JP2019040588A - Operation management system, vehicle, and information processing method - Google Patents

Abstract

To provide an operation management system or the like, capable of surely managing switching of an operation mode in a vehicle.SOLUTION: An operation management system comprises an authentication server, and a vehicle in which a manual operation and an automatic operation can be switched. A vehicle comprises: a plurality of electronic control devices connected to a network in the vehicle; a detection part that detects the switching of a manual operation mode and an automatic operation mode on the basis of a message generated by one or more electronic control devices of the plurality of electronic control devices; and a transaction data generation part that generates first transaction data including a first identifier indicating information that indicates the switching detected by the detection part and the vehicle, and transmits it to an authentication server. The authentication server comprises: a verification part that determines validity of the transaction data including the first transaction data acquired from the vehicle; and a storage part that stores the transaction data of which the validity is confirmed by the verification part to a storage device.SELECTED DRAWING: Figure 1

Description

  The present disclosure relates to an operation management system, a vehicle, and an information processing method.

  2. Description of the Related Art In recent years, research and development of automatic driving systems that automatically perform driving control of automobiles have been actively conducted. In the automatic driving system, traveling control is performed in cooperation with an electronic control unit (hereinafter referred to as ECU: Electronic Control Unit) arranged in the automobile.

  In the automatic driving system, by switching between a manual driving mode in which the driver drives, i.e., the driver performs driving control of the automobile, and an automatic driving mode in which the automobile autonomously runs, i.e., automatically performs driving control of the automobile Ensure safe driving.

  For example, Patent Document 1 discloses a technique for determining whether or not a switching condition determined in advance based on traffic regulations is met and switching from the manual operation mode to the automatic operation mode.

JP 2017-61320 A

  By the way, when there is a car accident in the automatic driving mode, the driver is not responsible and there is a problem with the car itself.

  However, in the technology disclosed in Patent Document 1, when there is an automobile accident, it cannot be objectively determined whether the accident is in the automatic driving mode or the manual driving mode. Therefore, it cannot be verified whether there is a problem in the automatic driving function that realizes the automatic driving system, and the automatic driving function cannot be improved. As a result, a safer automatic driving system cannot be constructed.

  The present disclosure has been made in view of the above-described circumstances, and an object thereof is to provide an operation management system and the like that can reliably manage operation mode switching in a vehicle.

  An operation management system according to an aspect of the present disclosure is an operation management system including one or more authentication servers and one or more vehicles that can be switched between manual operation and automatic operation, each of the one or more vehicles being A first communication unit that communicates with at least one authentication server of the one or more authentication servers, a plurality of electronic control devices connected to a network in the vehicle, and one or more of the plurality of electronic control devices Based on a message issued by the electronic control unit, a detection unit that detects switching between a manual operation mode that is manually operated and an automatic operation mode that is automatically operated, information indicating the switching detected by the detection unit, and a first that indicates the vehicle A transaction data generation unit that generates first transaction data including one identifier and transmits the first transaction data to the one authentication server via the first communication unit; Obtain. Each of the at least one authentication server includes a second communication unit that communicates with each of the one or more vehicles, and transaction data including the first transaction data acquired from at least one of the one or more vehicles. A verification unit that determines validity; and a recording unit that records the transaction data whose validity has been confirmed by the verification unit in a storage device.

  Note that these comprehensive or specific modes may be realized by a system, method, integrated circuit, computer program, or recording medium such as a computer-readable CD-ROM, and the system, method, integrated circuit, computer. You may implement | achieve with arbitrary combinations of a program and a recording medium.

  According to the present disclosure, it is possible to reliably manage switching of operation modes in a vehicle.

It is the figure which showed an example of the structure of the driving | operation management system which concerns on embodiment. It is a figure which shows an example of the whole structure of the vehicle-mounted network system which the vehicle which concerns on embodiment has. It is a figure which shows a part of functional structure of the head unit which concerns on embodiment. It is a block diagram which shows the function structure of the gateway which concerns on embodiment. It is a block diagram which shows the function structure of the authentication server which concerns on embodiment. It is explanatory drawing which shows the data structure of a block chain. It is explanatory drawing which shows the data structure of transaction data. It is a block diagram which shows the function structure of the car maker server which concerns on embodiment. It is a sequence diagram which shows the registration process between the car maker server and authentication server in embodiment. It is a flowchart which shows the detailed process of step S104 shown to FIG. 8A. It is a sequence diagram which shows the 1st verification process between the vehicle which concerns on embodiment, and an authentication server. It is a flowchart which shows the detailed process of step S201 shown to FIG. 9A. It is a flowchart which shows the detailed process of step S205 shown to FIG. 9A. It is a sequence diagram which shows the 2nd verification process between the vehicle which concerns on Embodiment 1, and an authentication server. It is a flowchart which shows the detailed process of step S209 shown to FIG. 10A. It is a flowchart which shows the detailed process of step S213 shown to FIG. 10A. It is a flowchart which shows the detailed process of step S215 shown to FIG. 10A. It is a figure which shows an example of the screen display displayed with the vehicle which concerns on embodiment. It is a figure which shows an example of the screen display displayed with the vehicle which concerns on embodiment. It is a block diagram which shows the function structure of the authentication server which concerns on the modification of embodiment. It is a sequence diagram which shows the registration process between the car maker server which concerns on the modification of embodiment, and an authentication server. It is an example of the data structure used when the authentication server which concerns on the modification of embodiment records 3rd transaction data. It is a sequence diagram which shows the 1st verification process between the vehicle and authentication server which concern on the modification of embodiment. It is an example of the data structure used when the authentication server which concerns on the modification of embodiment records 1st transaction data.

  An operation management system according to an aspect of the present disclosure is an operation management system including one or more authentication servers and one or more vehicles that can be switched between manual operation and automatic operation, each of the one or more vehicles being A first communication unit that communicates with at least one authentication server of the one or more authentication servers, a plurality of electronic control devices connected to a network in the vehicle, and one or more of the plurality of electronic control devices Based on a message issued by the electronic control unit, a detection unit that detects switching between a manual operation mode that is manually operated and an automatic operation mode that is automatically operated, information indicating the switching detected by the detection unit, and a first that indicates the vehicle A transaction data generation unit that generates first transaction data including one identifier and transmits the first transaction data to the one authentication server via the first communication unit; Obtain. Each of the at least one authentication server includes a second communication unit that communicates with each of the one or more vehicles, and transaction data including the first transaction data acquired from at least one of the one or more vehicles. A verification unit that determines validity; and a recording unit that records the transaction data whose validity has been confirmed by the verification unit in a storage device.

  Thereby, since the switching history of the driving mode in the vehicle can be recorded in the storage device, the switching of the driving mode in the vehicle can be reliably managed.

  In addition, for example, the recording unit previously records a second identifier for uniquely identifying each of the one or more vehicles in the storage device, and the verification unit is included in the first transaction data. Whether the first identifier is included in the second identifier and the validity of the first transaction data are verified, and the recording unit causes the verification unit to check whether the first identifier is the second identifier. The first transaction data may be recorded in the storage device when it is confirmed that the first transaction data is included and the validity of the first transaction data is confirmed.

  In addition, for example, each of the one or more vehicles further includes an input unit that receives input of information, and the input unit is input information, and it is approved that the switched automatic driving mode is continued. Information indicating that the transaction has been performed is transmitted to the transaction data generation unit, the transaction data generation unit generates second transaction data including the input information, and the first authentication unit is used to generate the second authentication data. It may be sent to the server.

  In addition, for example, when the information indicating the switching detected by the detection unit indicates that the switching is detected from the manual operation mode to the automatic operation mode, the transaction data generation unit includes information indicating the switching detected by the detection unit, and In addition to the first identifier indicating the vehicle, the first transaction data including information indicating an automatic driving level in the automatic driving mode is generated and transmitted to the one authentication server via the first communication unit. You may do that.

  In addition, for example, when the information indicating the switching detected by the detection unit indicates that the switching is detected from the manual operation mode to the automatic operation mode, the transaction data generation unit includes information indicating the switching detected by the detection unit, and In addition to the first identifier indicating the vehicle, the first transaction data including information indicating a driving assist function that operates in the automatic driving mode is generated, and the one authentication server is configured via the first communication unit. You may send to.

  In addition, for example, each of the one or more vehicles further includes a sensor unit that acquires sensor information indicating information regarding a driver of the vehicle for each predetermined period or for each event, and the sensor unit acquires the acquired Sensor information is transmitted to the transaction data generation unit, the transaction data generation unit generates first transaction data including information indicating the switching, the first identifier, and the sensor information, and the first communication unit It may be transmitted to the one authentication server via.

  In addition, for example, the recording unit previously records a second identifier for uniquely identifying each of the one or more vehicles in the storage device, and the verification unit is included in the first transaction data. If the first identifier is not included in the second identifier, it may be notified that the first identifier is not included in the second identifier.

  In addition, for example, the transaction data generation unit further generates transaction data including the first transaction data as block chain transaction data, and the recording unit generates the transaction data including the first transaction data in the block chain. It may be recorded as transaction data.

  Hereinafter, embodiments will be described with reference to the drawings. Note that each of the embodiments described below shows a specific example of the present disclosure. That is, the numerical values, shapes, materials, constituent elements, arrangement and connection forms of constituent elements, steps, order of steps, and the like shown in the following embodiments are examples of the present disclosure and are not intended to limit the present disclosure. . In addition, among the constituent elements in the following embodiments, constituent elements that are not described in the independent claims indicating the highest concept are not necessarily required to achieve the problems of the present disclosure, but constitute more preferable forms. It is explained as a constituent element.

(Embodiment)
[1.1 System configuration]
First, the system configuration of the present disclosure will be described.

  The operation management system according to the present disclosure reliably manages switching of an operation mode, which is switching between an automatic operation mode and a manual operation mode in a vehicle. Hereinafter, the operation management system and the like in the embodiment will be described with reference to the drawings.

[1.1.1 Overall Configuration of Operation Management System 10]
FIG. 1 is a diagram showing an example of the configuration of the operation management system according to the present embodiment.

  The driving management system 10 includes one or more authentication servers and one or more vehicles that can be switched between manual driving and automatic driving. In the present embodiment, the operation management system 10 includes, for example, vehicles 100a, 100b, and 100c, authentication servers 200a, 200b, and 200c, and a car manufacturer server 300, as shown in FIG. The vehicle 100a and the authentication server 200a and the like, the authentication server 200a and the like, and the car maker server 300 and the authentication server 200a and the like are connected by a network N. The authentication servers 200a, 200b, and 200c are connected to the storage devices 201a, 201b, and 201c. The authentication server 200a or the like may be connected to the storage device 201a or the like via the network N, or may include the storage device 201a inside. The storage device 201a electronically records blockchain transactions and blocks.

[1.1.2 Configuration of Vehicle 100a]
The vehicle 100a and the like are, for example, automobiles capable of switching between manual driving and automatic driving, but are not limited thereto. The vehicle 100a and the like may be a motorcycle, a ship, or the like that can be switched between manual operation and automatic operation. That is, the vehicle 100a or the like only needs to be able to switch between a manual operation mode in which the driver performs vehicle travel control and an automatic operation mode in which the vehicle autonomously travels, i.e., automatically performs vehicle travel control. In addition, the vehicle 100a and the like may be any vehicle as long as a plurality of ECUs are connected to the network in the vehicle 100a and the plurality of ECUs cooperate to automatically control traveling of the vehicle 100a in the automatic operation mode. .

  FIG. 2 is a diagram illustrating an example of the overall configuration of the in-vehicle network system included in the vehicle 100a according to the present embodiment. Since the vehicles 100b and 100c have the same configuration, the vehicle 100a will be described as an example.

  The plurality of electronic control devices are connected by a network in the vehicle 100a or the like. More specifically, a plurality of electronic control devices ECU111, ECU121, ECU131, ECU141, ECU151, and gateway 101 are connected via an in-vehicle network. Here, the in-vehicle network may be CAN, Ethernet (registered trademark), or a mixture of CAN and Ethernet (registered trademark). Even when the in-vehicle network includes Ethernet (registered trademark), the message may be transmitted by broadcast.

  For example, an engine 110, a battery 130, and a drive system ECU related to fuel control such as a motor (not shown) are connected to the in-vehicle network. In the example shown in FIG. 2, an ECU 111 for the engine 110 and an ECU 131 for the battery 130 are connected to the in-vehicle network.

  The in-vehicle network is connected to a driving assist unit 120 and a safety / comfort functional ECU such as an automatic brake (not shown), a lane keeping function, an inter-vehicle distance function, a collision prevention function, and an airbag. In the example illustrated in FIG. 2, an ECU 121 for the driving assist unit 120 is connected to the in-vehicle network. In the present embodiment, the ECU 121 for the driving assist unit 120, for example, when the driving assist function of the driving assist unit 120 is turned on and the driving mode of the vehicle 100a is switched between the automatic driving mode and the manual driving mode. Send a message to that effect. Note that the ECU 121 for the driving assist unit 120 may include information indicating that the driving mode of the vehicle 100a is switched between the automatic driving mode and the manual driving mode in the message that is periodically transmitted.

  An infotainment ECU such as the head unit 140 is connected to the in-vehicle network. In the example shown in FIG. 2, the ECU 141 for the head unit 140 is connected to the in-vehicle network. Note that the ECU 141 for the head unit 140 may not be provided, and the head unit 140 may be directly connected to the in-vehicle network without the ECU 141. In the present embodiment, the head unit has a display unit and an input unit, which will be described later, and has a function of accepting screen display and information input to a user such as a driver on board the vehicle 100a.

  FIG. 3 is a diagram showing a part of the functional configuration of the head unit 140 according to the present embodiment. As shown in FIG. 3, the head unit 140 includes a display unit 1411 and an input unit 1412.

  The display unit 1411 displays a screen shown in the screen information transmitted from one of the authentication server 200a and the like to the user. In the present embodiment, the display unit 1411 displays a screen for notifying the user whether or not the automatic operation mode is to be continued and notifying that the automatic operation mode has been switched.

  The input unit 1412 receives input of information. The input unit 1412 transmits information that is input by the user and that indicates that the switched automatic driving mode is approved to be continued to the gateway 101. Specifically, on the screen displayed by the display unit 1411, the input unit 1412 receives confirmation information that is information indicating approval or confirmation of continuing the switched automatic driving mode. Then, the input unit 1412 transmits the input confirmation information to the authentication server 200a or the like via the gateway 101 or the gateway 101.

  In addition, a communication system ECU such as a communication unit 150 having a communication function for communicating with the authentication server 200a or the like is connected to the in-vehicle network. In the example illustrated in FIG. 2, an ECU 151 for the communication unit 150 is connected to the in-vehicle network.

  In addition, ECU111-ECU151 mentioned above is good also as an integral with the component which each connects, ie, one component. For example, the engine 110 and the eECU 111 connected to the engine 110 may be configured as a single unit, that is, as one component. The same applies to other ECUs.

  Such a plurality of electronic control units, that is, the ECUs 111 to 151 acquire the state of the connected ones and transmit a message indicating the state or the like obtained periodically or irregularly. For example, the ECU 111 acquires the rotation speed of the engine 110 as a state or the like, and periodically transmits a message indicating the rotation speed. Further, for example, as described above, the ECU 121 transmits a message when the driving assist function of the driving assist unit 120 is turned on.

  Next, the gateway 101 connected to the in-vehicle network will be described.

[1.1.3 Configuration of Gateway 101]
FIG. 4 is a block diagram showing a functional configuration of the gateway 101 according to the present embodiment.

  The gateway 101 is mounted on the vehicle 100a and the like, and includes a detection unit 1101, a transaction data generation unit 1102, and a first communication unit 1103 as illustrated in FIG. Hereinafter, each component will be described.

<Detection unit 1101>
The detection unit 1101 detects switching between the manual operation mode in which the manual operation is performed and the automatic operation mode in which the automatic operation is performed based on a message issued by one or more of the plurality of electronic control devices. In the example illustrated in FIG. 2, the detection unit 1101 detects switching of the driving mode as switching of the assist function of the driving assist unit 120 from a message transmitted by the ECU 121 connected to the in-vehicle network. Here, the switching of the operation mode includes switching from the manual operation mode to the automatic operation mode, or switching from the automatic operation mode to the manual operation mode.

  More specifically, when the detection unit 1101 detects from the message transmitted by the ECU 121 connected to the in-vehicle network that the automatic driving function is turned on during the manual driving, the automatic driving from the manual driving mode is performed. It may be detected that the mode has been switched. Further, when the detection unit 1101 detects from the message transmitted by the ECU 121 connected to the in-vehicle network that the manual operation is performed by the driver during the automatic operation, the detection unit 1101 is switched from the automatic operation mode to the manual operation mode. It may be detected.

  Moreover, the detection part 1101 may detect that the vehicle 100a etc. switched to the parking mode which parks automatically by an automatic parking function as switching of the assist function of the driving assistance part 120.

  There are several detection methods for detecting whether or not the assist function of the driving assist unit 120 has been switched. For example, the detection unit 1101 may detect whether or not the assist function of the driving assist unit 120 has been switched from a message transmitted from the ECU 121 for the driving assist unit 120 connected to the in-vehicle network. Further, the detection unit 1101 detects whether or not the assist function of the driving assist unit 120 has been switched from information on a sensor (not shown) mounted outside the vehicle such as the vehicle 100a or a message transmitted by the sensor ECU. Also good.

  In the present embodiment, when detecting the switching of the assist function of the driving assist unit 120, the detection unit 1101 transmits switching information that is information indicating the switching to the transaction data generation unit 1102. The switching information includes information indicating switching between the manual operation mode and the automatic operation mode.

<Transaction data generation unit 1102>
The transaction data generation unit 1102 generates first transaction data including switching information detected by the detection unit 1101 and a first identifier indicating the vehicle. The transaction data generation unit 1102 transmits the generated first transaction data to one such as the authentication server 200a via the first communication unit 1103. Further, the transaction data generation unit 1102 generates first transaction data as block chain transaction data.

  In the present embodiment, the transaction data generation unit 1102 generates first transaction data that is block chain transaction data from the switching information acquired from the detection unit 1101. Here, it is assumed that the switching information is information indicating switching of the operation mode. In this case, the first transaction data includes switching information indicating the switching of the driving mode, the time when switching is performed, a first identifier indicating the vehicle 100a and the like, and a signature for information including these.

  Here, the gateway 101 may hold in advance a signature key necessary for generating the signature. Further, the signature key necessary for generating the signature may be generated based on the secret information input to the input unit 1412 of the head unit 140.

  The switching information indicating the switching of the operation mode may be information indicating that the automatic operation mode is switched to the manual operation mode, or may be information indicating that the operation mode is switched from the manual operation mode to the automatic operation mode. The switching information may be information indicating switching of the assist function of the driving assist unit 120 other than switching of the driving mode. In this case, the switching information may further include information indicating which driving assist function of the assist functions of the driving assist unit 120 is used as the switched driving assist function.

  Further, the transaction data generation unit 1102 generates block transaction data, that is, second transaction data including confirmation information to be described later, from the confirmation information acquired from the head unit 140, and authenticates the authentication server via the first communication unit 1103. It may be transmitted to 200a or the like. The transaction data generation unit 1102 may generate the second transaction data including confirmation information including, for example, user consent information. This consent information is, for example, information indicating that the user has confirmed that the manual operation mode has been switched to the automatic operation mode and has continued the automatic operation mode.

<First communication unit 1103>
The first communication unit 1103 communicates with at least one authentication server such as one or more authentication servers 200a. More specifically, the first communication unit 1103 is a communication interface that communicates with at least one of the authentication server 200a and the like via the communication unit 150 connected to the in-vehicle system. This communication may be performed by TLS (Transport Layer Security). In that case, the encryption key for TLS communication may be held by the communication unit 150 or the first communication unit 1103.

  Next, the authentication server 200a and the like will be described.

[1.1.4 Configuration of authentication server 200a]
FIG. 5 is a block diagram showing a functional configuration of the authentication server 200a according to the present embodiment. Since the authentication servers 200b and 200c have the same configuration, the authentication server 200a will be described as an example.

  As shown in FIG. 5, the authentication server 200a includes a screen generation unit 211, a transaction data verification unit 212, a transaction data generation unit 213, a block generation unit 214, a synchronization unit 215, a recording unit 216, a second And a communication unit 217. The authentication server 200a can be realized by a processor executing a predetermined program using a memory. Hereinafter, each component will be described.

<Screen generator 211>
The screen generation unit 211 generates a screen to be displayed to the user when it is determined that the operation mode is switched from the manual operation mode to the automatic operation mode based on the switching information included in the first transaction data acquired from the vehicle 100a or the like. To do. For example, the screen generation unit 211 notifies the user who is a passenger such as the vehicle 100a that the operation mode has been switched to the automatic operation mode, and confirms with the user whether or not to continue the automatic operation mode. Generate the screen.

  Then, the screen generation unit 211 transmits screen information indicating the generated screen to the gateway 101 such as the vehicle 100a via the second communication unit 217.

<Transaction data verification unit 212>
The transaction data verification unit 212 is an example of a verification unit, and verifies the validity of transaction data including first transaction data acquired from at least one vehicle 100a of one or more vehicles. For example, the transaction data verification unit 212 verifies whether the first identifier included in the first transaction data is included in the second identifier and the validity of the first transaction data. When the first identifier included in the first transaction data is not included in the second identifier, the transaction data verification unit 212 converts the first identifier into the second identifier via the second communication unit 217. Notify that it is not included.

  In the present embodiment, the transaction data verification unit 212 verifies the validity of the first transaction data acquired from the vehicle 100a or the like.

  Specifically, when acquiring the first transaction data from the vehicle 100a or the like, the transaction data verification unit 212 verifies whether the signature, that is, the authentication information included in the first transaction data is valid. Further, when acquiring the first transaction data, the transaction data verification unit 212 verifies whether the first identifier is valid. More specifically, the transaction data verification unit 212 verifies whether the first identifier included in the first transaction data is included in the second identifier indicating the legitimate vehicle recorded in the recording unit 216 in advance. . As a result, it is possible to verify whether the vehicle indicated by the first identifier included in the first transaction data is a registered vehicle that can be switched between manual driving and automatic driving.

  When the transaction data verification unit 212 confirms the validity of the acquired first transaction data as a result of the verification, the transaction data verification unit 212 records the first transaction data in the recording unit 216 and notifies the synchronization unit 215 of the first transaction data. .

  Similarly, the transaction data verification unit 212 verifies the validity of the second transaction data acquired from the vehicle 100a or the like. When the transaction data verification unit 212 confirms the validity of the second transaction data as a result of the verification, the transaction data verification unit 212 may record the second transaction data in the recording unit 216 and notify the synchronization unit 215 of the second transaction data.

  Similarly, the transaction data verification unit 212 verifies the validity of the third transaction data acquired from the car manufacturer server 300. When the transaction data verification unit 212 confirms the validity of the third transaction data as a result of the verification, the transaction data verification unit 212 may record the third transaction data in the recording unit 216 and notify the synchronization unit 215 of the third transaction data.

  Details of the second transaction data and the third transaction data will be described later.

<Transaction data generation unit 213>
When the transaction data generation unit 213 acquires confirmation information from the vehicle 100a or the like, the transaction data generation unit 213 may generate second transaction data including the confirmation information. In this case, the transaction data generation unit 213 may generate the second transaction data including the confirmation information by further including the user consent information. This consent information is, for example, information indicating that the user has confirmed or switched from the manual operation mode to the automatic operation mode and has approved or confirmed that the automatic operation mode is to be continued.

  Note that such second transaction data is not limited to the case where the transaction data generation unit 213 generates, but may be generated by the gateway 101 such as the vehicle 100a as described above. The second transaction data generated by the gateway 101 may be acquired from the vehicle 100a or the like by the transaction data generation unit 213 or may be acquired by the block generation unit 214.

<Block generation unit 214>
The block generation unit 214 executes a consensus algorithm among a plurality of authentication servers. As the consensus algorithm, a consensus algorithm called PBFT (Practical Byzantine Fault Tolerance) may be used, or another known consensus algorithm may be used. In the present embodiment, the block generation unit 214 executes a consensus algorithm among the authentication server 200a, the authentication server 200b, and the authentication server 200c.

  The block generation unit 214 first generates a block of a block chain including one or more transaction data. Then, when the consensus algorithm can be formed by the consensus algorithm, the block generation unit 214 records it in the recording unit 216. The block generated by the block generation unit 214 is connected to the block chain recorded in the recording unit 216 and recorded.

  Here, the data structure of the block chain and the data structure of the transaction data will be described.

  FIG. 6A is an explanatory diagram illustrating a data structure of a block chain.

  The block chain is a block in which the recording units are connected on a chain. Each block has a plurality of transaction data and a hash value of the immediately preceding block. Specifically, the block B2 includes the hash value of the previous block B1. Then, the hash value calculated from the plurality of transaction data included in the block B2 and the hash value of the block B1 is included in the block B3 as the hash value of the block B2. In this manner, by connecting the blocks in a chain while including the contents of the previous block as a hash value, tampering of the connected transaction data is effectively prevented.

  If past transaction data is changed, the hash value of the block will be different from that before the change. To make the altered block appear to be correct, all subsequent blocks must be recreated. Is very difficult in practice.

  In the present embodiment, each transaction data includes first transaction data including switching information, second transaction data including user confirmation information, and third transaction data related to regular vehicle registration described later.

  FIG. 6B is an explanatory diagram of a data structure of transaction data.

  The transaction data D1 shown in FIG. 6B is an example of first transaction data including switching information indicating, for example, switching of operation modes. The transaction data D1 includes an address P1 indicating the holder, an address P2 indicating the destination, and an electronic signature P3 generated by signing the hash values of the addresses P1 and P2 with the signature key of the holder. Contains. Note that, when transaction data is newly generated, the address P1 is blank in the transaction data.

<Synchronizer 215>
The synchronization unit 215 synchronizes block chain blocks and transaction data among a plurality of authentication servers. In a plurality of authentication servers, the transaction data of the block chain is synchronized by peer to peer and recorded in the recording unit 216.

  For example, when the validity of the first transaction data acquired from the vehicle 100a is verified by the transaction data verification unit 212, the synchronization unit 215 transfers a copy of the first transaction data to the other authentication servers 200b and 200c. Thereby, the verified first transaction data can be recorded in the recording units 216 of the other authentication servers 200b and 200c. In addition, when the synchronization unit 215 acquires the first transaction data from the other authentication servers 200b and 200c, the synchronization unit 215 records the acquired first transaction data in the recording unit 216. Since the same applies to the second transaction data and the third transaction data, the description thereof is omitted.

<Recording unit 216>
The recording unit 216 records the first transaction data, the second transaction data, and the third transaction data in the block 201 of the block chain in the storage device 201a. Note that the storage device 201a may be configured inside the recording unit 216, or may be configured outside the authentication server 200a as shown in FIG.

  In the present embodiment, the recording unit 216 stores transaction data including, for example, the first transaction data, the second transaction data, and the third transaction data whose validity has been confirmed by the transaction data verification unit 212 in the storage device 201a. Record. The recording unit 216 records transaction data including first transaction data, second transaction data, and third transaction data as block chain transaction data.

  Here, the recording unit 216 may record in advance in the storage device 201a a second identifier that uniquely identifies each of the one or more vehicles. The vehicle indicated by the second identifier recorded in advance is, for example, a regular vehicle that is certified by a car manufacturer or the like and can be switched between manual driving and automatic driving and is guaranteed to operate.

  More specifically, in the recording unit 216, it is confirmed by the transaction data verification unit 212 that the first identifier is included in the second identifier, and the validity of the first transaction data is confirmed. In this case, the first transaction data may be recorded in the storage device 201a. Thereby, it is reliably recorded in the storage device 201a that the operation mode has been switched in the regular vehicle.

<Second communication unit 217>
The second communication unit 217 is a communication interface that communicates with the vehicle 100 a and the like and the car manufacturer server 300. This communication may be performed by TLS. In that case, the second communication unit 217 may hold the encryption key for TLS communication.

  In the present embodiment, second communication unit 217 communicates with each of one or more vehicles 100a and the like. When the transaction data verification unit 212 confirms that the first identifier is not included in the second identifier and the validity of the first transaction data is confirmed by the transaction data verification unit 212, the second communication unit 217 That the second identifier is not included in the second identifier. Thereby, it can be determined that the vehicle is irregular or the assist function switching of the driving assist unit 120 including the switching of the driving mode is incorrect.

  Next, the car maker server 300 will be described.

[1.1.5 Configuration of Car Maker Server 300]
FIG. 7 is a block diagram showing a functional configuration of car maker server 300 according to the present embodiment.

  As shown in FIG. 7, the car maker server 300 includes an input unit 311, a transaction data generation unit 312, and a third communication unit 313. The car maker server 300 can be realized by a processor executing a predetermined program using a memory. Hereinafter, each component will be described.

<Input unit 311>
The input unit 311 receives an input relating to a regular vehicle that is managed by a car manufacturer and can be switched between manual driving and automatic driving, and transmits the input to the transaction data generating unit 312. More specifically, the input unit 311 receives an input of a second identifier that uniquely identifies each of a plurality of regular vehicles managed by the car manufacturer. Then, the input unit 311 transmits the input second identifier to the transaction data generation unit 312.

<Transaction data generation unit 312>
The transaction data generation unit 312 generates, as block chain transaction data, third transaction data that includes the second identifier acquired from the input unit 311 and indicates that a regular vehicle is to be registered.

  In the present embodiment, the transaction data generation unit 312 generates third transaction data indicating that a regular vehicle is registered, including the second identifier and the signature of the car manufacturer server 300. Since the signature is an example of authentication information, when the password input by the car maker server 300 is obtained, it may be a hash value of the password, or may be generated using a signature key generated from the password. May be.

<Third communication unit 313>
The third communication unit 313 is a communication interface that performs communication with the vehicle 100a and the like and the authentication server 200a and the like. This communication may be TLS. This communication may be performed by TLS. In this case, the encryption key for TLS communication may be held by the third communication unit 313.

[1.2 Operation etc.]
Hereinafter, the processing operation of the operation management system 10 configured as described above will be described.

[1.2.1 Registration Process Between Car Maker Server 300 and Authentication Server 200a]
First, a registration process for registering a second identifier for uniquely identifying a regular vehicle that can be switched between manual driving and automatic driving in the authentication server 200a and the like will be described. Here, a case will be described in which the third transaction data including the second identifier is transmitted from the car maker server 300 to one authentication server 200a among the authentication servers 200a and the like.

  FIG. 8A is a sequence diagram showing a registration process between car maker server 300 and authentication server 200a according to the present embodiment. FIG. 8B is a flowchart showing detailed processing of step S104 shown in FIG. 8A.

  First, in step S101, the car maker server 300 acquires a second identifier indicating a legitimate vehicle that can be switched between manual driving and automatic driving.

  Next, in step S102, the car maker server 300 generates third transaction data including a second identifier indicating the acquired regular vehicle. In the present embodiment, the third transaction data is generated including, for example, a second identifier and authentication information such as a signature of the car manufacturer server 300.

  Next, in step S103, the car maker server 300 transmits the generated third transaction data to the authentication server 200a. 8A shows an example in which the car maker server 300 transmits the generated third transaction data to the authentication server 200a, but the present invention is not limited to this. What is necessary is just to transmit to any one of authentication servers 200a etc.

  Next, in step S104, the authentication server 200a verifies the acquired third transaction data, and if successful, causes the recording unit 216 to record the third transaction data, and proceeds to step S106.

  Here, the detailed process of step S104 is demonstrated using FIG. 8B. In other words, the authentication server 200a first verifies the acquired third transaction data and confirms whether or not it is successful (S1041). More specifically, the authentication server 200a verifies whether the second identifier included in the third transaction data is valid and whether the signature of the car manufacturer server 300 included in the third transaction data is valid. That is, the authentication server 200a checks whether or not the second identifier and signature are valid. In step S1041, the authentication server 200a confirms that the second identifier and signature are valid, and if the third transaction data is successfully verified (Y in S1041), records the third transaction data in the recording unit 216. (S1042), the process proceeds to step S106. In step S1041, if the verification of the third transaction data is not successful (N in S1041), the authentication server 200a notifies the car maker server 300 (S1043) and ends the registration process.

  Next, in step S106, the authentication server 200a transfers the acquired copy of the third transaction data to the other authentication servers 200b and 200c. The other authentication servers 200b and 200c also verify the transferred and acquired third transaction data. This verification process is the same as the process described in FIG. 8B.

  Next, in step S107, the authentication server 200a, the authentication server 200b, and the authentication server 200c execute a consensus algorithm. By executing the consensus algorithm, it is verified that the third transaction data acquired by the authentication server 200a, the authentication server 200b, and the authentication server 200c is valid transaction data. The authentication servers 200a, 200b, and 200c generate a block that includes verified third transaction data. As a result, a block of the third transaction data including the second identifier indicating a regular vehicle that can be switched between manual driving and automatic driving is generated, so whether the vehicle is a legitimate vehicle by referring to the block chain. Judgment can be made.

[1.2.2 Verification process between vehicle 100a and authentication server 200a]
Next, a description will be given of a process in which switching of the driving mode is detected in the vehicle 100a and the switching is verified between the vehicle 100a and the authentication server 200a. Here, a case will be described in which the first transaction data including the switching information indicating the switching and the first identifier of the vehicle 100a is transmitted from the vehicle 100a to one of the authentication servers 200a.

  FIG. 9A is a sequence diagram showing a first verification process between the vehicle 100a and the authentication server 200a according to the present embodiment. FIG. 9B is a flowchart showing detailed processing of step S201 shown in FIG. 9A. FIG. 9C is a flowchart showing detailed processing of step S205 shown in FIG. 9A. Here, the first verification process will be described as a process from when the switching of the driving mode is detected in the vehicle 100a until the first transaction data including the switching information indicating the switching is verified.

  First, in step S201, the gateway 101 of the vehicle 100a detects that the operation mode has been switched in the vehicle 100a.

  Here, the detailed process of step S201 is demonstrated using FIG. 9B. That is, the gateway 101 of the vehicle 100a first detects whether the switching of the driving mode is detected as the switching of the assist function of the driving assist unit 120 from the message transmitted by the ECU 121 for the driving assist unit 120 connected to the in-vehicle network. Confirm (S2011). In step S2011, when the gateway 101 detects switching of the operation mode (Y in S2011), the gateway 101 proceeds to step S203. In step S2011, when the gateway 101 does not detect switching of the operation mode (N in S2011), the first verification process is terminated.

  Next, in step S203, the gateway 101 of the vehicle 100a generates first transaction data including switching information indicating switching of the operation mode and a first identifier indicating the vehicle 100a. In the present embodiment, the first transaction data is generated including, for example, switching information and a first identifier, and authentication information such as a signature for information including the switching information and the first identifier.

  Next, in step S204, the gateway 101 of the vehicle 100a transmits the generated first transaction data to the authentication server 200a. 9A shows an example in which the vehicle 100a transmits the generated first transaction data to the authentication server 200a. However, the present invention is not limited to this. You may transmit to any authentication server in the authentication server 200a etc.

  In step S205, the authentication server 200a verifies the acquired first transaction data. If the authentication server 200a succeeds, the authentication server 200a causes the recording unit 216 to record the first transaction data, and proceeds to step S207.

  Here, the detailed process of step S205 is demonstrated using FIG. 9C. In other words, the authentication server 200a first verifies the acquired first transaction data to confirm whether or not it is successful (S2051). More specifically, the authentication server 200a determines whether the first identifier included in the first transaction data is included in the second identifier indicating the legitimate vehicle recorded in advance in the recording unit 216, and is valid. It is verified whether the signature included in the first transaction data is valid. That is, the authentication server 200a confirms whether or not both the first identifier and the signature are valid. In step S2051, the authentication server 200a confirms that the first identifier and signature are valid, and if the verification of the first transaction data is successful (Y in S2051), records the first transaction data in the recording unit 216. (S2052) and proceed to step S207. In step S2051, if the verification of the first transaction data is not successful (N in S2051), the authentication server 200a notifies the gateway 101 of the vehicle 100a (S2053) and ends the first verification process. To do. Note that the authentication server 200a may end the first verification process after notifying not only the vehicle 100a but also the car manufacturer server 300. Thereby, the car maker server 300 can know that the unauthorized vehicle 100a was detected.

  Next, in step S207, the authentication server 200a transfers the obtained copy of the first transaction data to the other authentication servers 200b and 200c. The other transaction servers 200b and 200c also verify the first transaction data transferred and acquired. This verification process is the same as the process described in FIG. 9C.

  Next, in step S208, the authentication server 200a, the authentication server 200b, and the authentication server 200c execute a consensus algorithm. By executing the consensus algorithm, it is verified that the first transaction data acquired by the authentication server 200a, the authentication server 200b, and the authentication server 200c is valid transaction data. The authentication servers 200a, 200b, and 200c generate a block that includes the verified first transaction data.

  Next, the second verification process following the first verification process will be described.

  FIG. 10A is a sequence diagram showing a second verification process between vehicle 100a and authentication server 200a according to the present embodiment. FIG. 10B is a flowchart showing detailed processing of step S209 shown in FIG. 10A. FIG. 10C is a flowchart showing detailed processing of step S213 shown in FIG. 10A. FIG. 10D is a flowchart showing detailed processing of step S215 shown in FIG. 10A. The second verification process is performed following the first verification process in which the first transaction data indicating the switching of the operation mode is recorded. More specifically, in the second verification process, the second transaction data including that the user has confirmed that the switching of the operation mode from the manual operation mode to the automatic operation mode is continued after the first verification process. This is the process until

  First, in step S209, the authentication server 200a determines whether to switch the operation mode included in the first transaction data.

  Here, the detailed process of step S209 is demonstrated using FIG. 10B. That is, the authentication server 200a first checks whether the switched operation mode is the automatic operation mode or the manual operation mode (S2091). More specifically, the authentication server 200a confirms whether the switched operation mode indicated by the switching information included in the block-generated first transaction data is the automatic operation mode or the manual operation mode. In step S2091, the authentication server 200a generates an automatic operation mode switching screen (S2092) when the switched operation mode is the automatic operation mode (automatic operation mode in S2091), and proceeds to step S212. In step S2091, the authentication server 200a generates a manual operation mode switching screen (S2093) when the switched operation mode is the manual operation mode (manual operation mode in S2091), and proceeds to step S212.

  Next, in step S212, the authentication server 200a transmits screen information indicating the screen generated in step S209 to the vehicle 100a.

  Next, in step S213, the vehicle 100a displays the screen acquired from the authentication server 200a. In the present embodiment, vehicle 100a displays the screen with head unit 140.

  Here, the detailed process of step S213 will be described with reference to FIG. 10C. That is, the vehicle 100a first checks whether the screen acquired from the authentication server 200a is an automatic operation mode switching screen or a manual operation mode switching screen (S2131). In step S2131, when the screen acquired from the authentication server 200a is the automatic operation mode switching screen (automatic operation mode switching screen in S2131), the vehicle 100a displays the automatic operation mode switching screen (S2132). In the present embodiment, the automatic operation mode switching screen is, for example, a screen as shown in FIG. Here, FIG. 11 is a diagram showing an example of a screen display displayed on vehicle 100a according to the present embodiment. FIG. 11 shows an example of a screen display such as “Switching to the manual operation mode is detected. Do you want to continue the automatic operation mode?”. In other words, FIG. 11 shows an example of a screen display for confirming (or approving) the user whether the driving mode has been switched to the automatic driving mode in the vehicle 100a and whether or not to continue the switched automatic driving mode. Has been. When the user selects “Yes” on the screen shown in FIG. 11, the user confirms or approves that the switched automatic operation mode is continued as it is. On the other hand, when the user selects “No” on the screen shown in FIG. 11, the user does not approve that the switching of the automatic operation mode is continued as it is. That is, in step S2133, the vehicle 100a confirms whether or not there is an input indicating user approval. If there is an input indicating user approval (Y in S2133), the process proceeds to step S214. On the other hand, if there is no input indicating user approval (Y in S2133), the second verification process is terminated.

  In step S2131, if the screen acquired from the authentication server 200a is the manual operation mode switching screen (the manual operation mode switching screen in S2131), the vehicle 100a displays the manual operation mode switching screen (S2134). The verification process ends.

  In the present embodiment, the manual operation mode switching screen is, for example, a screen as shown in FIG. Here, FIG. 12 is a diagram showing an example of a screen display displayed on vehicle 100a according to the present embodiment. FIG. 12 shows an example of a screen display such as “Switching to the manual operation mode has been detected”. That is, FIG. 12 shows an example of a screen display for notifying the user that the operation mode has been switched to the manual operation mode in the vehicle 100a. When the screen shown in FIG. 12 is displayed, since the user is in manual operation, the screen shown in FIG. 12 does not display what the user selects.

  Next, in step S214, second transaction data including confirmation information indicating input indicating user confirmation or approval is generated and transmitted to the authentication server 200a. The confirmation information indicating the input indicating the confirmation or approval of the user may be, for example, information indicating “Yes” shown in FIG. 11 or approved (confirmed) to continue the switched automatic driving mode as it is. It may be information indicating that.

  Next, in step S215, the authentication server 200a verifies the acquired second transaction data, and if successful, causes the recording unit 216 to record the second transaction data, and proceeds to step S217.

  Here, the detailed process of step S215 is demonstrated using FIG. 10D. That is, the authentication server 200a first verifies the acquired second transaction data, and confirms whether or not it is successful (S2151). More specifically, the authentication server 200a verifies whether the signature included in the second transaction data is valid. In step S2151, the authentication server 200a confirms that the signature is valid, and if the verification of the second transaction data is successful (Y in S2151), causes the recording unit 216 to record the second transaction data (S2152). The process proceeds to step S217. In step S2151, if the verification of the second transaction data is not successful (N in S2151), the authentication server 200a notifies the gateway 101 of the vehicle 100a (S2153) and ends the second verification process. To do.

  Next, in step S217, the authentication server 200a transfers the obtained copy of the second transaction data to the other authentication servers 200b and 200c. The other authentication servers 200b and 200c also verify the transferred and acquired second transaction data. This verification process is the same as the process described in FIG. 10D.

  Next, in step S218, the authentication server 200a, the authentication server 200b, and the authentication server 200c execute a consensus algorithm. By executing the consensus algorithm, it is verified that the second transaction data acquired by the authentication server 200a, the authentication server 200b, and the authentication server 200c is valid transaction data. The authentication servers 200a, 200b, and 200c generate a block that includes verified second transaction data.

[1.3 Effects of the embodiment]
As described above, according to the operation management system 10 and the like according to the present embodiment, since all history of operation mode switching in the vehicle can be recorded in the storage device, the operation mode switching in the vehicle is reliably managed. can do. In addition, according to the operation management system 10 or the like according to the present embodiment, when the operation mode is switched from the manual operation mode to the automatic operation mode, the user approves or confirms that the switched automatic operation mode is continued as it is. Is also recorded as a history. In this way, the operation management system according to the present embodiment can reliably manage operation mode switching in the vehicle.

  Accordingly, when a problem such as a vehicle failure or an accident occurs, it can be objectively determined whether the vehicle is in the automatic operation mode or the manual operation mode at the time when the problem occurs. For this reason, it is possible to reliably verify whether there is a problem such as an abnormality in the automatic driving function that realizes the automatic driving system, so that if there is a problem with the automatic driving function, the automatic driving function can be improved. . Therefore, since an automobile accident during the automatic driving mode can be further suppressed, a safer automatic driving system can be constructed.

  Furthermore, according to the operation management system 10 and the like according to the present embodiment, it can be objectively determined whether the vehicle accident or failure occurred in the automatic operation mode, and thus it can be understood that the driver is not responsible. As a result, it is possible to ask a car manufacturer and / or an insurance company to compensate for a car accident or failure.

  In addition, according to the operation management system 10 and the like according to the present embodiment, all the history of operation mode switching in the vehicle is managed by the block chain that is difficult to tamper with. Can be confirmed reliably later without being tampered with. Therefore, it is possible to reliably verify whether there is a problem such as abnormality in the automatic driving function that realizes the automatic driving system, and to improve the automatic driving function when there is a problem in the automatic driving function. Thereby, a car accident during the automatic driving mode can be further suppressed, and a safer automatic driving system can be constructed.

(Modification)
In the above embodiment, the driving management system 10 that manages the switching of the assist function of the driving assist unit 120 including the switching of the driving mode in the vehicle using the block chain that is difficult to tamper with has been described, but the present invention is not limited to this. Switching of the assist function of the driving assist unit 120 including switching of the driving mode may be managed without using the block chain. Hereinafter, this case will be described as a modified example, focusing on differences from the above-described embodiment.

[1.4. System configuration]
The driving management system 10 of the present modification records, as a history, that the assist function of the driving assist unit 120 including switching of the driving mode has been switched, as in the above embodiment. In addition, the operation management system 10 of the present modified example also records that the user has confirmed that the automatic operation mode is continued if the operation mode is switched from the manual operation mode to the automatic operation mode, as in the above embodiment. Record.

  The operation management system 10 of this modification includes, for example, one or more vehicles such as the vehicles 100a, 100b, and 100c shown in FIG. 1, one or more authentication servers such as the authentication server 200A shown in FIG. Is provided. The vehicle 100a and the like differ from the above embodiment only in that the first transaction data and the second transaction data are generated as transaction data that is not a block chain, and the others are the same. Also, the car maker server 300 differs from the above embodiment only in that the third transaction data is generated as transaction data that is not a block chain, and the others are the same. The authentication server 200A will be described later.

[1.4.1 Configuration of Authentication Server 200A]
FIG. 13 is a block diagram illustrating a functional configuration of an authentication server 200A according to a modification of the embodiment. The same elements as those in FIG. 5 are denoted by the same reference numerals, and detailed description thereof is omitted.

  The authentication server 200A shown in FIG. 13 differs from the authentication server 200a according to the above embodiment in that the configuration of the transaction data generation unit 213A is different and the block generation unit 214 is not provided.

  When acquiring confirmation information from the vehicle 100a or the like, the transaction data generation unit 213A may generate second transaction data that is transaction data that is not a block chain. Since others are the same, description is abbreviate | omitted.

[1.5 Operation etc.]
Hereinafter, the processing operation of the operation management system 10 of the present modification configured as described above will be described.

[1.5.1 Registration Process Between Car Maker Server 300 and Authentication Server 200A]
First, a registration process for registering a second identifier that uniquely identifies a regular vehicle that can be switched between manual driving and automatic driving in the authentication server 200A will be described. Here, the case where the third transaction data including the second identifier is transmitted from the car maker server 300 to the authentication server 200A will be described.

  FIG. 14 is a sequence diagram illustrating a registration process between the car maker server 300 and the authentication server 200A according to a modification of the embodiment. In addition, the same code | symbol is attached | subjected to the element similar to FIG. 8A etc., and detailed description is abbreviate | omitted. FIG. 15 is an example of a data structure used when the authentication server 200A according to the modification of the embodiment records the third transaction data.

  First, in step S101, the car maker server 300 acquires a second identifier indicating a legitimate vehicle that can be switched between manual driving and automatic driving.

  Next, in step S102, the car maker server 300 generates third transaction data including a second identifier indicating the acquired regular vehicle. Here, the third transaction data is transaction data that is not recorded as a block chain.

  Next, in step S103, the car maker server 300 transmits the generated third transaction data to the authentication server 200A.

  Next, in step S104A, the authentication server 200A verifies the acquired third transaction data, and if successful, proceeds to step S104B. Note that the detailed processing in step S104A is as described with reference to FIG.

  Next, in step S104B, the authentication server 200A causes the recording unit 216 to record the third transaction data. More specifically, for example, as shown in FIG. 15, the authentication server 200A can switch between manual driving and automatic driving for the type of vehicle indicated by the acquired second identifier in a transaction indicating registration processing, that is, registration. The storage device 201A records that the vehicle is a genuine vehicle. In this way, the authentication server 200A records the third transaction data that is not a block chain in the storage device 201A.

[1.5.2 Verification process between vehicle 100a and authentication server 200A]
Next, a description will be given of a process in which switching of the driving mode is detected in the vehicle 100a and the switching is verified between the vehicle 100a and the authentication server 200A. Here, a case will be described in which first transaction data including switching information indicating the switching and a first identifier of the vehicle 100a is transmitted from the vehicle 100a to the authentication server 200A.

  FIG. 16 is a sequence diagram illustrating a first verification process between the vehicle 100a and the authentication server 200A according to the modification of the embodiment. In addition, the same code | symbol is attached | subjected to the element similar to FIG. 9A etc., and detailed description is abbreviate | omitted. FIG. 17 is an example of a data structure used when the authentication server 200A according to the modification of the embodiment records the first transaction data. Here, the first verification process will be described as a process from when the driving mode switching is detected in the vehicle 100a until the first transaction data including the switching information indicating the switching is verified.

  First, in step S201, the gateway 101 of the vehicle 100a detects that the operation mode has been switched in the vehicle 100a. The detailed processing in step S201 is as described with reference to FIG. 9B, so description thereof is omitted here.

  Next, in step S203, the gateway 101 of the vehicle 100a generates first transaction data including switching information indicating switching of the operation mode and a first identifier indicating the vehicle 100a. Also in this modification, the first transaction data is generated including, for example, switching information and a first identifier, and authentication information such as a signature for the information including the switching information and the first identifier.

  Next, in step S204, the gateway 101 of the vehicle 100a transmits the generated first transaction data to the authentication server 200A.

  Next, in step S205A, the authentication server 200A verifies the acquired first transaction data, and if successful, proceeds to step S205B. Note that the detailed processing in step S205B is as described with reference to FIG.

  Next, in step S205B, the authentication server 200A causes the recording unit 216 to record the first transaction data. More specifically, for example, as shown in FIG. 17, the authentication server 200A switches to the manual operation mode or the automatic operation mode in the transaction indicating the switching of the operation mode in the vehicle indicated by the acquired first identifier. Is recorded in the storage device 201A. In addition, for example, as illustrated in FIG. 17, the authentication server 200 </ b> A further records in the storage device 201 </ b> A whether or not there is a user's approval when switching to the automatic driving mode in a transaction indicating switching of the driving mode. In this way, the authentication server 200A records the first transaction data in the storage device 201A.

  Similarly, for the second verification process following the first verification process, the authentication server 200A records the third transaction data in the storage device 201A using a data structure that does not use the block chain.

[2. Other variations]
As mentioned above, although this indication has been explained based on the above-mentioned embodiment and a modification, it is needless to say that this indication is not limited to each above-mentioned embodiment. The following cases are also included in the present disclosure.

  (1) In the above embodiment, the authentication server and the car maker server are described as separate devices. However, the authentication server and the car maker server may be configured by the same device.

  (2) In the above-described embodiment and modification, the authentication server notifies the vehicle when an error is detected by switching the operation mode, but may also notify the car manufacturer server.

  (3) The block chain managed by the authentication server in the above embodiment may be referred to from the car manufacturer server. The block chain may be referred to not only from the car maker but also from a server (not shown) of an insurance company.

  (4) In the embodiment and the modification described above, the gateway 101 such as the vehicle 100a detects the switching of the operation mode, and includes the first transaction indicating the switching information indicating the switching and the first identifier indicating the vehicle 100a and the like. Although data is transmitted, it is not limited to this. The gateway 101 may generate the first transaction data including a function operating in the driving assist unit 120 and / or an identifier indicating the ECU 121 of the driving assist unit 120. Thereby, it becomes possible to easily verify whether the vehicle 100a or the like has a problem, that is, whether the automatic driving function has become abnormal when the function of the driving assist unit 120 is operating in the automatic driving mode. Further, when the vehicle 100a or the like has a problem, that is, when the automatic driving function becomes abnormal, it is possible to easily identify the function that operates in the corresponding driving assist unit 120 by the identifier of the ECU 121 of the driving assist unit 120.

  (5) In the above-described embodiment and modification, the gateway 101 such as the vehicle 100a detects the switching of the operation mode, but the present invention is not limited to this. Any ECU or all ECUs in the in-vehicle network of the vehicle 100a or the like may have the same function and detect switching of the operation mode.

  (6) In the above-described embodiment and modification, when it is detected that the manual operation mode has been switched to the automatic operation mode, a screen is displayed to the user such as the driver on the head unit 140 such as the vehicle 100a. However, the present invention is not limited to this. When it is detected that the operation mode has been switched from the manual operation mode to the automatic operation mode, it is possible to notify the user by voice and confirm the continuation of the automatic operation mode, and input information by the user's voice.

  (7) In the embodiment and the modification described above, the car manufacturer server acquires the first identifier indicating the vehicle, but the present invention is not limited to this. The car manufacturer server may acquire a driving assist function or an automatic driving function mounted on the vehicle in addition to the first identifier. Accordingly, it is possible to verify whether the driving assist function or the automatic driving function included in the second transaction data received by the authentication server matches the driving assist function or the automatic driving function acquired from the car manufacturer server.

  (8) In the embodiment and the modification described above, the gateway 101 such as the vehicle 100a detects the switching of the operation mode and transmits it to the authentication server, but in addition to the switching information indicating the switching of the operation mode, You may transmit the message transmitted on the vehicle-mounted network which the vehicle 100a etc. have. Thereby, it becomes possible to detect the switching of the operation mode by referring to the transaction data including the first transaction data recorded in the authentication server and confirming the message on the in-vehicle network. It is also possible to check at which timing during the manual operation mode the operation mode has been switched to the automatic operation mode.

  (9) In the embodiment and the modification described above, the gateway 101 such as the vehicle 100a detects the switching of the operation mode, and sends the first transaction data including the switching information indicating the switching and the first identifier to the authentication server. Although it transmits, it is not restricted to this. The gateway 101 may transmit the first transaction data further including the automatic driving function installed in the vehicle 100a or the automatic driving level executed in the automatic driving mode.

  More specifically, the transaction data generation unit 1102 indicates information indicating the switching detected by the detection unit 1101 when the information indicating the switching detected by the detection unit 1101 indicates that switching from the manual operation mode to the automatic operation mode is performed. In addition to the first identifier indicating the vehicle, first transaction data including information indicating the automatic driving level in the automatic driving mode is generated and transmitted to one authentication server via the first communication unit 1103. May be. In this case, in steps S212 and S213 shown in FIG. 10A and the like, when creating and displaying a screen for confirming to the user whether or not to continue the automatic driving mode, the automatic driving level is also set. It may be confirmed. The automatic driving level is 0 to 5. Level 0 indicates that the driver operates everything, and level 1 indicates that the automatic driving system performs driving support that supports either steering operation or acceleration / deceleration. Level 2 indicates that the automatic driving system provides driving support that supports both steering operation and acceleration / deceleration. Level 3 indicates that the automatic driving system operates all at a specific place and that the driver operates in an emergency. Level 4 indicates that automatic driving is performed such that the automatic driving system operates everything at a specific location. Level 5 indicates that the automatic operation system performs fully automatic operation that operates all without limitation of the place.

  Further, when the information indicating the switching detected by the detection unit 1101 indicates that the switching from the manual operation mode to the automatic operation mode is performed, the transaction data generation unit 1102 includes the information indicating the switching detected by the detection unit 1101, and In addition to the first identifier indicating the vehicle, the first transaction data including information indicating the driving assist function operating in the automatic driving mode may be generated and transmitted to the one authentication server via the first communication unit 1103. Good.

  (10) In the embodiment and the modification described above, the gateway 101 such as the vehicle 100a detects the switching of the operation mode, and sends the first transaction data including the switching information indicating the switching and the first identifier to the authentication server. Although it transmits, it is not restricted to this. The gateway 101 may further include the sensor information acquired from the sensor mounted on the vehicle 100a in the first transaction data. Here, the sensor information is information relating to the driver of the vehicle 100a including the driver's state.

  More specifically, each of the one or more vehicles further includes a sensor unit that acquires sensor information indicating information on the driver of the vehicle for each predetermined period or for each event, and the sensor unit acquires The sensor information is transmitted to the transaction data generation unit 1102, and the transaction data generation unit 1102 generates first transaction data including information indicating switching, a first identifier, and sensor information, and passes through the first communication unit 1103. It may be transmitted to one authentication server.

  For example, the sensor unit may be a camera installed in the vehicle 100a or the like. In this case, the sensor information may include a driver's image, moving image, or iris information captured by the camera. Further, for example, the sensor unit may be a millimeter wave radar installed in the vehicle 100a or the like. In this case, the sensor information may include information indicating the driver's heartbeat acquired by millimeter waves.

  (11) Each device in the above-described embodiments and modifications is specifically a computer system including a microprocessor, ROM, RAM, a hard disk unit, a display unit, a keyboard, a mouse, and the like. A computer program is recorded in the RAM or hard disk unit. Each device achieves its functions by the microprocessor operating according to the computer program. Here, the computer program is configured by combining a plurality of instruction codes indicating instructions for the computer in order to achieve a predetermined function.

  (12) In each of the above-described embodiments and modifications, some or all of the constituent elements may be configured by one system LSI (Large Scale Integration). . The system LSI is an ultra-multifunctional LSI manufactured by integrating a plurality of components on a single chip, and specifically, a computer system including a microprocessor, ROM, RAM, and the like. . A computer program is recorded in the RAM. The system LSI achieves its functions by the microprocessor operating according to the computer program.

  In addition, each part of the components constituting each of the above devices may be individually made into one chip, or may be made into one chip so as to include a part or all of them.

  Although the system LSI is used here, it may be called IC, LSI, super LSI, or ultra LSI depending on the degree of integration. Further, the method of circuit integration is not limited to LSI's, and implementation using dedicated circuitry or general purpose processors is also possible. An FPGA (Field Programmable Gate Array) that can be programmed after manufacturing the LSI or a reconfigurable processor that can reconfigure the connection and setting of circuit cells inside the LSI may be used.

  Further, if integrated circuit technology comes out to replace LSI's as a result of the advancement of semiconductor technology or a derivative other technology, it is naturally also possible to carry out function block integration using this technology. Biotechnology can be applied.

  (13) Part or all of the constituent elements constituting each of the above devices may be configured as an IC card that can be attached to and detached from each device or a single module. The IC card or the module is a computer system including a microprocessor, a ROM, a RAM, and the like. The IC card or the module may include the super multifunctional LSI described above. The IC card or the module achieves its function by the microprocessor operating according to the computer program. This IC card or this module may have tamper resistance.

  (14) The present disclosure may be the method described above. Further, the present invention may be a computer program that realizes these methods by a computer, or may be a digital signal composed of the computer program.

  The present disclosure also relates to a computer-readable recording medium such as a flexible disk, hard disk, CD-ROM, MO, DVD, DVD-ROM, DVD-RAM, BD (Blu-ray). (Registered trademark) Disc), or recorded in a semiconductor memory or the like. The digital signal may be recorded on these recording media.

  In addition, the present disclosure may transmit the computer program or the digital signal via an electric communication line, a wireless or wired communication line, a network represented by the Internet, a data broadcast, or the like.

  Further, the present disclosure may be a computer system including a microprocessor and a memory, wherein the memory records the computer program, and the microprocessor operates according to the computer program.

  In addition, the program or the digital signal is recorded on the recording medium and transferred, or the program or the digital signal is transferred via the network or the like, and executed by another independent computer system. It is good.

  (15) The above embodiment and the above modifications may be combined.

  The present disclosure can be used for an operation management system, a vehicle, and an information processing method of the operation management system, and particularly for an operation management system, a vehicle, and an operation management system that reliably manages switching of operation modes in a vehicle such as an automobile. It can be used for information processing methods.

100a, 100b, 100c Vehicle 101 Gateway 110 Engine 111, 121, 131, 141, 151 ECU
120 driving assist unit 130 battery 140 head unit 150 communication unit 200a, 200A, 200b, 200c authentication server 211 screen generation unit 212 transaction data verification unit 213, 213A transaction data generation unit 214 block generation unit 215 synchronization unit 216 recording unit 217 second Communication unit 300 Car manufacturer server 311 Input unit 312 Transaction data generation unit 313 Third communication unit 1101 Detection unit 1102 Transaction data generation unit 1103 First communication unit 1411 Display unit 1412 Input unit

Claims (10)

An operation management system comprising one or more authentication servers and one or more vehicles capable of switching between manual operation and automatic operation,
Each of the one or more vehicles is
A first communication unit that communicates with at least one authentication server of the one or more authentication servers;
A plurality of electronic control devices connected to the network in the vehicle;
Based on a message issued by one or more of the plurality of electronic control devices, a detection unit that detects switching between a manual operation mode that is manually operated and an automatic operation mode that is automatically operated;
A transaction data generation unit that generates first transaction data including information indicating the switching detected by the detection unit and a first identifier indicating the vehicle, and transmits the first transaction data to the one authentication server via the first communication unit; ,
With
Each of the at least one authentication server includes
A second communication unit that communicates with each of the one or more vehicles;
A verification unit that determines validity of transaction data including the first transaction data acquired from at least one of the one or more vehicles;
A recording unit that records the transaction data that has been validated by the verification unit in a storage device;
Operation management system. The recording unit records in advance in the storage device a second identifier that uniquely identifies each of the one or more vehicles,
The verification unit verifies whether the first identifier included in the first transaction data is included in the second identifier and the validity of the first transaction data;
The recording unit is
When it is confirmed by the verification unit that the first identifier is included in the second identifier and the validity of the first transaction data is confirmed, the first transaction data is stored in the memory Record on the device,
The operation management system according to claim 1. Each of the one or more vehicles further includes
It has an input unit that accepts input of information,
The input unit is input information, and transmits information indicating that the switched automatic driving mode is approved to be continued to the transaction data generation unit,
The transaction data generation unit generates second transaction data including the input information, and transmits the second transaction data to the one authentication server via the first communication unit.
The operation management system according to claim 1 or 2. The transaction data generation unit, when the information indicating the switching detected by the detection unit indicates that the switching from the manual driving mode to the automatic driving mode, the information indicating the switching detected by the detection unit, and the vehicle Generating the first transaction data including information indicating an automatic driving level in the automatic driving mode in addition to the first identifier indicating, and transmitting the first transaction data to the one authentication server via the first communication unit;
The operation management system according to any one of claims 1 to 3. The transaction data generation unit, when the information indicating the switching detected by the detection unit indicates that the switching from the manual driving mode to the automatic driving mode, the information indicating the switching detected by the detection unit, and the vehicle Generating the first transaction data including information indicating a driving assist function operating in the automatic driving mode in addition to the first identifier shown, and transmitting the first transaction data to the one authentication server via the first communication unit;
The operation management system according to any one of claims 1 to 4. Each of the one or more vehicles further includes
A sensor unit that acquires sensor information indicating information related to the driver of the vehicle for each predetermined period or event,
The sensor unit transmits the acquired sensor information to the transaction data generation unit,
The transaction data generation unit generates first transaction data including information indicating the switching, the first identifier, and the sensor information, and transmits the first transaction data to the one authentication server via the first communication unit;
The operation management system according to any one of claims 1 to 5. The recording unit records in advance in the storage device a second identifier that uniquely identifies each of the one or more vehicles,
If the first identifier included in the first transaction data is not included in the second identifier, the verification unit indicates that the first identifier is not included in the second identifier. Notice,
The operation management system according to any one of claims 1 to 6. The transaction data generation unit further includes:
Generating transaction data including the first transaction data as block chain transaction data;
The recording unit is
Recording transaction data including the first transaction data as block chain transaction data;
The operation management system according to any one of claims 1 to 7. One vehicle in an operation management system comprising one or more authentication servers and one or more vehicles capable of switching between manual operation and automatic operation,
A first communication unit that communicates with at least one authentication server of the one or more authentication servers;
A plurality of electronic control devices connected to the network in the one vehicle;
Based on a message issued by one or more of the plurality of electronic control devices, a detection unit that detects switching between a manual operation mode that is manually operated and an automatic operation mode that is automatically operated;
A transaction data generation unit that generates first transaction data including information indicating the switching detected by the detection unit and a first identifier indicating the vehicle, and transmits the first transaction data to the one authentication server via the first communication unit; Comprising
vehicle. An information processing method of one authentication server in an operation management system comprising one or more authentication servers and one or more vehicles capable of switching between manual operation and automatic operation,
A communication step of communicating with each of the one or more vehicles;
Based on a message issued by one or more electronic control devices among a plurality of electronic control devices connected to the one in-vehicle network, which is first transaction data acquired from one of the one or more vehicles. A verification step for verifying validity of transaction data including information indicating switching between a manual operation mode manually operated and an automatic operation mode automatically operated, and first transaction data including a first identifier indicating the vehicle;
A recording step of recording the transaction data in a storage device when the validity of the transaction data is confirmed in the verification step;
Information processing method.

Images