JP2018039461A - Valet parking system, terminal device and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a valet parking system that improves safety of a valet parking system by an automatic drive control system.SOLUTION: A valet parking system includes a terminal device, an automobile, and a server device. The terminal device includes: a data transmission/reception part which receives a drive plan from the server device and transmits an authenticated drive plan to the automobile; a verification part which verifies the received drive plan; and an authenticated drive plan generation part which generates an authenticated drive plan when the drive plan is genuine. The automobile includes: a data transmission/reception part which receives the authenticated drive plan from the terminal device; a verification part which verifies the authenticated drive plan; and an automatic drive control part which performs automatic drive control according to the authenticated drive plan when the authenticated drive plan is genuine. The server device includes: a data transmission/reception part which transmits a drive plan to the terminal device; and a drive plan generation part which generates the drive plan.SELECTED DRAWING: Figure 2

Description

  The present invention relates to a valet parking system, a terminal device, and a program.

  Conventionally, a valet parking service is known in which an attendant parks a vehicle of a customer who has entered a site such as a hotel or restaurant on behalf of the customer (for example, Non-Patent Document 1).

Nippon Parking Development Co., Ltd., “Japan Parking Development Valley Parking Service”, [online], Japan Parking Development Co., Ltd., [Search August 30, 2016], Internet <URL: http: //www.npd .co.jp / solution / valet />

  Conventionally, there is no example in which the above-described valet parking is realized by automatic operation control, and how this is realized has not yet been fully studied. If valet parking is realized by automatic driving control, the computer on the facility side directly sends a command to the vehicle, so that driving by an attendant becomes unnecessary. However, if the customer's vehicle can be controlled without limitation by an instruction from the computer on the facility side, a security problem may occur. For example, a device impersonating a computer on the facility side may remotely steal a customer's vehicle. Alternatively, the electronic key information for controlling the customer's vehicle recorded in the computer on the facility side may be stolen and later misused.

  Therefore, an object of the present invention is to provide a valet parking system with improved safety in valet parking by an automatic operation control system.

  The valet parking system of the present invention includes a terminal device, an automobile, and a server device.

  The terminal device includes a data transmission / reception unit, a verification unit, and an operation plan generation unit with authentication. The data transmission / reception unit of the terminal device receives the operation plan from the server device, and transmits the authenticated operation plan generated when the operation plan is authentic to the vehicle. The verification unit of the terminal device verifies whether or not the received operation plan is authentic. The operation plan generation with authentication of the terminal device generates an operation plan with authentication using an electronic key that is authentication information for controlling the vehicle when the operation plan is authentic.

  The automobile includes a data transmission / reception unit, a verification unit, and an automatic driving control unit. The data transmission / reception unit of the automobile receives the operation plan with authentication from the terminal device. The verification unit of the automobile verifies whether or not the authenticated operation plan is authentic. The automatic driving control unit of the automobile executes the automatic driving control according to the certified driving plan when the certified driving plan is authentic.

  The server device includes a data transmission / reception unit and an operation plan generation unit. The data transmission / reception unit of the server device transmits the operation plan to the terminal device. The operation plan generation unit of the server device generates an operation plan.

  According to the valet parking system of the present invention, safety can be improved in valet parking by the automatic operation control system.

The figure which shows the outline of a structure and operation | movement of the valet parking system of Example 1. FIG. The block diagram which shows the structure of each apparatus of the valet parking system of Example 1. FIG. FIG. 3 is a first sequence diagram illustrating the operation of each device of the valet parking system according to the first embodiment. FIG. 3 is a second sequence diagram illustrating the operation of each device of the valet parking system according to the first embodiment. The 3rd sequence figure which shows operation | movement of each apparatus of the valet parking system of Example 1. FIG.

  Hereinafter, embodiments of the present invention will be described in detail. In addition, the same number is attached | subjected to the structure part which has the same function, and duplication description is abbreviate | omitted.

  Hereinafter, the configuration and operation of the valet parking system according to the first embodiment will be described with reference to FIG. The valet parking system 1 of the present embodiment includes a terminal device 11, an automobile 12, a server device 13, and a TTP server device 14.

  The terminal device 11 is a device having a communication function, and may be any device that stores authentication information of the owner of the terminal device 11. It is assumed that the terminal device 11 can communicate with the automobile 12. The terminal device 11 and the automobile 12 may perform data transmission / reception with, for example, a short-range wireless communication function (broken line in the figure), or a network 9 (for example, a wireless LAN, a mobile communication network, an Internet line, in-vehicle V2X communication, Data may be transmitted / received via a communication path combining these). The terminal device 11 and the server device 13 also need to be able to communicate. The terminal device 11 and the server device 13 are assumed to be communicably connected via a network 9 (for example, a wireless LAN, a mobile communication network, an Internet line, an in-vehicle V2X communication, or a communication path combining these). The terminal device 11 may be, for example, a smartphone or a tablet terminal. For example, an electronic key terminal for automobiles in which the authentication information of the owner is stored and a communication function is added may be used as the terminal device 11.

  The automobile 12 has an automatic driving function. When the vehicle 12 receives a control command related to automatic driving control from an external device or the like, and the control command is authentic, the vehicle 12 can execute driving control according to the control command. It is assumed that the automobile 12 can communicate with the TTP server device 14. The automobile 12 and the TTP server device 14 are connected to be communicable via the network 9 and can transmit and receive data.

  The server device 13 is a device for remotely operating the automobile 12 to park it at a suitable position in the site. The server device 13 is assumed to be managed and managed by the facility that provides the valet parking service. For example, the server device 13 may be a device managed and managed by a hotel or restaurant that provides a valet parking service. Alternatively, the server device 13 may be a device managed and controlled by a parking lot management company contracted with a hotel or restaurant that provides the service.

  The TTP server device 14 is a device that transmits map information having a predetermined meaning of an effective section to the automobile 12 (details will be described later). The TTP server device 14 is a device managed and managed by a trusted third party (TTP). For example, as a reliable third-party organization (TTP), there can be considered an administrative organization related to automatic driving control or a public organization specialized in surveying, for example, a related organization (Ministry of Land, Infrastructure, Transport and Tourism) of the Ministry of Land, Infrastructure, Transport and Tourism. However, trusted third-party organizations (TTP) are not limited to public organizations.

  As shown in FIG. 1, the terminal device 11 stores therein an electronic key 7 that is authentication information for controlling the automobile 12. By performing authentication using the electronic key 7, the terminal apparatus 11 Automatic operation can be executed. The electronic key 7 is information that is continuously used and does not expire except in special cases such as when it is stolen.

  As shown in FIG. 1, the terminal device 11 receives the operation plan 6 from the server device 13, and generates an authenticated operation plan 8 using the electronic key 7 when the operation plan 6 is authentic, The generated certified operation plan 8 is transmitted to the automobile 12. The automobile 12 starts the automatic operation control according to the received operation plan 8 with authentication only when the operation plan 8 with authentication received from the terminal device 11 is authentic. The automobile 12 may have a function of periodically determining the expiration date of the certified operation plan 8. When the expiration date of the operation plan with authentication 8 has expired, the operation plan with authentication 8 expires and the automobile 12 stops the automatic operation control. In addition, the automobile 12 receives from the TTP server device 14 effective zone information 5 that is map information in which a zone (effective zone) in which the certified operation plan 8 can be used effectively is recorded. It may be determined whether or not it is within the range of the effective section designated by the information 5 or within the range of a predetermined section determined based on the effective section. When the operation plan with authentication 8 is outside the range of the valid section or the predetermined section, the operation plan with authentication 8 expires and the automobile 12 stops the automatic operation control.

  Hereinafter, with reference to FIG. 2, the detail of a structure of each apparatus of the valet parking system 1 of a present Example is demonstrated. As shown in FIG. 2, the terminal device 11 of the present embodiment includes a data transmission / reception unit 111, a storage unit 1111, a verification unit 112, an authenticated operation plan generation unit 113, an electronic key storage unit 1131, and a revocation command. The configuration includes a generation unit 114. The automobile 12 of this embodiment includes a data transmission / reception unit 121, a storage unit 1211, a verification unit 122, an expiration date determination unit 123, a request generation unit 124, an effective zone determination unit 125, and an automatic driving control unit 126. The configuration includes an authenticated operation plan revocation unit 127. The server device 13 includes a data transmission / reception unit 131, a storage unit 1311, an operation plan generation unit 132, and a signature generation unit 133. The TTP server device 14 includes a data transmission / reception unit 141, a valid partition information search unit 142, and a database 1421.

  Next, with reference to FIG. 3, FIG. 4, the detail of operation | movement of each apparatus of the valet parking system 1 of a present Example is demonstrated.

  As shown in FIG. 3, first, the data transmission / reception unit 111 of the terminal device 11 transmits a valet parking application to the server device 13 (S111A). Note that the valet parking application transmitted in step S111A is stored in the storage unit 1111.

The data transmission / reception unit 131 of the server device 13 receives the valet parking application (S131A). The operation plan generation unit 132 of the server device 13 generates the operation plan 6 when receiving a valet parking application from the terminal device 11 (S132). The driving plan 6 is command information for driving and controlling the automobile 12 and includes a wide range of concepts. For example, the driving plan 6 can be a command in which the timing of the vehicle 12 going straight, turning right, turning left, moving backward, traveling speed, and prohibition items for automatic driving are specified in chronological order. On the other hand, the driving plan 6 may be a command that specifies only prohibited items such as the current location, destination (cabinet), roadway, and travel prohibited area of the automobile 12. Various contents of the operation plan 6 can be considered depending on how the automobile 12 is controlled. For example, the operation plan 6 may be information in which a plurality of control commands for the automobile 12 are collected, or may be information including only a single control command for the automobile 12. When the operation plan 6 is a single control command, a plurality of operation plans 6 are generated in the execution order and are sequentially transmitted to the automobile 12 in time series order.
The signature generation unit 133 of the server device 13 signs the operation plan 6 generated in step S132 (S133). The data transmission / reception unit 131 of the server device 13 transmits the signed operation plan 6 to the terminal device 11 (S131B). In the present embodiment, in order to be able to determine whether or not the operation plan 6 is authentic, the operation plan 6 is signed. However, since the authenticity determination of the operation plan 6 can be realized by other methods, it is not limited to the above method. The valet parking application received in step S131A and the signed operation plan 6 transmitted in step S131B are stored in the storage unit 1311.

  The data transmitter / receiver 111 of the terminal device 11 receives the signed operation plan 6 from the server device 13 (S111B). The verification unit 112 of the terminal device 11 verifies the signature attached to the operation plan 6 and verifies whether the operation plan 6 is authentic (S112). By executing step S112, the terminal device 11 can confirm that the server device 13 is not a spoofed but a legitimate device. The operation plan generator with authentication 113 of the terminal device 11 generates the operation plan with authentication 8 when the operation plan 6 is authentic (S113). In step S113, the operation plan with authentication 8 is generated using the electronic key 7 which is authentication information for controlling the automobile 12. It is assumed that the electronic key 7 has been stored in the electronic key storage unit 1131 in advance. For example, a ciphertext obtained by encrypting the operation plan 6 using the electronic key 7 may be used as the operation plan 8 with authentication. Or it is good also considering the ciphertext which encrypted the information which set the driving plan 6 and the electronic key 7 as a set with a common key (shared with the motor vehicle 12) as the driving plan 8 with authentication. Alternatively, information obtained by signing information obtained by setting the operation plan 6 and the electronic key 7 may be used as the operation plan with authentication 8. The data transmitter / receiver 111 of the terminal device 11 transmits the generated operation plan with authentication 8 to the automobile 12 (S111C). Step S111C may be executed, for example, by short-range wireless communication, may be executed by wired communication, or may be executed via the network 9. In the case of wired communication, for example, a stand for connecting the terminal device 11 to the automobile 12 side may be prepared in advance, and communication may be performed by connecting the terminal device 11 to the stand. The signed operation plan received in step S111B and the authenticated operation plan 8 transmitted in step S111C are stored in the storage unit 1111.

  The data transmitter / receiver 121 of the automobile 12 receives the authenticated operation plan 8 from the terminal device 11 (S121A). The verification unit 122 of the automobile 12 verifies whether or not the authenticated operation plan 8 received from the terminal device 11 is authentic (S122A). The authenticated operation plan 8 received in step S121A is stored in the storage unit 1211.

  As shown in FIG. 4, the expiration date determination unit 123 of the automobile 12 determines the expiration date of the operation plan with authentication 8 (S123). The expiration date of the operation plan with authentication 8 may be set based on the generation date and time of the operation plan with authentication 8, for example. For example, a time one hour after the generation of the certified operation plan 8 may be set as the expiration date. Alternatively, a time after 24 hours from when the certified operation plan 8 is generated may be set as the expiration date. In this case, the operation plan with authentication 8 needs to include time stamp information of the generation date and time. Further, for example, the expiration date of the certified operation plan 8 may be set based on the time when the automobile 12 receives the certified operation plan 8. For example, a time one hour after the time when the automobile 12 receives the certified operation plan 8 may be set as the expiration date. The automatic operation control unit 126 stops the automatic operation control according to the certified operation plan 8 when the determination result of the expiration date becomes a predetermined result (expiration date). Next, the request generation unit 124 of the automobile 12 acquires the current position of the automobile 12 by using, for example, a GPS function, and generates an effective zone information request including the current position information (S124). The data transmitter / receiver 121 of the automobile 12 transmits the valid section information request generated in step S124 to the TTP server device 14 (S121C). The valid partition information request transmitted in step S121C is stored in the storage unit 1211.

  The data transmitter / receiver 141 of the TTP server device 14 receives the valid section information request from the automobile 12 (S141A). The valid section information search unit 142 refers to the current position information included in the valid section information request, and searches for valid section information around the current position information using the coordinates indicated by the current position information as a search query (S142). It is assumed that the valid partition information has been stored in the database 1421 in advance. As described above, the effective zone information is map information in which a zone (effective zone) that can be used effectively by the certified operation plan 8 is recorded. Valid partition information is prepared in advance by a trusted third party (TTP). For example, a trusted third-party organization (TTP) has previously surveyed areas in which automated driving control services are operating (eg, valet parking areas such as commercial facilities, hotels, restaurants, etc.) The coordinate information and the like may be updated to the latest information as needed. In addition, a reliable third party (TTP) may have previously investigated information on the boundary between public roads and private property, and may continue to update this information as needed. The method of determining the effective section is arbitrary. For example, only the area where the service by the above-described automatic operation control is operating may be set as the effective section. Of these effective sections, areas recognized as public roads may be excluded from the effective sections. The data transmitter / receiver 141 of the TTP server device 14 transmits the valid section information retrieved in step S142 to the automobile 12 (S141B).

  The data transmitter / receiver 121 of the automobile 12 receives the valid section information from the TTP server device 14 (S121D). The effective zone determination unit 125 determines whether or not the certified operation plan 8 is within the range of the effective zone (S125). The automatic operation control unit 126 stops the automatic operation control according to the operation plan with authentication 8 when the determination result of the effective region becomes a predetermined result (a part or all of the operation plan with authentication 8 is outside the effective region). To do. By executing step S125, the automobile 12 is prevented from going out of the facility in accordance with the fake certified operation plan 8 (or the fake operation plan 6). Thereby, crime prevention performance improves. Note that the valid section information received in step S121D is stored in the storage unit 1211.

  In this embodiment, the automatic operation control unit 126 is authenticated only when all of the verification (S122), the expiration date determination (S123), and the effective zone determination (S125) of the operation plan with authentication 8 described above is true. Automatic operation control is started according to the operation plan 8 (S126). However, the expiration date determination (S123) and the valid partition determination (S125) may be omitted depending on circumstances, and when the step S125 is omitted, the TTP server device 14 is also unnecessary.

  When the receipt command by the operation plan with authentication 8 is received, the automobile 12 autonomously travels to the vehicle compartment desired by the facility side, enters the vehicle compartment autonomously, and waits in the vehicle compartment until the next command is issued. When the delivery instruction by the certified operation plan 8 is received, the automobile 12 exits from the vehicle compartment, and autonomously travels, for example, to the vehicle approach where the owner waits.

  Next, with reference to FIG. 5, the method by which the terminal device 11 forcibly expires the authenticated operation plan 8 will be described. When it is desired to cancel the automatic driving control of the automobile 12 as soon as possible for some reason, the invalidation command generation unit 114 of the terminal device 11 is based on a predetermined rule (for example, when a predetermined request is received from the owner). Is generated (S114). The data transmission / reception unit 111 of the terminal device 11 transmits the revocation command generated in step S114 to the automobile 12 (S111E). The data transmitter / receiver 121 of the automobile 12 receives the revocation command from the terminal device 11 (S121E). The authenticated operation plan revocation unit 127 expires the authenticated operation plan 8 in accordance with the revocation command received in step S121E (S127).

  Thus, according to the valet parking system 1 of the present embodiment, the safety of the valet parking by the automatic operation control method can be improved.

<Supplementary note>
The apparatus of the present invention includes, for example, a single hardware entity as an input unit to which a keyboard or the like can be connected, an output unit to which a liquid crystal display or the like can be connected, and a communication device (for example, a communication cable) capable of communicating outside the hardware entity. Can be connected to a communication unit, a CPU (Central Processing Unit, may include a cache memory or a register), a RAM or ROM that is a memory, an external storage device that is a hard disk, and an input unit, an output unit, or a communication unit thereof , A CPU, a RAM, a ROM, and a bus connected so that data can be exchanged between the external storage devices. If necessary, the hardware entity may be provided with a device (drive) that can read and write a recording medium such as a CD-ROM. A physical entity having such hardware resources includes a general-purpose computer.

  The external storage device of the hardware entity stores a program necessary for realizing the above functions and data necessary for processing the program (not limited to the external storage device, for example, reading a program) It may be stored in a ROM that is a dedicated storage device). Data obtained by the processing of these programs is appropriately stored in a RAM or an external storage device.

  In the hardware entity, each program stored in an external storage device (or ROM or the like) and data necessary for processing each program are read into a memory as necessary, and are interpreted and executed by a CPU as appropriate. . As a result, the CPU realizes a predetermined function (respective component requirements expressed as the above-described unit, unit, etc.).

  The present invention is not limited to the above-described embodiment, and can be appropriately changed without departing from the spirit of the present invention. In addition, the processing described in the above embodiment may be executed not only in time series according to the order of description but also in parallel or individually as required by the processing capability of the apparatus that executes the processing. .

  As described above, when the processing functions in the hardware entity (the apparatus of the present invention) described in the above embodiments are realized by a computer, the processing contents of the functions that the hardware entity should have are described by a program. Then, by executing this program on a computer, the processing functions in the hardware entity are realized on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, for example, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used. Specifically, for example, as a magnetic recording device, a hard disk device, a flexible disk, a magnetic tape or the like, and as an optical disk, a DVD (Digital Versatile Disc), a DVD-RAM (Random Access Memory), a CD-ROM (Compact Disc Read Only). Memory), CD-R (Recordable) / RW (ReWritable), etc., magneto-optical recording medium, MO (Magneto-Optical disc), etc., semiconductor memory, EEP-ROM (Electronically Erasable and Programmable-Read Only Memory), etc. Can be used.

  The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, the computer reads a program stored in its own recording medium and executes a process according to the read program. As another execution form of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In this embodiment, a hardware entity is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

Claims (7)

A valet parking system including a terminal device, an automobile, and a server device,
The terminal device
A data transmission / reception unit that receives the operation plan from the server device and transmits the operation plan with authentication generated when the operation plan is authentic;
A verification unit that verifies whether or not the received operation plan is authentic;
When the driving plan is authentic, including an authenticated driving plan generation unit that generates the certified driving plan using an electronic key that is authentication information for controlling the vehicle,
The car is
A data transmission / reception unit for receiving the authenticated operation plan from the terminal device;
A verification unit for verifying whether the certified operation plan is authentic;
When the certified operation plan is authentic, an automatic operation control unit that executes automatic operation control according to the authenticated operation plan,
The server device
A data transmission / reception unit for transmitting the operation plan to the terminal device;
A valet parking system including an operation plan generator for generating the operation plan. The valet parking system according to claim 1,
The car is
It further includes an expiration date determination unit that determines an expiration date of the received operation plan with authentication,
The automatic operation control unit is
A valet parking system that stops automatic operation control according to the certified operation plan when the expiration date determination result is a predetermined result. The valet parking system according to claim 1 or 2,
In addition to the terminal device, the automobile, and the server device, including a TTP server device under the control of a reliable third party,
The data transmission / reception unit of the automobile
From the TTP server device, it receives effective zone information that is information related to the effective zone of the certified operation plan,
The car is
An effective zone determination unit that determines whether or not the operation plan with authentication is within the range of the effective zone;
The automatic operation control unit is
A valet parking system that stops automatic operation control according to the certified operation plan when the determination result of the effective section is a predetermined result. The valet parking system according to any one of claims 1 to 3,
The terminal device
Including a revocation command generation unit that generates a revocation command that is a command for revoking the certified operation plan based on a predetermined rule;
The data transceiver of the terminal device is
The generated revocation order shall be sent to the car,
The car is
A valet parking system including an authenticated operation plan revocation unit for revoking the received operation plan with authentication when the revocation command is received. A terminal device that performs valet parking in cooperation with an automobile and a server device,
A data transmission / reception unit that receives the operation plan from the server device and transmits the operation plan with authentication generated when the operation plan is authentic;
A verification unit that verifies whether or not the received operation plan is authentic;
A terminal device including an authenticated operation plan generation unit that generates the authenticated operation plan using an electronic key that is authentication information for controlling the vehicle when the operation plan is authentic. The terminal device according to claim 5,
Including a revocation command generation unit that generates a revocation command that is a command for revoking the certified operation plan based on a predetermined rule;
The data transmitter / receiver
A terminal device that transmits the generated revocation command to the automobile.   The program which makes a computer function as a terminal device of Claim 5 or 6.

Images