JP2012060482A - Control system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a control system capable of effectively suppressing damages by a relay attack by determining whether or not the relay attack is being performed by using the correlation of electromagnetic wave intensity of signals transmitted from a key to a vehicle and signals transmitted from the vehicle to the key in a smart key system.SOLUTION: A key 3 carried by a user detects an RSSI value of LF signals (polling signals) transmitted from the vehicle in an RSSI detection unit 35 and returns the information by RF signals together with an ID 34. A vehicle 2 detects the RSSI value of the received RF signals in an RSSI detection unit 45. A collation ECU 4 performs collation processing between the ID 34 and a master ID 44, and when the correlation (ratio) of both the RSSI values is within an appropriate range (within the range in the case that the relay attach is not performed), permits the door unlocking and engine start of the vehicle.

Description

  The present invention relates to a control system.

  Smart key systems for vehicles (smart entry systems, smart start systems) are in widespread use. In the current smart key system, for example, when a user performs an operation such as a door handle contact or pressing of an engine start switch, a polling signal is transmitted, and when the ID returned from the smart key is compared with the master ID, Door unlocking and engine starting are executed.

  For example, in Patent Document 1 below, in the smart key system, a means for determining whether or not the occupant intends to continue driving is equipped, and the portable device is separated from the vehicle, and driving continues for those who do not have the portable device. A system is disclosed that permits the restart of the internal combustion engine when there is an intention to prevent theft of the vehicle more reliably.

JP 2007-153190 A

  A theft technique called relay attack is known for smart key systems. It is shown in FIG. In this method, theft persons A and B are located between the vehicle and the owner in a situation where the owner is away from the vehicle. Assume that the owner carries a smart key. Thieves A and B possess radio wave repeaters.

  In this state, first, the thieves A and B relay the polling signal transmitted from the vehicle and transmit it to the owner's place. Normally, the reach range of the polling signal is limited to the periphery of the vehicle, but the polling signal can be sent to the owner by relaying the thieves A and B. When the smart key carried by the owner of the vehicle receives the polling signal, it returns an ID code unique to the smart key stored therein as an RF signal.

  The returned RF signal reaches the vehicle. The vehicle executes a matching process with the master ID on the received RF signal. Since the RF signal is a signal transmitted from the smart key of the owner, the verification is naturally successful. As a result, the vehicle is allowed to unlock the door. In this way, the theft can enter the vehicle.

  Further, when the same procedure is repeated after the thief A has boarded the vehicle, the vehicle interior verification is successful and the vehicle is permitted to start the engine. In this way, the thief can drive the vehicle. The above is the outline of the relay attack.

  Naturally, effective countermeasures against such relay attacks are necessary. As a countermeasure against relay attack, the RSSI (Received Signal Strength Indicator, radio wave intensity, electromagnetic wave intensity, electric field intensity) of the electromagnetic wave of the RF signal transmitted from the smart key to the vehicle is detected, and if the RSSI value is too small, the smart key Therefore, a control system has been proposed that does not permit door unlocking or engine starting because it is determined that a relay attack is being performed.

  However, in the case of this system, the high resolution required for the RSSI detection means is an obstacle to the realization. Therefore, for example, not only the RSSI (referred to as RSSI2) of the RF signal transmitted from the smart key to the vehicle but also the RSSI (referred to as RSSI1) of the LF signal transmitted from the vehicle to the smart key is detected, and both RSSI values ( For example, when the RSSI2 is extremely smaller than the RSSI1, it can be considered that the relay attack is determined. In the case of this method, even if the resolution of RSSI is low, a certain countermeasure effect can be expected.

  In view of the above problems, the problem to be solved by the present invention is to correlate the electromagnetic wave intensity between the signal transmitted from the key to the vehicle and the signal transmitted from the vehicle to the key in the smart key system. Is used to determine whether or not a relay attack is being performed, and to provide a control system that can effectively suppress damage caused by the relay attack.

Means for Solving the Problems and Effects of the Invention

  In order to achieve the above object, a control system according to the present invention is a first communication unit that is portable by a user and has a wireless communication function, and a first detection unit that detects the intensity of electromagnetic waves received by the first communication unit. When the first detection unit and the first communication unit receive a command signal for requesting a response of the identification signal, the electromagnetic wave intensity of the command signal is detected by the first detection unit and transmitted together with the identification signal from the first communication unit. When the input device provided in the vehicle receives the input associated with the transmission of the command signal, the first communication unit receives the first communication from the second communication unit provided in the vehicle. The command signal is transmitted to the unit, and the electromagnetic wave received by the second communication unit is provided in the vehicle, collating means for collating the signal received by the second communication unit with the identification signal unique to the portable device. Second detector for detecting the intensity of When the collation by the collating unit is successful and the electromagnetic wave intensity of the command signal and the electromagnetic wave intensity of the identification signal detected by the second detection unit satisfy a predetermined condition, the input received by the input unit And permission means for permitting the operation of the vehicle requested by the vehicle.

  Accordingly, in the control system according to the present invention, the identification signal unique to the portable device is transmitted from the portable device to the vehicle to perform the collation process, and the electromagnetic wave intensity of the command signal transmitted from the vehicle to the portable device and the portable device to the vehicle. It is also determined whether or not the electromagnetic wave intensity of the transmitted identification signal satisfies a predetermined condition. If both the determination results are appropriate, the operation of the vehicle is permitted. Therefore, for example, in the case of a relay attack, the above two electromagnetic wave intensities do not have an appropriate relationship, and thus a control system that can effectively prevent a relay attack can be realized.

  Further, the predetermined condition is a numerical value belonging to the case where the electromagnetic wave intensity of the command signal and the electromagnetic wave intensity of the identification signal are established without communication between the vehicle and the portable device without a device that relays electromagnetic waves. It may belong to a range.

  Thus, when the electromagnetic wave intensity of the command signal transmitted from the vehicle to the portable device and the electromagnetic wave intensity of the identification signal transmitted from the portable device to the vehicle are not interposed between the vehicle and the portable device. Since the operation of the vehicle is permitted only when it belongs to the numerical range to which it belongs and the verification is successful, the relay attack is performed, and the vehicle, the portable device, and the device that relays electromagnetic waves are interposed The vehicle is not permitted to operate, and a control system that effectively suppresses damage caused by relay attack can be constructed.

  The predetermined condition is that the ratio between the electromagnetic wave intensity of the command signal and the electromagnetic wave intensity of the identification signal is such that communication can be established without an apparatus that relays electromagnetic waves between the vehicle and the portable device. Belonging to a numerical range belonging to.

  As a result, the ratio of the electromagnetic wave intensity of the command signal and the electromagnetic wave intensity of the identification signal belongs to the numerical range belonging to the case where a device that relays electromagnetic waves is not interposed between the vehicle and the portable device, and the verification is successful. Only when the operation of the vehicle is permitted, a relay attack is performed, and a vehicle, a portable device, and a device that relays electromagnetic waves are interposed. When the ratio is not an appropriate value, the operation of the vehicle is not permitted, and a control system that effectively suppresses the damage caused by the relay attack can be constructed.

  The input associated with the transmission of the command signal may be an input for commanding the unlocking of the door of the vehicle.

  As a result, the identification signal specific to the portable device is transmitted from the portable device to the vehicle to perform a collation process, and the electromagnetic wave intensity of the command signal transmitted from the vehicle to the portable device and the electromagnetic wave strength of the identification signal transmitted from the portable device to the vehicle. It is also determined whether or not a predetermined condition is satisfied. If both the determination results are appropriate, unlocking of the vehicle door is permitted. Therefore, for example, in the case of a relay attack, the above two electromagnetic wave intensities do not have an appropriate relationship, so that a control system that can effectively prevent the unlocking of the vehicle door by the relay attack can be realized.

  The input associated with the transmission of the command signal may be an input for instructing start of the drive unit of the vehicle.

  As a result, the identification signal specific to the portable device is transmitted from the portable device to the vehicle to perform a collation process, and the electromagnetic wave intensity of the command signal transmitted from the vehicle to the portable device and the electromagnetic wave strength of the identification signal transmitted from the portable device to the vehicle. It is also determined whether or not a predetermined condition is satisfied, and if both of the determination results are appropriate, the start of the drive unit (engine, motor) for traveling the vehicle is permitted. Therefore, for example, in the case of a relay attack, the above two electromagnetic wave intensities do not have an appropriate relationship, so that a control system that can effectively prevent the drive unit from being started by the relay attack can be realized.

The block diagram in one Example of the control system of this invention. The flowchart which shows the process sequence in the case of a smart entry system. The flowchart which shows the process sequence in the case of a smart start system. The figure which shows the example of the relationship between RSSI of the signal transmitted to a smart key from a vehicle, and RSSI of the signal transmitted from a smart key to a vehicle. The figure which shows the example of the appropriate range of RSSI of the signal transmitted to a smart key from a vehicle, and RSSI of the signal transmitted to a vehicle from a smart key. The figure which shows the outline | summary of a relay attack.

  Embodiments of the present invention will be described below with reference to the drawings. First, FIG. 1 is a schematic diagram of a device configuration of a vehicle control system 1 (system, control device) according to the present invention. A system 1 shown in FIG. 1 includes a collation control unit (ECU: Electronic Control Unit) 4 provided in a vehicle 2 and a key 3 (smart key, electronic key, portable device) that can be carried by a user. The vehicle 2 is not limited as long as it is an automobile, and may be, for example, a gasoline engine car, a diesel engine car, an electric car, or a hybrid car.

  The verification ECU 4 includes a vehicle interior LF transmitter 40, a vehicle interior LF transmitter 41, and an RF receiver 42. The vehicle exterior LF transmission unit 40 is installed, for example, at a door handle portion of the vehicle 2 and transmits a polling signal to the vehicle interior of the vehicle 2 using electromagnetic waves in the LF (long wave) band.

  The vehicle interior LF transmission unit 41 is installed in the vehicle interior and transmits a polling signal to the vehicle interior of the vehicle 2 by electromagnetic waves in the LF (long wave) band. The RF receiver 42 is installed in, for example, a vehicle interior and receives RF signals transmitted from outside the vehicle interior. The RSSI detector 45 detects the RSSI of the RF signal received by the RF receiver 42.

  The verification ECU 4 has a normal computer structure, and includes a CPU that controls various calculations and information processing, a RAM that is a temporary storage unit as a work area of the CPU, and a nonvolatile memory 43 that stores various information. It is assumed that a master ID 44 described later is stored in the memory 43.

  The door 5 of the vehicle 2 is equipped with a lock mechanism 50, a touch sensor 51, and a lock button 52. The door is locked or unlocked by the lock mechanism 50. The touch sensor 51 is a sensor that is mounted on the door handle of the vehicle 2 and detects that the user has gripped the door handle.

  The lock button 52 is a door locking button in the smart key system, and is provided near the door handle, and is a button that locks the door when pressed by the user when the vehicle exterior verification is successful.

  The door 5 refers to a plurality of doors (driver's seat side door, passenger seat side door, rear seat right side, left side door, etc.) equipped on the vehicle 2, and each of the doors has a lock mechanism 50, a touch sensor 51, and a lock. The button 52 may be equipped.

  The vehicle 2 also includes an engine start switch 61 in the vicinity of the driver's seat in the passenger compartment. The engine start switch 61 is a switch for starting the engine in the smart start system, and is a switch for starting the engine when the user presses the button while the vehicle interior verification is successful. Each of the above units is connected by in-vehicle communication (CAN communication) and can exchange information.

  The key 3 is an electronic key related to the smart key system, which can be carried by the user, and includes an LF receiver 30, an RF transmitter 31, a controller 32, a memory 33, and an RSSI detector 35. The memory 33 stores an identification signal 34 (ID code, ID) unique to the key 3. The LF receiving unit 30 receives the above-described polling signal.

  The RF transmitter 31 receives the polling signal and transmits the ID code 34 unique to the key 3 as an RF signal. The RSSI detector 35 detects the RSSI of the signal (electromagnetic wave) received by the LF receiver 30. The control unit 32 has the same structure as a normal computer, and includes a CPU for various information processing, a RAM of a temporary storage unit as a work area of the CPU, and the like. The controller 32 controls the equipment of the key 3 such as the LF receiver 30, the RF transmitter 31, the controller 32, and the memory 33.

  As described above, this system includes a so-called smart entry system as an unlocking method for a vehicle door. In this method, when the touch sensor 51 detects an operation for unlocking the door that is gripped by the user, the LF wave commanding a reply of the identification signal (ID34) from the outside LF transmitter 40 to the key 3 is used. A polling signal is transmitted.

  For example, it is assumed that a predetermined number of polling signals are transmitted per contact detection of the door handle. When the key 3 receives the polling signal, it returns an RF wave signal including ID 34 from the RF transmitter 31. The collation ECU 4 collates the signal received by the RF receiving unit 42 with the master ID 44, and if the collation is successful (both match), the door 5 of the vehicle is unlocked or put into an unlocking permitted state.

  Based on the above configuration, the system 1 executes processing for preventing door unlocking due to a relay attack in the smart entry system in the vehicle 2. The processing procedure is shown in FIG. The processing procedure of FIG. 2 (and FIG. 3 described later) may be programmed in advance and stored in, for example, the memories 43 and 33, and the verification ECU 4 and the control unit 32 may be called and automatically executed. The process on the right side in FIG. 2 is a process using the regular key 3 of the owner of the vehicle 2.

  In the process of FIG. 2, first, in S10, the verification ECU 4 determines whether or not the touch sensor 51 has detected that the user has touched the door handle. When the touch sensor 51 detects contact (S10: YES), the process proceeds to S20, and when contact is not detected (S10: NO), S10 is repeated to enter a waiting state. After proceeding to S20, the verification ECU 4 transmits an LF signal (polling signal) from the LF transmitter 40 outside the vehicle interior. That is, input (by contact) to the touch sensor is associated with transmission of the LF signal.

  The key 3 receives the LF signal transmitted in S20 by the LF receiver 30 in S100. The key 3 is S110, and the RSSI detector 35 detects the RSSI of the LF signal received in S100. The key 3 transmits an RF signal (identification signal) including the ID 34 unique to the key 3 from the RF transmission unit 31 in S120. The RF signal includes information on the RSSI value detected in S100.

  Subsequently, in S30, the verification ECU 4 determines whether or not an RF signal has been received. When the RF signal is received (S30: YES), the process proceeds to S40, and when the RF signal is not received (S30: NO), the process proceeds to S70.

  After proceeding to S40, the verification ECU 4 detects the RSSI value of the RF signal received by the RF receiving unit 42 confirmed to be received at S30 by the RSSI detecting unit 45. In S50, it is determined whether or not the RSSI value of the LF signal detected in S110 and the RSSI value of the RF signal detected in S40 satisfy a predetermined condition.

  Here, the predetermined condition is a condition that is satisfied when the relay attack is not performed. Specifically, the RSSI value of the LF signal detected in S110 and the RSSI value of the RF signal detected in S40. As a condition that the correlation is within an appropriate range. Specific examples of the correlation between these two RSSI values are shown in FIGS.

  As shown in FIG. 4, the RSSI value (RSSI1) of the LF signal transmitted from the vehicle 2 to the smart key 3 and the RSSI value (RSSI2) of the RF signal transmitted from the smart key 3 to the vehicle 2 are both As the distance between the smart key and the smart key increases, the numerical value tends to decrease.

  When the vehicle door is unlocked by the authorized user (normal time) (a), the RSSI2 tends to be larger than the RSSI1, whereas the relay attack (RA) is performed. In the case (b), the smart key 3 is often located far from the vehicle, so the RSSI2 value tends to be small, and the RSSI1 tends to be larger than the RSSI2. Further, it can be confirmed that the ratio between RSSI1 and RSSI2 is within a certain range in normal times.

  Using the above tendency, the verification ECU 4 in S50, if RSSI1 and RSSI2 are within the range indicated as the appropriate range in FIG. 5, the correlation between the two RSSI values is appropriate and no relay attack is performed. Is determined. In FIG. 5 (a), a plane having RSSI1 and RSSI2 as two coordinate axes is set, and the area of RSSI2 and RSSI1 in normal time (when the door is unlocked by a regular user) is set as an appropriate range. It is set.

  In the appropriate area of FIG. 5A, the ratio of RSSI2 and RSSI1 (that is, a value obtained by dividing RSSI2 by RSSI1) is set as an appropriate range when the relay attack is not performed. In FIG. 4B, the ratio between RSSI2 and RSSI1 (that is, a value obtained by dividing RSSI2 by RSSI1) is calculated, and the range of the ratio value at normal time (when the door is unlocked by a regular user) is set as an appropriate range. . Specifically, the appropriate range may be determined appropriately according to the device configuration to be used, and the ratio of RSSI2 and RSSI1 is, for example, a range in a region greater than 1, a range in a region less than 1, a region in a region that crosses 1 It may be appropriately determined as a range.

  When it is determined in S50 that the correlation between RSSI1 and RSSI2 is within the proper range (S50: YES), the process proceeds to S60, and when it is determined that the correlation is not within the proper range (S50: NO), the process proceeds to S70. .

  After proceeding to S60, the collation ECU 4 performs collation between the RF signal confirmed to be received in S30 and the master ID 44, and determines whether the collation is successful. If the collation is successful (S60: YES), the process proceeds to S80, and if the collation is unsuccessful (S60: NO), the process proceeds to S70. In S80, the verification ECU 4 instructs the lock mechanism 50 to unlock the door (operation of the vehicle requested by the operation input received in S10).

  After proceeding to S70, the verification ECU 4 determines whether or not the elapsed time has exceeded a predetermined time. Here, the elapsed time is the elapsed time since the transmission of the LF signal in S20. If the elapsed time exceeds the predetermined time (S70: YES), the process of FIG. 2 is terminated. If the predetermined time has not been exceeded (S70: NO), the process returns to S30 and waits for reception of the RF signal.

  As described above, in the process of FIG. 2, the RSSI value of the LF signal transmitted from the vehicle 2 to the key 3 (in S20) and the RSSI value of the RF signal transmitted from the key 3 to the vehicle 2 (in S120) Both are detected and the correlation between both RSSI values is determined, thereby determining whether the door is unlocked by a proper owner or a relay attack. The correlation between both RSSI values is calculated, for example, in the form of a ratio.

  Therefore, when the relay attack is performed (that is, when the contact detected in S10 is caused by the theft), the RSSI value of the RF signal is relative because the owner of the vehicle is far from the vehicle. On the other hand, since the theft is near the owner, the RSSI value of the LF signal is relatively large. Therefore, since the correlation (relationship) between both RSSI values is different from the normal correlation, it is detected that a relay attack occurs, and the door is not unlocked.

  On the other hand, when the door is unlocked by the proper owner of the vehicle 2 (that is, when the contact detected in S10 is from the proper owner), the RSSI value of the LF signal and the RSSI value of the RF signal are Since the correlation is within the proper range, the door is unlocked in S80.

  In the case of this method, for example, unlike the case where it is determined whether the distance between the vehicle and the key is near or far from one RSSI value and whether or not the relay attack is determined, strict accuracy is not required for the RSSI value. . Therefore, there is an advantage that it is not difficult to realize. Therefore, the door unlocking by the relay attack can be effectively suppressed. The above is the processing of FIG.

  Next, FIG. 3 will be described. Fig. 2 shows the procedure for relay attack countermeasures in smart entry (door unlocking using smart keys), while Fig. 3 shows the procedure for relay attack countermeasures in smart start (engine start using smart keys). It is a procedure. Among the processes in FIG. 3, the same reference numerals as those in FIG. 2 perform the same processes as in FIG. Hereinafter, parts different from FIG. 2 will be described.

  In the process of FIG. 3, S10 of FIG. 2 is replaced with S15. In S15, the verification ECU 4 determines whether or not the user has turned on the engine start switch 61. When the on operation for the engine start switch 61 is performed (S15: YES), the process proceeds to S20. When the on operation for the engine start switch 61 is not performed (S15: NO), S10 is repeated to wait for the on operation. In FIG. 3, S80 in FIG. 2 is replaced with S85. In S85, the verification ECU 4 starts the engine. The transmission of the LF signal in FIG. 3 may be performed from the vehicle interior LF transmission unit 41.

  In the process of FIG. 3, the same principle as in FIG. 2 works, and the engine start due to the relay attack is suppressed. That is, when the relay attack is being performed (that is, when the engine start switch is turned on in S10 by a theft), the owner of the vehicle is far away from the vehicle, so the RSSI value of the RF signal is Whereas it is relatively small, the RSSI value of the LF signal is relatively large because the theft is near the owner.

  Therefore, since the correlation (relationship) between both RSSI values is different from the normal correlation, a relay attack is detected and the engine is not started. On the other hand, when the engine is started by the authorized owner of the vehicle 2 (that is, when the engine start switch is turned on in S10 by the authorized owner), the RSSI value of the LF signal and the RSSI value of the RF signal are Is within the proper range, the engine is started in S85. The above is the processing of FIG.

  Embodiments of the present invention may be modified as appropriate without departing from the spirit and scope of the claims. For example, the appropriate range described above is not limited to the region as shown in FIG. 5, and may be changed according to the characteristics of the apparatus actually used. Whether the combination of the condition that RSSI2 and RSSI1 are within the appropriate range as shown in FIG. 5 and the condition that the absolute value of RSSI2 is smaller than a predetermined value (AND and OR of both conditions) is satisfied. May be determined in S50.

1 Control system 2 Vehicle 3 Key (portable machine)
4 verification ECU

Claims (5)

A first communication unit that is portable by a user and has a wireless communication function, a first detection unit that detects the intensity of electromagnetic waves received by the first communication unit, and the first communication unit that returns an identification signal. When receiving a command signal to request, a portable device comprising: a first transmission means for detecting the electromagnetic wave intensity of the command signal by the first detection unit and transmitting it from the first communication unit together with an identification signal;
When the input means provided in the vehicle receives an input associated with the transmission of the command signal, the command signal is transmitted from the second communication unit provided in the vehicle to the first communication unit, and the second Collating means for collating a signal received by the communication unit with an identification signal unique to the portable device;
A second detection unit provided in the vehicle for detecting the intensity of the electromagnetic wave received by the second communication unit;
When the collation by the collating unit is successful and the electromagnetic wave intensity of the command signal and the electromagnetic wave intensity of the identification signal detected by the second detection unit satisfy a predetermined condition, the input received by the input unit is Permission means for permitting the requested vehicle operation;
A control system characterized by comprising:   The predetermined condition is a numerical range to which the electromagnetic wave intensity of the command signal and the electromagnetic wave intensity of the identification signal belong when communication is established without an apparatus that relays electromagnetic waves between the vehicle and the portable device. The control system according to claim 1, which belongs to   The predetermined condition is that the ratio of the electromagnetic wave intensity of the command signal and the electromagnetic wave intensity of the identification signal is such that communication is established without an apparatus that relays electromagnetic waves between the vehicle and the portable device. The control system according to claim 1, wherein the control system belongs to a numerical range.   The control system according to any one of claims 1 to 3, wherein the input associated with the transmission of the command signal is an input for commanding unlocking of the door of the vehicle.   The control system according to any one of claims 1 to 3, wherein the input associated with the transmission of the command signal is an input for instructing start of the drive unit of the vehicle.