Control system and mobile device

A control system includes: a transmission device that transmits a plurality of signals having different frequencies from one of a first communication unit mounted in a vehicle and a second communication unit mounted in a mobile device carried by a user in such a manner that the plurality of signals are combined to generate a predetermined composite signal in an area located at a distance from the first communication unit, the distance being not more than a predetermined distance; and a permission device that permits a predetermined action of the vehicle when the predetermined composite signal generated in the area from the plurality of signals transmitted by the transmission device is detected and an authentication signal transmitted by the second communication unit is authenticated as an authorized authentication signal for the vehicle.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is a U.S. National Phase Application under 35 U.S.C. 371 of International Application No. PCT/JP2015/000259 filed on Jan. 21, 2015 and published in Japanese as WO 2015/118821 A1 on Aug. 13, 2015 . This application is based on and claims the benefit of priority from Japanese Patent Application No. 2014-020210 filed on Feb. 5, 2014. The entire disclosures of all of the above applications are incorporated herein by reference.

TECHNICAL FIELD

The present disclosure relates to a control system and a mobile device.

BACKGROUND ART

There has been a proliferation of smart key systems for vehicles. A vehicle provided with a smart key system transmits a signal requesting a reply including an ID, in response to, for example, a touch of a door handle or operation of an engine start switch by a user. A key transmits its ID in reply to the signal. The system checks the ID returned by the key against the master ID stored in an onboard device, and permits the door to unlock or the engine to start if the ID is validated. Alternatively, an onboard device may transmit polling signals reaching the vicinity of the vehicle periodically without operation by a user.

For example, Patent Literature 1 discloses a smart key system for preventing theft of a vehicle more reliably. The smart key system includes a device to determine whether an occupant intends to continue driving. When a mobile device is away from a vehicle and if it is determined that an occupant having no mobile device intends to continue driving, the system permits the internal combustion engine to restart.

Such smart key systems may be deceived by a method of theft that may be called a relay attack, as exemplified inFIG. 11. In this technique, criminals A and B are located between a vehicle and its owner, who is away from the vehicle. The owner carries a smart key. The criminals A and B carry radio wave relays.

In such a condition, a request signal (a polling signal) transmitted by the vehicle is relayed by the relays carried by the criminals A and B to reach the owner. Although this type of request signal (polling signal) typically has a reach range that is limited to the vicinity of a vehicle, the relays carried by the criminals A and B enable the request signal to reach the owner. In reply to the request signal, the smart key carried by the owner of the vehicle transmits an RF signal including an ID code that is unique to the key and stored therein.

The RF signal transmitted by the key has a relatively long reach range. Upon arrival of the RF signal at the vehicle, the vehicle checks the ID included in the received RF signal against the master ID stored in the vehicle (for authentication). Since the RF signal is transmitted by the smart key carried by the owner, the verification is of course successful. This permits a door of the vehicle to unlock. The criminals can gain entry into the vehicle in this manner.

Then, repeating the similar procedure after the entry of the criminal A into the vehicle produces a successful result of the verification inside the cabin, permitting the engine to start. This allows the criminals to drive away the vehicle. The above brief description pertains to a relay attack.

There is a demand for effective measures against such a relay attack. An effective method to reduce damage caused by a relay attack may include determination whether a mobile device is in the vicinity of a vehicle. With such a measure provided, damage caused by a relay attack can be reduced effectively by permitting a door to unlock or an engine to start if it is determined that a mobile device is in the vicinity of a vehicle, and by prohibiting the door from unlocking or the engine from starting if it is determined that the mobile device is not in the vicinity of the vehicle.

PRIOR ART LITERATURES

Patent Literature

SUMMARY OF INVENTION

It is an object of the present disclosure to provide a control system and a mobile device that are capable of reducing damage caused by a relay attack effectively by using a mechanism to determine whether the mobile device is in a vicinity of the vehicle. The control system and the mobile device are for use in a system in which a predetermined action of a vehicle is permitted by wireless communication between the mobile device carried by a user and a vehicle.

According to a first aspect of the present disclosure, a control system includes: a transmission device that transmits a plurality of signals having different frequencies from one of a first communication unit mounted in a vehicle and a second communication unit mounted in a mobile device carried by a user in such a manner that the plurality of signals are combined to generate a predetermined composite signal in an area located at a distance from the first communication unit, the distance being not more than a predetermined distance; and a permission device that permits a predetermined action of the vehicle when the predetermined composite signal generated in the area from the plurality of signals transmitted by the transmission device is detected and an authentication signal transmitted by the second communication unit is authenticated as an authorized authentication signal for the vehicle.

The system described above can reduce damage caused by a relay attack effectively on the basis of whether a composite signal is detected that is generated in a vicinity of the vehicle from a plurality of signals transmitted by the vehicle or the mobile device.

According to a second aspect of the present disclosure, a mobile device includes: a second communication unit having a function to communicate with a first communication unit mounted in a vehicle. The second communication unit includes: a reception device that receives a synchronizing clock signal transmitted by the first communication unit; and a transmission device that transmits a plurality of signals having frequencies different from a signal transmitted by the first communication unit in a period, in which the first communication unit transmits the signal, in synchronization with a clock of the first communication unit based on the clock signal received by the reception device in such a manner that the signals are combined to generate a predetermined composite signal in an area located at a distance from the first communication unit, the distance being not more than a predetermined distance.

The mobile device described above can reduce damage caused by a relay attack effectively on the basis of whether a composite signal is detected that is generated in a vicinity of the vehicle from a plurality of signals transmitted by the vehicle or the mobile device.

EMBODIMENTS FOR CARRYING OUT INVENTION

Embodiments of the present disclosure will now be described with reference to the drawings.FIG. 1is a block diagram of a device configuration of a control system1for a vehicle (hereinafter referred to simply as a system1) according to a first embodiment of the present disclosure. The system1illustrated inFIG. 1includes an ECU (Electronic Control Unit)4provided in a vehicle2and a key3(e.g., a smart key, an electronic key, and a mobile device) that can be carried by a user.

The ECU4is provided with an LF transmitting section40and an RF communication section41. The LF transmitting section40is disposed at positions such as at each door handle of the vehicle2and in a cabin to transmit different signals using electromagnetic waves of an LF (Low Frequency) band to positions inside and outside the cabin of the vehicle2. The RF communication section41is placed, for example, in the cabin to transmit and receive RF signals of, for example, a UHF band for communication with positions in the cabin and outside the vehicle.

The ECU4has a configuration of a normal computer and includes a CPU that performs various operations and information processing, a RAM that is a temporary storage serving as a work space for the CPU, and a nonvolatile memory42for storing various types of information. The memory42stores, for example, a master ID43.

The vehicle2includes a door and a trunk lid5each equipped with a touch sensor50and a lock/unlock control section51(the door and the trunk lid5refer to any one of doors and trunk lids that may be included in the vehicle2). The touch sensors50are placed in the vehicle2at a door handle and the trunk lid where a user holds to detect a touch of the door handle or the trunk lid by the user. The lock/unlock control sections51control the door and the trunk lid so that they are locked or unlocked.

The vehicle2also includes an engine start switch60near a driver seat in the cabin. The engine start switch60is a switch to start an engine in a smart start system. The engine start switch60starts the engine when being pushed by a user and if the verification inside the cabin is successful. The engine herein is not limited to internal combustion engines and may refer to a driving unit for a vehicle in general including an electric motor. The components described above are connected to an intra-vehicle communication network (CAN communication) to exchange information with each other.

The key3is an electronic key in relation to the smart key system. The key3can be carried by a user and includes an LF receiving section30, an RF communication section31, a control section32, a memory33, and switches35. The memory33stores an identifying signal34(e.g., an ID code and an ID) unique to the key3.

The LF receiving section30has a function to receive a wireless signal of an LF band. The RF communication section31has a function of transmitting and receiving an RF signal of, for example, a UHF band. The control section32has a configuration similar to that of a normal computer and includes a CPU for various types of information processing and a RAM that is a temporary storage serving as a work space for the CPU. The switches35are in relation to a wireless keyless system and include lock/unlock switches for the door and the trunk, and a pre-air-conditioning switch. The control section32controls the components of the key3, including the LF transmitting section30and the RF communication section31, so that processing is performed in accordance with the operation of each of the switches35by a user.

The system1having the configuration described above performs a series of operations of a smart entry system and the smart start system that incorporate processing to reduce damage caused by a relay attack. An exemplary procedure of the processing is illustrated inFIG. 2. The processing procedure inFIG. 2(and those inFIGS. 3 and 4) are programmed in advance and are stored in, for example, the memory42and the memory33, so that the ECU4and the control section32may call the programs and execute the programs automatically. An exemplary time-dependent transition is illustrated inFIG. 7in the case of executing the processing inFIG. 2.

With reference toFIG. 2, the ECU4determines in step S10whether any one of the touch sensors50disposed at the door handle and the trunk lid is touched or the engine start switch60is operated by a user. If a touch of any one of the touch sensors50or the operation of the engine start switch60is detected (S10: YES), the processing proceeds to step S20. If none of these actions is detected (S10: NO), the processing repeats step S10until any of the actions is detected.

The ECU4causes a corresponding one of the LF transmitting sections40to transmit in step S20a WAKE signal requesting to activate the key3(here, if a touch is detected by one of the touch sensors, the corresponding one of the LF transmitting sections40is the one that is disposed at the door or the trunk on which the touch is detected, and if the operation of the engine start switch is detected, the corresponding one of the LF transmitting sections40is the one that is disposed in the cabin). The frequency of an LF signal is, for example, 125 kHz.

The key3receives in step S200the WAKE signal at the LF receiving section30; the WAKE signal activates the key3. Subsequently, the control section32causes the RF communication section31to transmit in step S210a signal to acknowledge the reception of the WAKE signal (an ACK signal).

The RF communication section41in the vehicle2receives in step S30the ACK signal transmitted by the key3. The ECU4then causes the RF communication section41to transmit in step S40a challenge signal (a signal including a vehicle code and requesting the key to transmit a reply including the ID). The key3receives in step S220the challenge signal at the RF communication section31. The ECU4and the control section32transmit and receive in steps S50and S230a clock signal to/from each other by bidirectional communication, so that the ECU4and the control section32have synchronized clocks.

As illustrated inFIG. 7, the RF signals transmitted and received in the processing described above have a frequency of, for example, 433.92 MHz (denoted as a frequency F1). The ECU4changes in step S60the frequency of an RF signal to be transmitted by the RF communication section41of the vehicle to 434.045 MHz (denoted as a frequency F2).

The ECU4instructs the RF communication section41to transmit in step S70an RF signal of the frequency F2. At the same time, the control section32of the key3instructs the RF communication section31to transmit in step S240an RF signal of the frequency F1. The synchronization in steps S50and S230enables the ECU4and the control section32to provide the instructions simultaneously. The RF communication section41has a transmission output, in step S70, that allows the key3to receive the RF signal only if the key3is close enough to the vehicle so that it can be determined that no relay attack is conducted.

In the manner described above, the vehicle2and the key3transmit RF signals simultaneously, with the signal from the vehicle2having the frequency F2and the signal from the key3having the frequency F1. As described above, the frequencies F1and F2have relatively close values. As is well known, combining signals (electromagnetic waves) having relatively close yet different frequencies produces a beat. Hence, if the key3is located in the reach range of the RF signal transmitted by the vehicle2, a beat is generated in the vicinity of the key3. In contrast, if the key3is located outside the reach range of the RF signal transmitted by the vehicle2, no beat is produced in the vicinity of the key3(and at any other locations).

Presumably, a criminal focuses attention on relaying an LF signal transmitted by a vehicle to a key during a relay attack, but does not consider relaying also an RF signal. Thus, a beat is not likely to be generated in the vicinity of the key3during a relay attack. In brief, a beat is produced in the vicinity of the key3if the key3is located near the vehicle2; no beat is generated in the vicinity of the key3if the key3is located far from the vehicle2, and this holds true also during a relay attack.

Hence, detecting the presence of a beat in the vicinity of the key3allows determination whether communication is normal with no relay attack or the communication is accompanied by a relay attack. Furthermore, the frequencies F1and F2have a difference value that is in agreement with the value of the frequency of an LF signal (125 kHz). This allows the LF receiving section30of the key3to detect a beat in the vicinity of the key3. The processing described above is performed in step S250and beyond.

The control section32determines in step S250whether the LF receiving section30detects a beat component. If a beat component is detected (S250: YES), the processing proceeds to step S260; if no beat component is detected (S250: NO), the processing proceeds to step S270.

A beat is detected in the vicinity of the key3in the case of proceeding to step S260; thus, it is assumed that the key3is close enough to the vehicle2and that no relay attack is conducted, as described above. No beat is detected in the vicinity of the key3in the case of proceeding to step S270; hence, it is assumed that the key3is far from the vehicle2even though the communication up to step S70is successful, which indicates that a relay attack is conducted.

The control section32determines in step S260that the communication is normal with no intervention by a relay attack, and causes the RF communication section31to transmit in step S280the ID34of the key3. The control section32determines in step S270that the communication is abnormal with intervention by a relay attack, and causes the RF communication section31to transmit in step S290a signal requesting retransmission of an LF WAKE signal (an LF retransmission requesting signal).

The ECU4receives the ID34and determines in step S80whether the ID34is authenticated successfully. If the ID34is received and the authentication is successful (S80: YES), the processing proceeds to step S90. If no ID34is received or if it is received but it fails the authentication (S80: NO), the processing proceeds to step S100.

The ECU4permits in step S90a predetermined vehicle action. A predetermined action here refers to an action associated with the operation by the user detected in step S10. Specifically, the predetermined action is an action to unlock the door or the trunk lid if the user operation is a touch of the door or the trunk lid, and an action to start the engine if the user operation is that of the engine start switch.

The ECU4determines in step S100whether an LF retransmission requesting signal is received. If an LF retransmission requesting signal is received (S100: YES), the processing reverts back to step S20where the procedure described above is repeated. If an LF retransmission requesting signal is not received (S100: NO), the processing inFIG. 2is finished. The description above pertains to the processing procedure ofFIG. 2.

Exemplary conditions at smart entry and smart start are illustrated inFIGS. 5 and 6in the case of the first embodiment. As illustrated, the key3and an occupant of the vehicle are close to the vehicle2or inside the cabin with no relay attack conducted; thus, a beat is generated in an area between the RF communication section41and the key3and the generation of the beat is detected in step S250described above. This permits a vehicle door or the trunk to unlock or the engine to start.

If the key3and a legitimate occupant are located far from the vehicle2and a relay attack is conducted, no beat is generated in the area between the RF communication section41and the key3. This prevents the door or the trunk from unlocking and the engine from staring. By performing the processing procedure described above, damage caused by a relay attack can be reduced effectively. Furthermore, a beat to be generated in the example described above has a frequency receivable by the LF receiving section30. This eliminates the need to change an existing hardware configuration.

The detection of a beat in step S250may be performed as, for example, described below with reference toFIG. 10in which a configuration of the key3is illustrated more specifically. In the configuration illustrated inFIG. 10, the key3includes an LF receiving antenna301, which is included in the LF receiving section30, and an RF transmitting and receiving antenna310, which is included in the RF communication section31. The LF receiving antenna301and the RF transmitting and receiving antenna310are formed on the front side and the back side of an identical substrate. The LF receiving antenna301and the RF transmitting and receiving antenna310are placed such that they partially overlap with each other when viewed from the top of the substrate.

A signal line302extends from the LF receiving antenna301to an LF receiving IC300. Such a placement, in which the LF receiving antenna301and the RF transmitting and receiving antenna310are close to each other, ensures that a beat is generated inside the key3and that the beat is detected by the LF receiving section30. With the placement inFIG. 10in particular, a beat of 125 kHz resulting from combination of RF signals having the two frequencies described above is induced by the signal line302and thus can be detected by the LF receiving section30reliably.

A second embodiment of the present disclosure will now be described. In the first embodiment, two signals are combined; in the second embodiment, three signals are combined. In the second embodiment (and in a third embodiment to be described below), a system configuration identical with that inFIG. 1may be employed. An exemplary processing procedure according to the second embodiment is described inFIG. 3; an exemplary time-dependent transition in the case of executing this processing procedure is described inFIG. 8. The processing procedure inFIG. 3is identical with that inFIG. 2, except for the addition of step S72. Components designated with identical symbols with those illustrated in the other figures have similar configurations (unless new description is provided), and duplicate description will be omitted.

In the processing procedure inFIG. 3, RF signals (having frequencies F2and F1) are transmitted simultaneously in steps S70and S240. In synchronization with these signals, an LF transmitting section40in a vehicle2also transmits in step S72an LF signal (having a frequency of 125 kHz). This further combines the signal of 125 kHz with a beat of 125 kHz resulting from the combination of signals having the frequencies F1and F2as in the first embodiment. By defining a pattern of the signal to be transmitted in step S72appropriately, the three signals described above can be combined to produce an LF signal having a unique pattern. The presence of a relay attack can be determined on the basis of whether the LF signal having the unique pattern is detected in step S250. Hence, damage caused by a relay attack can be reduced by the detection of a composite signal having a unique pattern in the second embodiment.

A third embodiment of the present disclosure will now be described. In the first and second embodiments described above, signals are transmitted by the vehicle2and the key3to generate a beat; in the third embodiment, a plurality of signals is transmitted by a vehicle2. An exemplary processing procedure according to the third embodiment is described inFIG. 4; an exemplary time-dependent transition in the case of executing this procedure is described inFIG. 9. The processing procedure inFIG. 4is identical with that inFIG. 2, except for the addition of step S74and the elimination of step S240.

As illustrated inFIG. 9, an RF signal having a frequency of, for example, 433.795 MHz may be transmitted in step S70. In synchronization with this signal, an LF signal of 125 kHz may be transmitted in step S72. The two signals are combined to produce an RF signal of 433.92 MHz. If a key3is in the vicinity of the vehicle (in the reach range of the RF signal), an RF communication section31can detect this composite signal, which results in an affirmation in the determination in step S250(YES). Hence, a door or a trunk is permitted to unlock, or an engine is permitted to start in step S90. In the manner described above, the presence of a relay attack can be detected by combining a plurality of signals transmitted only by the vehicle2in the third embodiment.

In the examples described above, a challenge signal (a request signal) is transmitted in response to the operation of a user, although polling signals may be transmitted periodically regardless of the operation of a user.