JP7314775B2 - VEHICLE CONTROL DEVICE, VEHICLE SYSTEM, AND VEHICLE CONTROL METHOD - Google Patents

Description

The present disclosure relates to a vehicle control device, a vehicle system, and a vehicle control method.

2. Description of the Related Art Conventionally, a technique is known in which software of a vehicle control device is updated to update or extend functions. For example, Patent Literature 1 discloses a technique of upgrading a control program of an in-vehicle ECU using version upgrade data transmitted from a data communication device.

Japanese Unexamined Patent Application Publication No. 2004-28000

Vehicles have a relatively long product life. Therefore, when the software of the vehicle control device is repeatedly updated, it is conceivable that the software cannot be updated due to the lack of capability of the vehicle control device for the updated software. In this case, a vehicle control device whose software can be updated is required, but it is not easy to replace the vehicle control device in the vehicle. As means for solving this problem, it is conceivable to connect a control device to the vehicle control device installed in the vehicle afterward to compensate for the lack of performance and to enable software update.

In this way, when supplementing the insufficient performance of the vehicle control device already installed in the vehicle by connecting the control device later, the following requirements can be considered. It is conceivable that by changing the permitted functions for each product grade of the control device, it is possible to set multiple product grades that match the price range required by individual customers.

One object of this disclosure is to provide a vehicle control device, a vehicle system, and a vehicle control method that make it possible to change the permitted functions for each product grade of the control device when supplementing the insufficient performance of the vehicle control device installed in the vehicle due to software update by connecting the control device later.

The above objects are achieved by the combination of features stated in the independent claims, and the subclaims define further advantageous embodiments of the disclosure. The symbols in parentheses described in the claims indicate the corresponding relationship with specific means described in the embodiments described later as one aspect, and do not limit the technical scope of the present disclosure.

In order to achieve the above object, a vehicle control device of the present disclosure is a vehicle control device that is mounted in a vehicle and capable of controlling a plurality of in-vehicle devices (34, 35, 36, 37, 38), and a terminal identification information acquisition unit (30) that acquires terminal identification information for identifying each control device from a connection control device (39) that is a control device connected to the vehicle control device when a control device is newly connected and added to the vehicle control device for updating software used for control. 1), a function restriction unit (304) that changes the function permitted to the connection control device according to the authentication level of the connection control device determined based on the correspondence relationship in which the authentication level, which is the level of the function permitted to the control device, and the terminal identification information are associated in advance from the terminal identification information acquired by the terminal identification information acquisition unit;A transmission processing unit (302) for transmitting the terminal identification information acquired by the terminal identification information acquisition unit to the server (2) outside the vehicle storing the correspondence relationship, and a result acquisition unit (303) for acquiring the authentication level of the connection control device determined by the server based on the correspondence relationship from the terminal identification information transmitted by the transmission processing unit. In addition to information, vehicle-side identification information for identifying each vehicle control device is associated in advance, and the authentication level includes an authentication level of connection disapproval that does not permit connection to the vehicle control device. The transmission processing unit causes the server to transmit not only the terminal identification information but also the vehicle-side identification information of the vehicle control device corresponding to the own device, and the result acquisition unit authenticates connection disapproval when the terminal identification information and the vehicle-side identification information transmitted by the transmission processing unit are not associated with each other. On the other hand, if the terminal identification information transmitted by the transmission processing unit and the vehicle-side identification information are associated with each other in a corresponding relationship, an authentication level that is higher than the connection disapproval authentication level and does not disallow connection is obtained, and the function restriction unit disallows connection to the vehicle control device when the authentication level obtained by the result acquisition unit is the connection disapproval authentication level, and permits connection to the vehicle control device when the authentication level obtained by the result acquisition unit is not the connection disapproval authentication level. , which permits the connection controller to function according to its authentication level.be.

In order to achieve the above purpose, the control method for vehicles displayed in the present disclosed vehicle is compiled by adding a new control device to a vehicle control device (30) that can control multiple vehicle devices (34, 35, 36, 37,38, 38) on the vehicle to update the software used for control. Acquisition information for vehicles implemented by the tutor and the terminal identification information for identifying individual control devices is obtained from a connection control device (39), a control device connected to a vehicle control device.a terminal identification information acquisition step for, From the terminal identification information to be acquired, the function to be permitted to the connection control device is changed according to the authentication level of the connection control device determined based on the corresponding relationship in which the authentication level, which is the level of the function to be permitted to the control device, and the terminal identification information are associated in advance.Functional restrictiona step;A transmission processing step of transmitting the terminal identification information acquired in the terminal identification information acquisition step to a server (2) outside the vehicle storing the correspondence relationship, and a result acquisition step of acquiring the authentication level of the connection control device determined by the server based on the correspondence relationship from the terminal identification information transmitted in the transmission processing step.includesIn the function restriction step, the function permitted to the connection control device is changed according to the authentication level acquired in the result acquisition step. In addition to the authentication level and the terminal identification information, the corresponding relationship is associated with vehicle side identification information for identifying each vehicle control device in advance. If the terminal identification information transmitted in the transmission processing step and the vehicle-side identification information are not associated with each other in a corresponding relationship, the result acquisition step acquires a connection disapproval authentication level if the terminal identification information transmitted in the transmission processing step and the vehicle-side identification information are associated in a corresponding relationship. While not permitting connection to the vehicle control device, if the authentication level obtained in the result acquisition step is not a connection disapproval, it permits connection to the vehicle control device and permits the connection control device to perform a function corresponding to the authentication level..

According to these, the terminal identification information for identifying each connection control device, which is a control device connected to the vehicle control device, is acquired, and from the terminal identification information acquired, the authentication level of the function permitted to the control device is determined based on the correspondence relationship in which the terminal identification information is associated with the authentication level of the connection control device in accordance with the authentication level of the connection control device. Further, this terminal identification information is acquired when a control device is newly connected to and added to a vehicle control device that is mounted on a vehicle and is capable of controlling a plurality of on-board devices in order to update software used for control. Therefore, when supplementing the lack of performance in the vehicle control device that is already mounted on the vehicle for software update by connecting the control device later, it is possible to change the permitted functions for each product grade of the control device.

In order to achieve the above object, the vehicle system of the present disclosure includes the aforementioned vehicle control device (30) which is mounted on a vehicle and is capable of controlling a plurality of vehicle-mounted devices (34, 35, 36, 37, 38), and a connection control device (39) which is a control device newly connected to and added to the vehicle control device for updating software used for control.

According to this, since the above-mentioned vehicle control device is included, when supplementing the insufficient performance of the vehicle control device already installed in the vehicle due to software update by connecting the control device later, it is possible to change the permitted function according to the product grade of the control device.

1 is a diagram showing an example of a schematic configuration of a vehicle system 1; FIG. 2 is a diagram showing an example of a schematic configuration of a server 2; FIG. 3 is a diagram showing an example of a schematic configuration of a vehicle-side unit 3; FIG. 2 is a diagram showing an example of a schematic configuration of an integrated ECU 30; FIG. 4 is a diagram for explaining an example of functions permitted to an additional ECU 39 according to an authentication level; FIG. 4 is a sequence diagram showing an example of a flow of authentication-related processing at the time of connection in the vehicle system 1; FIG. FIG. 3 is a sequence diagram showing an example of the flow of disconnection-related processing in the vehicle system 1;

A number of embodiments for the disclosure are described with reference to the drawings. For convenience of explanation, parts having the same functions as the parts shown in the drawings used in the previous explanation may be denoted by the same reference numerals, and the explanation thereof may be omitted among a plurality of embodiments. The description in the other embodiments can be referred to for the parts with the same reference numerals.

(Embodiment 1)
<Schematic Configuration of Vehicle System 1>
Hereinafter, this embodiment will be described with reference to the drawings. First, the vehicle system 1 will be described with reference to FIG. As shown in FIG. 1, the vehicle system 1 includes a server 2 and vehicle-side units 3 used in each of a plurality of vehicles.

The server 2 is a server device installed outside the vehicle. Server 2 is connected to a public communication network. The server 2 acquires information transmitted from the vehicle-side unit 3 via a public communication network. The server 2 also transmits information to the vehicle-side unit 3 via the public communication network.

The server 2 is mainly composed of a microcomputer (hereinafter referred to as a microcomputer) having, for example, a processor, memory, I/O, and a bus connecting them. The server 2 executes the control program stored in the memory to execute various processes related to determining the level of functions (hereinafter referred to as the authentication level) to be permitted to the additional ECU 39 described later. Memory, as used herein, is a non-transitory tangible storage medium for non-transitory storage of computer-readable programs and data. A non-transitional physical storage medium is realized by a semiconductor memory, a magnetic disk, or the like.

The server 2 may consist of one server device, or may consist of a plurality of server devices. The server 2 may be a server device arranged on the cloud. Details of the server 2 will be described later.

The vehicle-side unit 3 is used in a vehicle as described above. The vehicle-side unit 3 can communicate with the server 2 . Details of the vehicle-side unit 3 will be described later.

<Schematic configuration of server 2>
Next, a schematic configuration of the server 2 will be described with reference to FIG. As shown in FIG. 2, the server 2 includes a registration unit 20, an information acquisition unit 21, an authentication level determination unit 22, a cancellation processing unit 23, and a response unit 24 as functional blocks. Note that part or all of the functions executed by the server 2 may be configured as hardware using one or a plurality of ICs or the like. Also, some or all of the functional blocks provided by the server 2 may be implemented by a combination of software executed by a processor and hardware members.

The registration unit 20 stores in advance identification information (hereinafter referred to as vehicle ID) for identifying each integrated ECU 30 described later, identification information (hereinafter referred to as terminal ID) for identifying each additional ECU 39 described later, and a correspondence relationship between authentication levels (hereinafter referred to as registration correspondence relationship). It is assumed that this registered correspondence relationship is stored in advance through regular procedures, for example, on a terminal of a dealer or the like. It is assumed that this registered correspondence relationship is stored in the registration unit 20 for each of the integrated ECUs 30 described later used in a plurality of vehicles. In other words, the server 2 is shared by the multiple integrated ECUs 30 . Note that a nonvolatile memory, for example, may be used as the registration unit 20 .

The information acquisition section 21 acquires information transmitted from the vehicle-side unit 3 . Information transmitted from the vehicle-side unit 3 includes an authentication request, a cancellation request, and the like. The authentication request is a request for authentication of the terminal ID. As an example, the authentication request may include the vehicle-side ID of the integrated ECU 30 of the vehicle-side unit 3 that issues the authentication request and the terminal ID of the additional ECU 39 connected to the integrated ECU 30 . The cancellation request is a request for canceling the registered correspondence stored in the registration unit 20 . The release request may include at least the vehicle-side ID of the integrated ECU 30 of the vehicle-side unit 3 that issues the release request. The cancellation request may include the terminal ID of the additional ECU 39 connected to the integrated ECU 30 .

When the information acquisition unit 21 acquires an authentication request from the vehicle-side unit 3, the authentication level determination unit 22 uses the terminal ID and the vehicle-side ID included in the authentication request to authenticate the terminal ID and determine the authentication level. As an example, when the combination of the terminal ID and the vehicle side ID included in the authentication request exists in the registration correspondence relationship stored in the registration unit 20, the authentication of the terminal ID is established. When the terminal ID is authenticated, the connection is permitted, and the authentication level associated with the terminal ID and the vehicle side ID included in the authentication request is determined as the authentication level for the additional ECU 39 of the terminal ID in the registration correspondence relationship stored in the registration part 20. - 特許庁

On the other hand, if the combination of the terminal ID and the vehicle ID included in the authentication request does not exist in the registered correspondence relationship stored in the registration unit 20, the authentication of the terminal ID fails. An example of such a case is a case where the terminal ID included in the authentication request is not included in the registration correspondence stored in the registration unit 20 . This situation occurs when the additional ECU 39 is not a legitimate product and the terminal ID of the additional ECU 39 is not stored in the registration unit 20 . In addition, the terminal ID included in the authentication request may be associated with a vehicle-side ID different from the vehicle-side ID included in the authentication request in the registered correspondence relationship stored in the registration unit 20 . Such a situation occurs when the additional ECU 39 is a stolen item from another vehicle and the terminal ID of this additional ECU 39 is already associated with the vehicle-side ID of the integrated ECU 30 of this other vehicle. If the terminal ID authentication fails, the connection is not permitted, and the authentication level corresponding to the connection refusal is determined.

In the following description, a case in which there are four authentication levels A to D will be described as an example. It is assumed that the heights of authentication levels A to D have a relationship of A>B>C>D. That is, authentication level A is the highest level, and authentication level D is the lowest level. The authentication level D, which is the lowest level, is set as the authentication level corresponding to disapproval of connection. Authentication levels A to C are authentication levels corresponding to connection permission.

When the information acquisition unit 21 acquires a cancellation request from the vehicle-side unit 3, the cancellation processing unit 23 cancels the registration correspondence relationship stored in the registration unit 20 using the vehicle-side ID included in the cancellation request. As an example, among the registered correspondences stored in the registration unit 20, the registered correspondence that includes the vehicle-side ID included in the cancellation request may be canceled. For example, the registered correspondence relationship including the vehicle-side ID included in the cancellation request may be deleted from the registration unit 20 to cancel the registered correspondence relationship.

Note that the terminal ID included in the cancellation request may be used instead of the vehicle-side ID to cancel the registered correspondence that includes this terminal ID among the registered correspondences stored in the registration unit 20 . However, from the viewpoint of reducing the possibility of illegal cancellation of the registered correspondence relationship using the additional ECU 39 stolen from another vehicle, the configuration using the vehicle-side ID is preferable.

The response unit 24 responds with the authentication level determined by the authentication level determination unit 22 to the vehicle-side unit 3 that has transmitted the authentication request. Further, when the cancellation processing is performed by the cancellation processing unit 23, the response unit 24 responds to the transmission source of the cancellation request to the vehicle-side unit 3 that the cancellation has been completed.

<Schematic configuration of vehicle-side unit 3>
Next, a schematic configuration of the vehicle-side unit 3 will be described with reference to FIG. As shown in FIG. 3, the vehicle-side unit 3 includes an integrated ECU 30, a communication module 31, an in-vehicle LAN 32, a connector 33, a meter MID (Multi Information Display) 34, a CID (Center Information Display) 35, a HUD (Head-Up Display) device 36, a speaker 37, an air conditioner unit 38, and an additional ECU 39.

The communication module 31 is an in-vehicle communication module. The communication module 31 communicates with the server 2 by connecting to a public communication network. As the communication module 31, for example, a DCM (Data Communication Module) may be used. The in-vehicle LAN 32 is an in-vehicle network that communicably connects in-vehicle devices such as an in-vehicle ECU. In the example of this embodiment, the integrated ECU 30 and the air conditioner unit 38 are connected to the in-vehicle LAN 32 .

The connector 33 is a connector that connects the integrated ECU 30 and other devices so that information can be exchanged. In this embodiment, the connector 33 connects the integrated ECU 30 and the additional ECU 39 . The connector 33 can change the communication standard that can be used when connecting devices. The communication standard referred to here is a standard used for communication between devices, and can be rephrased as an interface standard.

In this embodiment, a case where a USB (Universal Serial Bus) Type-C connector, for example, is used as the connector 33 will be described as an example. In this embodiment, the connector 33 can use, for example, USB 2.0, USB 3.0, and a communication standard for video signal transfer (hereinafter referred to as video line) as communication standards. Examples of video lines include HDMI (registered trademark), DisplayPort, and the like.

The meter MID 34 is a display provided inside the vehicle, for example, in front of the driver's seat. As an example, the meter MID 34 may be configured to be provided on the meter panel. A liquid crystal display, an organic EL display, or the like can be used as the meter MID 34 . As an example, the meter MID 34 mainly displays safety/security function information such as meter information. This meter MID34 corresponds to an in-vehicle device.

The CID 35 is a display provided in, for example, a center cluster inside the vehicle. A liquid crystal display, an organic EL display, or the like can be used as the CID 35 . As an example, the CID 35 mainly displays multimedia function information such as navigation information and audio information. The navigation information is information relating to the navigation function, and is, for example, a route guidance image. The audio information is an image or the like related to the operation of the audio equipment. Air conditioning information and the like are also displayed on the CID 35 . The air-conditioning information is an image or the like regarding the operation of the air-conditioning unit 38 . This CID 35 also corresponds to an in-vehicle device.

The HUD device 36 is provided, for example, on an instrument panel in the vehicle interior. The HUD device 36 projects the display image formed by the projector onto a predetermined projection area on the front windshield as a projection member. The image light reflected by the front windshield to the interior of the vehicle is perceived by the driver seated in the driver's seat. As a result, the driver can visually recognize the virtual image of the display image formed in front of the front windshield overlapping a part of the foreground. An example of the display image is an image showing the state of the vehicle, such as vehicle speed. The projection member onto which the HUD device 36 projects the display image is not limited to the front windshield, and may be a translucent combiner. This HUD device 36 also corresponds to an in-vehicle device.

The speaker 37 is a group of speakers provided inside the vehicle. This speaker corresponds to the audio output device. In the example of the present embodiment, the number and arrangement of the speakers 37 are such that they can support both stereo (that is, 2.0ch) sound and 5.1ch surround sound. Hereinafter, stereo sound will be referred to as 2.0ch output, and 5.1ch surround sound will be referred to as 5.1ch output. Two speakers are used for 2.0ch output. Six speakers are used for 5.1ch output. For example, in the case of 5.1ch output, a total of six speakers, two on the left and right in front of the vehicle, one in the center on the front of the vehicle, one on the left and right in the rear of the vehicle, and one subwoofer, may be used. For 2.0ch output, of the six speakers used for 5.1ch output, two on the front left and right sides of the vehicle may be used. This speaker 37 also corresponds to an in-vehicle device.

The air conditioner unit 38 is a unit for air conditioning the interior of the vehicle. The air conditioner unit 38 air-conditions the vehicle by supplying cool air or warm air from an outlet provided in an instrument panel or the like. This air conditioner unit 38 also corresponds to an in-vehicle device.

The integrated ECU 30 is an electronic control unit that integrates functions for controlling a plurality of in-vehicle devices. It is assumed that the integrated ECU 30 is mounted on the vehicle. In the example of this embodiment, the integrated ECU 30 is directly connected to in-vehicle devices such as a meter MID 34 , a CID 35 , a HUD device 36 and a speaker 37 . In addition, the integrated ECU 30 is indirectly connected to an in-vehicle device such as an air conditioner unit 38 via an in-vehicle LAN 32 .

The integrated ECU 30 can cause the meter MID 34, CID 35, and HUD device 36 to display various images. The integrated ECU 30 can output sound from the speaker 37 . The integrated ECU 30 can perform air conditioning from an air conditioner unit 38 via the in-vehicle LAN 32 .

The integrated ECU 30 is connected to the in-vehicle LAN 32 and receives information from sensors, other ECUs, etc. connected to the in-vehicle LAN 32 . The information input to the integrated ECU 30 via the in-vehicle LAN 32 includes, for example, vehicle information such as vehicle speed and travel distance, video information of digital television, and smart phone link information linked with a smart phone. The integrated ECU 30 collectively manages input information and output information, and is capable of freely rearranging the input sources and output destinations of various types of information.

The integrated ECU 30 is mainly composed of a microcomputer (hereinafter referred to as a microcomputer) having, for example, a processor, memory, I/O, and a bus connecting them. The integrated ECU 30 executes a control program stored in the memory to execute various processes related to control of a plurality of in-vehicle devices. The integrated ECU 30 corresponds to a vehicle control device. Memory, as used herein, is a non-transitory tangible storage medium for non-transitory storage of computer-readable programs and data. A non-transitional physical storage medium is realized by a semiconductor memory, a magnetic disk, or the like.

The integrated ECU 30 can control a plurality of in-vehicle devices by executing an application related to control of the plurality of in-vehicle devices on software. In the following description, this software is, for example, basic software (OS). This OS may be capable of being updated, upgraded, etc., by an update program within a range in which the specifications of the integrated ECU 30 satisfy the operating environment. Note that the update program may be configured to be acquired from outside the vehicle via the communication module 31, for example. The operating environment referred to here may be replaced with the recommended environment. Also, specs can be rephrased as performance. The specifications of the integrated ECU 30 are, for example, the number of clocks of the processor, memory capacity, and the like. Note that the integrated ECU 30 may be configured to operate multiple OSs.

The additional ECU 39 is a control device that is newly connected to and added to the integrated ECU 30 for upgrading the OS. This additional ECU 39 corresponds to a connection control device. A connection between the integrated ECU 30 and the additional ECU 39 is made via a connector 33 . The connection for upgrading refers to the connection in the case where the specification of the integrated ECU 30 does not allow the OS to be updated, but the OS can be updated by newly connecting the additional ECU 39 . The additional ECU 39 may not be used alone, for example. Not being used alone means that it does not function without being connected to other devices. In other words, it means that it does not function by itself.

As an example, the integrated ECU 30 may be built in a position not exposed to the outside of the vehicle interior, and the connecting portion of the connector 33 for connecting with the integrated ECU 30 may be exposed to the interior of the vehicle. The additional ECU 39 may be configured to be connected to the connector 33 as a retrofit in the vehicle interior. Note that the connecting portion of the connector 33 is not limited to being exposed in the vehicle interior as long as it is in a storage space that can be easily opened and closed from the vehicle interior. For example, in consideration of the appearance, the connecting portion of the connector 33 may be provided in a storage space of the dashboard, for example, and the additional ECU 39 connected to the connector 33 may be stored in the storage space.

<Schematic Configuration of Integrated ECU 30>
Next, a schematic configuration of the integrated ECU 30 will be described with reference to FIG. 4 . In this embodiment, for the sake of convenience, the description of the configuration of the integrated ECU 30 other than the configuration related to the change of the function permitted to the additional ECU 39 when the additional ECU 39 is connected will be omitted. As shown in FIG. 4, the integrated ECU 30 includes a terminal ID acquisition section 301, a transmission processing section 302, a result acquisition section 303, a function restriction section 304, and a storage section 305 as functional blocks. A part or all of the functions executed by the integrated ECU 30 may be configured as hardware using one or a plurality of ICs or the like. Also, some or all of the functional blocks included in the integrated ECU 30 may be implemented by a combination of software executed by a processor and hardware members.

A terminal ID acquisition unit 301 acquires the terminal ID of the additional ECU 39 from the additional ECU 39 when the additional ECU 39 is newly connected and added to the integrated ECU 30 for updating the OS. This terminal ID corresponds to the terminal identification information, and the terminal ID obtaining section 301 corresponds to the terminal identification information obtaining section. When detecting that the additional ECU 39 is connected to the connector 33 , the terminal ID obtaining section 301 may request the additional ECU 39 for the terminal ID and obtain the terminal ID from the additional ECU 39 . The connection of the additional ECU 39 to the connector 33 may be detected based on, for example, a pull-down resistor.

When the additional ECU 39 is newly connected, the transmission processing unit 302 transmits an authentication request including the terminal ID acquired by the terminal ID acquisition unit 301 and the vehicle side ID of the integrated ECU 30 as its own device to the server 2 via the communication module 31. In addition, the vehicle side ID should just be the identification information which can identify each integrated ECU30. The vehicle-side ID is not limited to the device ID of the integrated ECU 30, and may be the vehicle ID of the vehicle in which the integrated ECU 30 is mounted. This vehicle-side ID corresponds to vehicle-side identification information.

The result acquisition unit 303 acquires the authentication level of the additional ECU 39 determined by the server 2 via the communication module 31 as a response to the authentication request transmitted by the transmission processing unit 302 . In other words, from the terminal ID transmitted by the transmission processing unit 302, the server 2 acquires the authentication level of the additional ECU 39 determined based on the registered correspondence relationship.

If the terminal ID transmitted by the transmission processing unit 302 and the vehicle-side ID are not associated with each other in a registered correspondence relationship, the result acquisition unit 303 acquires an authentication level of connection disapproval. A result acquisition part 303 acquires a connection disapproval authentication level even when the terminal ID transmitted by the transmission processing part 302 is associated with a vehicle-side ID different from the vehicle-side ID transmitted by the transmission processing part 302 in a registered correspondence relationship. The authentication level for connection disapproval is authentication level D in this embodiment.

On the other hand, when the terminal ID transmitted by the transmission processing part 302 and the vehicle side ID are associated with each other in a registered correspondence relationship, the result acquisition part 303 acquires an authentication level not disallowing connection, which is higher than the authentication level D disallowing connection. Authentication levels that do not prohibit connection are authentication levels A to C in this embodiment. The result acquisition unit 303 acquires the authentication level associated with the combination of the terminal ID and the vehicle ID transmitted by the transmission processing unit 302 in the registered correspondence relation among the authentication levels A to C.

The function restricting unit 304 changes the functions permitted to the additional ECU 39 according to the authentication level acquired by the result acquiring unit 303 . The function restriction unit 304 does not permit connection of the additional ECU 39 to the integrated ECU 30 when the authentication level acquired by the result acquisition unit 303 is an authentication level that does not permit connection. In this case, for example, the function restriction unit 304 cuts off the electrical connection of the connector 33 so that the additional ECU 39 is not connected to the integrated ECU 30 . On the other hand, when the authentication level acquired by the result acquiring unit 303 is an authentication level that does not prohibit connection, the function restricting unit 304 permits the additional ECU 39 to be connected to the integrated ECU 30, and permits the additional ECU 39 to perform functions corresponding to the authentication level.

Here, an example of the functions permitted to the additional ECU 39 according to the authentication level will be described with reference to FIG. 5 . In the example of FIG. 5, the functions are roughly classified into "display", "audio output", "data transfer", and "vehicle LAN access". “Display” is a function related to display on displays such as the meter MID 34 , CID 35 and HUD device 36 . “Audio output” is a function related to audio output from the speaker 37 . “Data transfer” is a function related to data transfer via the connector 33 . “In-vehicle LAN access” is a function related to connection to the in-vehicle LAN 32 .

First, in the case of authentication level D, which is the lowest authentication level, connection of the additional ECU 39 to the integrated ECU 30 is not permitted, and all functions are not permitted. If the authentication level is authentication level C, which is the next lowest authentication level after authentication level D, only a part of the screen of meter MID 34, CID 35, and CID 35 of HUD device 36 is allowed to be displayed for the "display" function. In addition, it is subject to forced running, in which display is not permitted when the vehicle is running. In the case of authentication level C, only 2ch output of 2ch output and 5.1ch output is permitted for the function of "audio output". In the case of authentication level C, the use of USB 2.0 as a communication standard for data transfer via the connector 33 is permitted for the “data transfer” function. In the case of authentication level C, connection to the in-vehicle LAN 32 is not permitted for the function of "in-vehicle LAN access".

In the case of authentication level B, which is the next lowest authentication level after authentication level C, the display of the entire screen of meter MID 34, CID 35, and CID 35 of HUD device 36 is permitted for the function of "display". In addition, it is subject to forced running, in which display is not permitted when the vehicle is running. In the case of authentication level B, the "audio output" function permits audio output from the speaker 37 up to 5.1ch output. In the case of authentication level B, the use of USB 3.0 as a communication standard for data transfer via the connector 33 is permitted for the "data transfer" function. In the case of authentication level B, connection to the in-vehicle LAN 32 is partially permitted for the function of "in-vehicle LAN access". As an example, control of the air conditioner unit 38 via the in-vehicle LAN 32 is permitted. The control of the air conditioner unit 38 may be configured to permit even control by voice recognition. It should be noted that the air conditioner unit 38 may be controlled via a control microcomputer for controlling the air conditioner unit 38 .

In the case of the authentication level A with the highest authentication level, the display in all of meter MID34, CID35, and the HUD apparatus 36 is permitted about the function of a "display." Also, when the vehicle is running, it is not subject to forced running that does not permit display. In the case of authentication level A, for the "audio output" function, audio output from the speaker 37 is permitted up to 5.1ch output. In the case of authentication level A, for the “data transfer” function, USB 2.0 and video line are permitted as communication standards used for data transfer via the connector 33 . In the case of authentication level A, connection to the in-vehicle LAN 32 is entirely permitted for the function of "in-vehicle LAN access". As an example, not only control of the air conditioner unit 38 via the in-vehicle LAN 32 but also acquisition of information from the in-vehicle LAN 32, opening/closing control of the sunroof, and the like are permitted.

As described above, function restriction unit 304 changes the communication standard that can be used when connecting integrated ECU 30 and additional ECU 39 according to the authentication level acquired by result acquisition unit 303 . For example, as the authentication level increases, the communication standard is changed so as to increase the data transferable capacity per unit time. According to this, according to the product grade of additional ECU39, it becomes possible to change the communication standard which can be used. Therefore, for example, as the product grade of the additional ECU 39 increases, it becomes possible to change the communication standard so as to increase the data transferable capacity per unit time.

As described above, the function restriction unit 304 permits connection to the in-vehicle LAN 32 as the authentication level acquired by the result acquisition unit 303 increases. According to this, it becomes possible to permit connection to the in-vehicle LAN 32 as the product grade of the additional ECU 39 increases.

As described above, the function restriction unit 304 increases the number of displays (that is, display devices) capable of displaying information as the authentication level acquired by the result acquisition unit 303 increases. This makes it possible to increase the number of displays capable of displaying information as the product grade of the additional ECU 39 increases.

As described above, the function restricting unit 304 increases the number of speakers 37 that can be used to output audio as the authentication level acquired by the result acquiring unit 303 increases. According to this, it becomes possible to increase the number of speakers 37 that can be used for outputting sound as the product grade of the additional ECU 39 increases.

As described above, by changing the permitted functions for each product grade of the additional ECU 39, it is possible to set a plurality of grades of the additional ECU 39 that meet the price range desired by the customer.

In addition, the terminal ID acquisition part 301 acquires an authentication level that does not prohibit connection in the result acquisition part 303, and acquires the terminal ID from the additional ECU 39 connected to the integrated ECU 30 corresponding to the terminal ID each time a predetermined trigger is detected even after the connection of the additional ECU 39 to the integrated ECU 30 is permitted. The predetermined trigger may be, for example, activation of the vehicle. Activation of the vehicle may be detected based on, for example, that the IG power supply is turned on.

A storage part 305 stores the terminal ID included in the authentication request transmitted by the transmission processing part 302 when acquiring the authentication level, when the result acquisition part 303 acquires an authentication level not disallowing connection in response to the authentication request transmitted from the transmission processing part 302.例文帳に追加A nonvolatile memory may be used as the storage unit 305 . Note that the storage unit 305 may store the terminal ID and the authentication level acquired by the result acquisition unit 303 in association with each other.

After the aforementioned connection permission, the function restriction unit 304 maintains the connection permission of the additional ECU 39 to the integrated ECU 30 when the terminal ID acquired by the terminal ID acquisition unit 301 upon detection of a predetermined trigger matches the terminal ID stored in the storage unit 305. On the other hand, if the terminal ID acquired by the terminal ID acquisition unit 301 does not match the terminal ID stored in the storage unit 305, connection of the additional ECU 39 to the integrated ECU 30 is not permitted. If the connection is not permitted, the function restriction unit 304 cuts off the electrical connection of the connector 33 so that the additional ECU 39 is not connected to the integrated ECU 30 . That is, after the connection is permitted as described above, the terminal ID is authenticated not by the server 2 but by the integrated ECU 30 .

According to this, once the server 2 authenticates the terminal ID, the integrated ECU 30 authenticates the terminal ID. Therefore, it is possible to reduce the processing load on the server 2 and the communication load with the server 2 compared to a configuration in which the server 2 authenticates the terminal ID each time a predetermined trigger is detected.

In the case of a configuration in which the terminal ID and the authentication level are linked and stored in the storage unit 305, in addition to the authentication of the terminal ID, the integrated ECU 30 may determine the authentication level each time a predetermined trigger is detected. In the case of a configuration in which the terminal ID and the authentication level are not linked and stored in the storage unit 305, the terminal ID is authenticated by the integrated ECU 30 each time a predetermined trigger is detected, and the authentication level is maintained when the authentication is established.

Further, the transmission processing unit 302 transmits a disconnection request to the server 2 via the communication module 31 when disconnecting the additional ECU 39 from the integrated ECU 30 (hereinafter, when disconnecting). The transmission processing unit 302 may determine that it is time to disconnect, for example, by detecting that an input for disconnecting according to a regular procedure has been made at a dealer or the like.

The result acquisition unit 303 acquires a canceled response returned from the server 2 in response to the cancellation request transmitted from the transmission processing unit 302 . When the result acquisition unit 303 acquires a release response and the terminal ID is stored in the storage unit 305, the terminal ID stored in the storage unit 305 may be deleted. When the terminal ID and the authentication level are stored in the storage unit 305 in association with each other, the authentication level may be deleted from the storage unit 305 in addition to the terminal ID. Also, when the result acquisition unit 303 acquires a response indicating that the cancellation has been completed, the function restriction unit 304 cuts off the electrical connection of the connector 33 so that the additional ECU 39 is not connected to the integrated ECU 30 .

<Processing related to authentication at the time of connection in vehicle system 1>
Next, an example of the flow of processing related to authentication when connecting the additional ECU 39 to the integrated ECU 30 in the vehicle system 1 (hereinafter referred to as authentication-related processing at connection) will be described using the sequence diagram of FIG. 6 . In the example of FIG. 6, the case where the authentication of the terminal ID is established will be described as an example. The process of FIG. 6 may be started when the terminal ID acquisition unit 301 detects that the additional ECU 39 is connected to the connector 33 . In the temporary connection stage until the connection is permitted by the integrated ECU 30, data transfer between the integrated ECU 30 and the additional ECU 39 may be performed according to a predetermined communication standard such as USB 2.0. Execution of the steps included in the connection authentication-related process by the computer corresponds to execution of the vehicle control method.

First, at t1, the terminal ID acquisition unit 301 of the integrated ECU 30 requests the additional ECU 39 for the terminal ID via the connector 33 . At t<b>2 , the additional ECU 39 that has received the terminal ID request transmits the terminal ID of its own device to the integrated ECU 30 via the connector 33 . As a result, the terminal ID acquisition unit 301 acquires the terminal ID from the additional ECU 39 .

At t3, the transmission processing unit 302 of the integrated ECU 30 causes the server 2 to transmit an authentication request via the communication module 31 . At t4, the authentication level determining unit 22 of the server 2 performs authentication and authentication level determination using the terminal ID included in the authentication request. At t5, the response unit 24 of the server 2 responds to the integrated ECU 30 via the communication module 31 with the authentication level. In integrated ECU 30 , result acquisition unit 303 acquires the authentication level returned from server 2 .

At t<b>6 , the function restriction unit 304 of the integrated ECU 30 permits the additional ECU 39 to function according to the authentication level acquired by the result acquisition unit 303 . At t7, the terminal ID acquisition unit 301 stores the terminal ID acquired at t2 in the storage unit 305. FIG. The sequence diagram of FIG. 6 shows an example in which the terminal ID is authenticated. However, if the terminal ID is not authenticated at t4, connection of the additional ECU 39 to the integrated ECU 30 is not permitted at t6, and the process ends. In this case, the function limiting unit 304 cuts off the electrical connection of the connector 33 so that the additional ECU 39 is not connected to the integrated ECU 30 .

At t8, the terminal ID acquisition unit 301 detects a trigger such as turning on the IG power. At t9, the terminal ID acquisition unit 301 requests a terminal ID from the additional ECU 39 via the connector 33 . At t<b>10 , the additional ECU 39 that has received the request for the terminal ID transmits the terminal ID of its own device to the integrated ECU 30 via the connector 33 . As a result, the terminal ID acquisition unit 301 acquires the terminal ID from the additional ECU 39 .

At t11, for example, the function restriction unit 304 of the integrated ECU 30 authenticates the terminal ID based on whether the terminal ID acquired at t10 is stored in the storage unit 305 or not. At t12, the function restriction unit 304 maintains the connection between the integrated ECU 30 and the additional ECU 39 when the terminal ID is authenticated. If the terminal ID is successfully authenticated, the function restriction unit 304 may also maintain the authentication level. After that, the processing from t8 to t12 is repeated each time a trigger is detected.

The sequence diagram of FIG. 6 shows an example in which the terminal ID is authenticated. However, if the terminal ID is not authenticated at t11, the connection of the additional ECU 39 to the integrated ECU 30 is not permitted at t12, and the process ends. A situation in which the authentication of the terminal ID is not established at t11 includes the case where the additional ECU 39 is illegally replaced while the IG power source of the vehicle is turned off.

<Processing Related to Disconnection in Vehicle System 1>
Next, an example of the flow of processing related to disconnection between the integrated ECU 30 and the ECU 39 in the vehicle system 1 (hereinafter referred to as disconnection related processing) will be described using the sequence diagram of FIG. 7 . The process of FIG. 7 may be started, for example, when the integrated ECU 30 detects that an input has been made for disconnection according to a regular procedure at a dealer or the like.

First, at t<b>21 , the transmission processing unit 302 of the integrated ECU 30 causes the server 2 to transmit a release request via the communication module 31 . At t22, the cancellation processing unit 23 of the server 2 uses the vehicle-side ID included in the cancellation request to cancel the registered correspondence containing the vehicle-side ID among the registered correspondences stored in the registration unit 20.

At t23, the response unit 24 of the server 2 responds to the integrated ECU 30 via the communication module 31 that the release has been completed. In the integrated ECU 30 , the result acquisition unit 303 acquires the notification from the server 2 indicating that the cancellation has been completed. At t<b>24 , the function limiting unit 304 of the integrated ECU 30 cuts off the electrical connection of the connector 33 so that the additional ECU 39 is not connected to the integrated ECU 30 . At this time, the integrated ECU 30 may cause the aforementioned display to display an indication that the registered correspondence between the integrated ECU 30 and the additional ECU 39 in the server 2 has been cancelled.

<Summary of Embodiment 1>
According to the configuration of the first embodiment, the terminal ID for identifying each of the additional ECUs 39 connected to the integrated ECU 30 is acquired, and the function to be permitted to the additional ECU 39 is changed according to the authentication level of the additional ECU 39 determined from the acquired terminal ID. Also, this terminal ID is acquired when an additional ECU 39 is newly connected to and added to the integrated ECU 30 for updating software used for control. Therefore, when supplementing the insufficient performance of the vehicle control device installed in the vehicle for software update by connecting the control device later, it becomes possible to change the permitted functions according to the product grade of the control device.

Further, according to the configuration of the first embodiment, the server 2 that stores the registration correspondence relationship used for terminal ID authentication and authentication level determination is shared by a plurality of integrated ECUs 30, so security can be further enhanced. Details are as follows. Even if an additional ECU 39 linked to an integrated ECU 30 mounted on a certain vehicle (hereinafter referred to as a first vehicle) is stolen and an attempt is made to connect it to an integrated ECU 30 mounted on another vehicle (hereinafter referred to as a second vehicle), the additional ECU 39 cannot be connected to anything other than the integrated ECU 30 linked by the registered correspondence since the server 2 has already stored the registered correspondence.

Note that the functions permitted by the function restriction unit 304 are not limited to the functions described in the first embodiment. For example, it may be part of the functions described in the first embodiment, or may be other functions. Further, the in-vehicle device that can be controlled by the function restriction unit 304 is not limited to the in-vehicle device described in the first embodiment. For example, it may be a part of the in-vehicle device described in the first embodiment, or may be another in-vehicle device.

(Embodiment 2)
In the first embodiment, the connection between the integrated ECU 30 and the additional ECU 39 is a wired connection via the connector 33, but the configuration is not necessarily limited to this. For example, the connection between the integrated ECU 30 and the additional ECU 39 may be a connection through wireless communication. In this case, the connection between the integrated ECU 30 and the additional ECU 39 may be established by short-range wireless communication. The additional ECU 39 may be configured to be used in a vehicle. Further, when changing the communication standard according to the authentication level, the configuration may be such that the communication standard that can be used for this short-range wireless communication is changed. In this case, for example, as the authentication level increases, the communication standard may be changed so as to increase the amount of data that can be transferred per unit time.

(Embodiment 3)
Although the configuration including the server 2 in the vehicle system 1 is shown in the first embodiment, the configuration is not necessarily limited to this. For example, the vehicle system 1 may be configured without the server 2 . In this case, the integrated ECU 30 may include functional blocks that perform the same functions as the registration unit 20, the authentication level determination unit 22, and the cancellation processing unit 23, but the transmission processing unit 302 and the result acquisition unit 303 may be omitted. Then, the integrated ECU 30 may authenticate the terminal ID and determine the authentication level. Also, in this case, the configuration may include the registration unit 20 instead of the storage unit 305 .

The present disclosure is not limited to the above-described embodiments, and various modifications are possible within the scope of the claims, and embodiments obtained by appropriately combining technical means disclosed in different embodiments are also included in the technical scope of the present disclosure. The controller and techniques described in this disclosure may also be implemented by a special purpose computer comprising a processor programmed to perform one or more functions embodied by a computer program. Alternatively, the apparatus and techniques described in this disclosure may be implemented by dedicated hardware logic circuitry. Alternatively, the apparatus and techniques described in this disclosure may be implemented by one or more special purpose computers configured by a combination of a processor executing a computer program and one or more hardware logic circuits. The computer program may also be stored as computer-executable instructions on a computer-readable non-transitional tangible recording medium.

1 vehicle display system, 2 server, 3 vehicle side unit, 20 registration unit, 21 information acquisition unit, 22 authentication level determination unit, 23 cancellation processing unit, 24 response unit, 30 integrated ECU (vehicle control device), 31 communication module, 32 vehicle LAN (vehicle network), 33 connector, 34 meter MID (vehicle device), 35 CID (vehicle device), 36 HUD device (vehicle device), 37 speaker ( in-vehicle device), 38 air conditioner unit (in-vehicle device), 39 additional ECU (connection control device), 301 terminal ID acquisition unit (terminal identification information acquisition unit), 302 transmission processing unit, 303 result acquisition unit, 304 function restriction unit, 305 storage unit

Claims (10)

A vehicle control device mounted on a vehicle and capable of controlling a plurality of on-vehicle devices (34, 35, 36, 37, 38),
a terminal identification information acquisition unit (301) for acquiring terminal identification information for identifying each control device from a connection control device (39), which is the control device connected to the vehicle control device, when a control device is newly connected to the vehicle control device for updating software used for control;
a function restriction unit (304) for changing the function permitted to the connection control device according to the authentication level of the connection control device determined from the terminal identification information acquired by the terminal identification information acquisition unit, based on a correspondence relationship in which an authentication level, which is the level of the function permitted to the control device, and the terminal identification information are associated in advance;
a transmission processing unit (302) for transmitting the terminal identification information acquired by the terminal identification information acquisition unit to a server (2) outside the vehicle storing the correspondence relationship;
a result acquisition unit (303) for acquiring the authentication level of the connection control device determined by the server based on the correspondence relationship from the terminal identification information transmitted by the transmission processing unit;
The function restriction unit changes a function permitted to the connection control device according to the authentication level acquired by the result acquisition unit,
In addition to the authentication level and the terminal identification information, the correspondence relationship is associated in advance with vehicle-side identification information for identifying each of the vehicle control devices,
The authentication level includes a connection disapproval authentication level that does not allow connection to the vehicle control device,
The transmission processing unit transmits to the server not only the terminal identification information but also the vehicle side identification information of the vehicle control device corresponding to the own device,
When the terminal identification information transmitted by the transmission processing unit and the vehicle-side identification information are not associated in the correspondence relationship, the result acquisition unit acquires the connection disapproval authentication level, and when the terminal identification information and the vehicle-side identification information transmitted by the transmission processing unit are associated in the correspondence relationship, the result acquisition unit acquires the authentication level that is higher than the connection disapproval authentication level and is not the connection disapproval,
The function restriction unit does not permit connection to the vehicle control device when the authentication level acquired by the result acquisition unit is the authentication level for disallowing connection, but permits connection to the vehicle control device when the authentication level acquired by the result acquisition unit is the authentication level that does not prohibit connection, and permits the connection control device to perform a function corresponding to the authentication level. 2. The vehicle control device according to claim 1, wherein the connection control device added by being connected to the vehicle control device is not used by the connection control device alone. The server is shared by a plurality of the vehicle control devices,
In the correspondence relationship, the authentication level, the terminal identification information, and the vehicle side identification information are associated in advance with respect to a plurality of the vehicle control devices,
3. The vehicle control device according to claim 1 or 2 , wherein the result acquisition unit acquires the authentication level of the connection disapproval even when the terminal identification information transmitted by the transmission processing unit is associated with the vehicle-side identification information different from the vehicle-side identification information transmitted by the transmission processing unit. The terminal identification information acquisition unit acquires the authentication level that is not the connection disapproval in the result acquisition unit, and acquires the terminal identification information from the connection control device connected to the vehicle control device corresponding to the own device each time a predetermined trigger is detected even after the connection is permitted when connection to the vehicle control device is permitted.
a storage unit (305) for storing the terminal identification information transmitted by the transmission processing unit when acquiring the authentication level when the result acquisition unit acquires the authentication level that is not the connection disapproval,
The vehicle control device according to any one of claims 1 to 3, wherein after the connection permission, the function restriction unit maintains permission for connection to the vehicle control device when the terminal identification information acquired by the terminal identification information acquisition unit matches the terminal identification information stored in the storage unit, and does not permit connection to the vehicle control device when the terminal identification information acquired by the terminal identification information acquisition unit does not match the terminal identification information stored in the storage unit. A communication standard that can be used when connecting the vehicle control device and the connection control device can be changed,
The vehicle control device according to any one of claims 1 to 4 , wherein the function restriction unit changes a communication standard that can be used when connecting the vehicle control device and the connection control device according to the authentication level determined based on the correspondence relationship. The plurality of in-vehicle devices include at least one of the in-vehicle device connected to the vehicle control device via an in-vehicle network of the vehicle and the in-vehicle device using data obtained via the in-vehicle network,
The vehicle control device according to any one of claims 1 to 5 , wherein the function restriction unit permits connection to the in-vehicle network as the authentication level determined based on the correspondence relationship increases. The plurality of in-vehicle devices include a plurality of types of display devices,
The vehicle control device according to any one of claims 1 to 6 , wherein the function restriction unit increases the number of display devices capable of displaying information as the authentication level determined based on the correspondence relationship increases. The plurality of in-vehicle devices include a plurality of audio output devices that output audio,
8. The vehicle control device according to any one of claims 1 to 7 , wherein the function restricting unit increases the number of the audio output devices that can be used to output audio as the authentication level determined based on the correspondence relationship increases. A vehicle control device (30) according to any one of claims 1 to 8 , which is mounted on a vehicle and capable of controlling a plurality of in-vehicle devices (34, 35, 36, 37, 38);
A vehicle system including a connection control device (39) which is a control device newly connected to and added to the vehicle control device for updating software used for the control. A vehicle control method implemented by a computer when adding a new control device to a vehicle control device (30) mounted on a vehicle and capable of controlling a plurality of in-vehicle devices (34, 35, 36, 37, 38) for updating software used for the control, the method comprising:
a terminal identification information acquisition step of acquiring terminal identification information for identifying each of the control devices from a connection control device (39) which is the control device connected to the vehicle control device;
a function restriction step of changing a function permitted to the connection control device according to the authentication level of the connection control device determined from the acquired terminal identification information based on a correspondence relationship in which an authentication level, which is a level of a function permitted to the control device, and the terminal identification information are associated in advance;
a transmission processing step of transmitting the terminal identification information acquired in the terminal identification information acquisition step to a server (2) outside the vehicle storing the correspondence relationship;
a result acquisition step of acquiring the authentication level of the connection control device determined by the server based on the correspondence relationship from the terminal identification information transmitted in the transmission processing step ;
In the function restriction step, a function permitted to the connection control device is changed according to the authentication level acquired in the result acquisition step,
In addition to the authentication level and the terminal identification information, the correspondence relationship is associated in advance with vehicle-side identification information for identifying each of the vehicle control devices,
The authentication level includes a connection disapproval authentication level that does not allow connection to the vehicle control device,
In the transmission processing step, in addition to the terminal identification information, the vehicle side identification information of the vehicle control device corresponding to the own device is also transmitted to the server;
In the result obtaining step, when the terminal identification information transmitted in the transmission processing step and the vehicle-side identification information are not associated in the correspondence relationship, the authentication level for disallowing connection is obtained, and when the terminal identification information and the vehicle-side identification information transmitted in the transmission processing step are associated in the correspondence relationship, the authentication level for not disallowing connection, which is higher than the authentication level for disallowing connection, is obtained;
In the function restricting step, when the authentication level obtained in the result obtaining step is the authentication level of the connection disapproval, connection to the vehicle control device is not permitted, while when the authentication level obtained in the result obtaining step is the authentication level not disallowing the connection, connection to the vehicle control device is permitted, and the connection control device is permitted to perform a function corresponding to the authentication level.

Images