the gear lever when they do not have the electronic key 5 for vehicle 1.

[0033] For this purpose, as described now with reference to [Fig.2], a method 100 for starting vehicle 1 according to the invention, implemented by vehicle 1, must be executed to unlock the wheel of vehicle 1, activate the gear lever 10 and start vehicle 1.

[0034] A preliminary step 102 of the process 100 is the pairing of the protection module 17 with the electronic key 5, the electronic control means 15 and the electronic control means 11. This pairing is carried out at the factory and consists for example of: - registering a VIN code (for the English "Vehicle Identification Number") in the computer of the protection module 17 and in the electronic key 5, then equipping the electronic key 5 and the protection module 17 with a code specific to the electronic key 5 and a first secret key associated with a symmetric AES (from the English "Advanced Encryption Standard") 128-bit encryption and decryption algorithm;

[0035] - to equip the electronic control means 11 and the protection module 17 of a second secret key associated with an AES symmetric encryption and decryption algorithm, and a code specific to the transmission computer; and

[0036] - to equip the electronic control means 15 and the protection module 17 with a third secret key associated with an AES symmetric encryption and decryption algorithm, and with a code specific to the parking brake computer.

[0037] Following this preliminary step 102, it is assumed that in the life cycle of vehicle 1, it is parked and asleep, in nominal mode.

[0038] During all this parking and sleeping of the vehicle, the parking brake 14 is held 104 in the engaged position on the wheel of the vehicle 1, and the user controls 20 of the gear lever 10 are inhibited 110. The holding 104 of the parking brake 14 in the engaged position is effective as long as the electronic control means 15 do not receive authorization to release the wheel, and the inhibition 110 of the user controls 20 is effective as long as the electronic control means 11 do not receive authorization to transmit.

[0039] Let us now assume that a user activates the electronic key 5 to unlock vehicle 1. The protection module 17 then receives an unlock command 302 (referenced in [Fig. 3]), sent by the electronic key 5, and then authenticates it. These steps are represented by the message exchanges 302 to 306 shown in [Fig. 3]. Message 302 is the command to unlock the doors of vehicle 1, sent by the electronic key 5 to the protection module 17. It includes, for example, a wake-up code and the VIN code of vehicle 1. The following message 304 is an authentication request for the electronic key 5 sent by the protection module 17 to the electronic key 5 in encrypted form using the first secret key and the AES encryption algorithm.Finally, the following message 306 is the code specific to the electronic key 5, encrypted using the first secret key and the AES encryption algorithm, and is sent by the electronic key 5 to the protection module 17. When the protection module 17 receives this last message 306, it authenticates 118 the electronic key 5 by decrypting the code specific to the key. electronic 5 and by comparing it 120 to the code specific to the electronic key 5 that it has in its memory.

[0040] If this decryption results in a code identical to the code specific to the electronic key 5, in memory in the protection module 17, then this authentication 118 succeeds (branch Y), and the protection module 17 commands the opening of the doors of the vehicle 1 and then begins to wake up certain computers of the vehicle.

[0041] If, on the contrary, the protection module 17 fails to decipher the last message 306 or does not recognize the code specific to the electronic key 5 in this last message 306, then the authentication 118 of the electronic key 5 fails (branch N) and the process 100 does not continue until a new authentication of the electronic key 5 results in successful authentication.

[0042] In this example of use of the invention, it is assumed that the authentication 118 of the electronic key 5 is successful. The protection module 17 then wakes up, in particular, the transmission and parking brake control units, and then authenticates them 122, 126. These authentications preferably take place in parallel with each other, although for simplicity the authentication 122 of the transmission control unit is shown before the authentication 126 of the parking brake control unit in Figures 2 and 3.

[0043] The authentication 122 of the transmission computer comprises messages 322 and 324, referenced in [Fig. 3]. The first message, 322, is an authentication request from the transmission computer, sent by the protection module 17 to the transmission computer in encrypted form using the second secret key and the AES encryption algorithm. The second message, 324, is a response from the transmission computer, sent to the protection module 17, containing the transmission computer's own code, encrypted using the second secret key and the AES encryption algorithm. When the protection module 17 receives this second message, 324, it authenticates the transmission computer by decrypting the transmission computer's own code contained in the second message, 324, and comparing it to the transmission computer's own code stored in its memory.

[0044] When these two codes coincide, the 122 authentication of the transmission computer is successful (branch Y).

[0045] If, on the contrary, the protection module 17 fails to decipher the second message 324 or if the two codes used in this authentication 122 do not coincide, then the authentication 122 of the transmission computer has failed (branch N) and the process 100 does not continue until a new authentication of the transmission computer results in a successful authentication.

[0046] Similarly, the parking brake control unit authentication 126 includes messages 342 and 344 referenced [Fig. 3]. The first 342 of these messages is a A parking brake control unit authentication request is sent by the protection module 17 to the parking brake control unit in encrypted form using the third secret key and the AES encryption algorithm. The second of these messages is a response from the parking brake control unit, sent to the protection module 17, containing the parking brake control unit's own code, encrypted using the third secret key and the AES encryption algorithm. When the protection module 17 receives the second of these messages, it authenticates the parking brake control unit by decrypting the parking brake control unit's own code contained in the second message and comparing it to the parking brake control unit's own code stored in its memory.

[0047] When these two codes coincide, the 126 authentication of the parking brake control unit is successful (branch Y).

[0048] If, on the other hand, the protection module 17 fails to decipher the second 344 of the messages or if the two codes used in this authentication 126 do not coincide, then the authentication 126 of the parking brake control unit has failed (branch N) and the process 100 does not continue until a new authentication of the parking brake control unit results in a successful authentication.

[0049] Of course, other types of authentication of the electronic key 5, and of transmission and parking brake computers, for example more robust, are conceivable.

[0050] In this example of use of the invention, it is assumed that the authentications 122, 126 of the transmission and parking brake computers are successful. Only under this condition does the process 100 continue by sending 130 a message 346 authorising the unlocking of the wheel to the electronic control means 15 and a message 326 authorising the transmission to the electronic control means 11. This sending 130 is carried out by the protection module 17.

[0051] The parking brake control unit, having been activated and authenticated, awaits authorization to release the wheel before releasing the parking brake. As soon as it receives this authorization (branch Y), the electronic control means command the release of the parking brake caliper, thus unlocking the wheel of vehicle 1.

[0052] Similarly, the transmission computer 11, being awake and authenticated, waits 112 for the transmission authorization to wake up the control computer 13. As soon as it receives this authorization (branch Y), the electronic control means 11 activate the control computer, which authenticates itself with the protection module 17, and the electronic control means 11 uninhibit 114 the user commands 20. In other words, they convert the user commands 20 corresponding to a reverse or forward command into corresponding direction of rotation instructions 22.

[0053] It should be noted that in extreme cold mode, with the parking brake 14 released when parked, the receipt of the authorization to unlock the wheel by the electronic control means 15 does not trigger the unlocking of the wheel, but the authentication 126 of the electronic control means 15 remains necessary to authorize the disinhibition 114 of the user controls 20 of the gear lever 10.

[0054] Of course, the invention is not limited to the examples just described, and many modifications can be made to these examples without departing from the scope of the invention. In particular, the invention is not limited to electric or hybrid vehicles. In the case of an internal combustion engine vehicle, the inhibition of the gearshift controls is, for example, performed by a control unit of a steering mechanism, or is replaced by an inhibition of an ignition or fuel injection system, using a control unit of the internal combustion engine vehicle.

Claims

Demands

1. Motor vehicle (1) comprising at least: - a parking brake (14), - a vehicle protection module (17) (1), capable of authenticating an electronic key (5) for accessing the vehicle (1), - electronic control means (11) for an actuator of a vehicle transmission chain (1), and - electronic control means (15) for the parking brake (14), capable, when the vehicle (1) is in a start-up phase, of maintaining the parking brake (14) in the engaged position on a wheel of the vehicle (1) and of releasing the parking brake (14) only upon receipt of authorization to release the wheel provided by the protection module (17) of the vehicle (1), the vehicle (1) being characterized in that the electronic control means (11) are capable of preventing, when the vehicle (1) is in the start-up phase, a user command (20) from acting on the actuator, and are capable of allowing the user command (20) to act on the actuator only upon receipt of transmission authorization provided by the protection module (17) of the vehicle (1),and in that the protection module (17) is capable of sending the wheel unlock authorization and the transmission authorization only upon a positive result of an authentication (118) of the electronic key (5), a positive result of an authentication (122) of the electronic control means (11) of the actuator and a positive result of an authentication (126) of the electronic control means (15) of the parking brake (14).

2. Motor vehicle (1) according to claim 1, wherein the transmission chain actuator is an electric traction or propulsion machine (12) for the vehicle (1).

3. Motor vehicle (1) according to claim 2, wherein the user control (20) is generated by a gear lever (10) and corresponding to a command to switch from a neutral position to a forward or reverse position, and the vehicle (1) comprising a control computer (13) for the electric machine (12), the electronic control means (11) are suitable, during the vehicle start-up phase (1), to wake up the control computer (13) and to transmit to it a direction of rotation instruction for the electric machine (12) corresponding to the user command (20), only upon receipt of transmission authorization.

4. Motor vehicle (1) according to claim 1, wherein the user control is generated by an electronically controlled steering column.

5. Motor vehicle (1) according to any one of claims 1 to 4, wherein the protection module (17) is implemented in a computer separate from at least one computer implementing the electronic control means (11) of the actuator and the electronic control means (15) of the parking brake (14).

6. Motor vehicle (1) according to claim 5, wherein the control unit of the protection module (17) is a master control unit, and at least one control unit is a slave control unit.

7. Method (100) of starting a vehicle, the vehicle (1) comprising: - a vehicle protection module (17) (1), - a parking brake (14), - electronic control means (15) for the parking brake (14), - an actuator for a vehicle transmission chain (1), and - electronic control means (11) for the actuator, the start-up method (100) comprising the following steps: - maintaining (104), by electronic control means (15) of the parking brake (14), the parking brake (14) in the engaged position on one wheel of the vehicle (1), - inhibition (110) of user commands (20) intended for the actuator, by electronic control means (11), - authentication (118) of an electronic key (5) for accessing the vehicle (1), by the protection module (17), then when the electronic key (5) has been authenticated: - authentication (122) of the electronic control means (11) of the actuator, by the protection module (17), - authentication (126) of the electronic control means (15) of the parking brake (14), by the protection module (17), - sending (130) by the protection module (17) an authorization to unlock the wheel to the electronic control means (15) and an authorization to transmit to the control means electronic (11), only when the authentications of the electronic control means (11) and the electronic control means (15) are successful.

8. Method (100) of starting a vehicle (1) according to claim 7, wherein the authentication steps (122, 126) of the electronic control means (15) and the electronic control means (11) are carried out in parallel by the protection module (17).

9. Method (100) of starting a vehicle (1) according to claim 7 or 8, wherein the actuator is an electric machine (12), the vehicle (1) includes a control computer (13) for the electric machine (12), and the sending step (130, 132) is followed by a transmission authorization receiving step (112) by the electronic control means (11), and then by a disinhibition step (114) of the user commands (20) intended for the actuator, the disinhibition step (114) comprising an activation of the control computer (13) by the electronic control means (11) and an authentication of the control computer (13) by the protection module (17).

10. Method (100) of starting a vehicle (1) according to any one of claims 1 to 9, comprising a prior pairing step (102) of the protection module (17) on the one hand with the electronic control means (15), and on the other hand with the electronic control means (11).

Images