Operation assisting system, control method thereof, moving object and server computer

Abstract

To provide an operation assisting system efficiently transmitting the positional information of a formation including a plurality of moving objects.SOLUTION: A first captain moving object transmits, to a first control server via a relay server, first formation positional information that defines a first solid which surrounds a plurality of first moving objects that forms a first flight formation. A second captain moving object transmits, to a second control server via the relay server, second formation positional information. The first control server obtains, from the relay server or from the second control server via the relay server, the second formation positional information, creates, based on the first formation positional information and on the second formation positional information, first formation control information for controlling the first flight formation so as not to collide with a second flight formation, and transmits, to the first captain moving object via the relay server, the first formation control information. The first captain moving object receives the first captain control information via the relay server, and controls the flights of the plurality of first moving objects according to the first formation control information.SELECTED DRAWING: Figure 8

Description

[Technical Field]

[0001] The present invention relates to a travel assistance system, a control method thereof, a mobile object, and a server computer. [Background technology]

[0002] Currently, unmanned aircraft such as drones are expected to play an active role in logistics. Non-Patent Document 1 points out the need for technological development to realize simultaneous operation of multiple aircraft by multiple operators. Patent Document 1 also describes staggering the takeoff times of drone formations each consisting of multiple drones. [Prior art documents] [Non-patent literature]

[0003] [Non-Patent Document 1] Public-Private Council for Improving the Environment for Small Unmanned Aircraft, "Roadmap 2021 for an Industrial Revolution in the Sky," June 18, 2021, (https: / / www.kantei.go.jp / jp / singi / kogatamujinki / kanminkyougi_dai16 / siryou4.pdf) [Patent documents]

[0004] [Patent Document 1] Special Publication No. 2022-523231 Summary of the Invention [Problem to be solved by the invention]

[0005] In the near future, it is expected that one million unmanned drones will fly through the sky to handle logistics. Because there are no roads in the air like there are on the ground, the challenge is how to fly a large number of unmanned drones without them colliding with each other. Even if roads for drones (space used as flight paths) are installed in the air in the future, it will be difficult to fly a large number of unmanned drones without them colliding with each other. This is because, with one million unmanned drones flying through the sky, the distance between adjacent drones could be anywhere from a few meters to a few tens of centimeters.

[0006] Flying in formation allows a large number of drones belonging to a transportation company to fly safely. On the other hand, if a large number of drones belonging to a transportation company cannot obtain the flight positions of a large number of drones belonging to other transportation companies, it becomes difficult to avoid collisions with the large number of drones belonging to other transportation companies. Furthermore, if such location information is tampered with by a third party, it becomes difficult to avoid collisions between multiple drones. Encrypting location information would prevent tampering by a third party. However, this increases the amount of location information per drone. This increases communication delays and reduces the time available for collision avoidance. Therefore, a communication technology that can efficiently transmit the location information of a large number of drones is needed.

[0007] When multiple unmanned aircraft fly simultaneously in the same airspace, they must fly without touching each other, and even then, it is necessary to efficiently transmit the position information of each unmanned aircraft.

[0008] SUMMARY OF THE INVENTION It is therefore an object of the present invention to provide a navigation assistance system that efficiently transmits position information of a formation consisting of multiple mobile objects. [Means for solving the problem]

[0009] The present invention is, for example, a plurality of first moving bodies flying in a first flight formation; a plurality of second moving bodies flying in a second flight formation; a relay server that wirelessly communicates with a first commander mobile unit that acts as a commander aircraft in the first flight formation among the plurality of first moving units, and a second commander mobile unit that acts as a commander aircraft in the second flight formation among the plurality of second moving units; a first control server that controls the first flight formation; a second control server that controls the second flight formation; A driving assistance system having: The first commander mobile body transmits first formation position information defining a first solid surrounding the plurality of first mobile bodies forming the first flight formation to the first control server via the relay server; The second commander mobile body transmits second formation position information defining a second solid surrounding the plurality of second mobile bodies forming the second flight formation to the second control server via the relay server; The first control server acquires the second formation position information from the relay server or from the second control server via the relay server, creates first formation control information for controlling the first formation so that the first formation does not come into contact with the second formation based on the first formation position information and the second formation position information, and transmits the first formation control information to the first commander mobile body via the relay server; the first commander mobile body receives the first formation control information via the relay server, and controls the flight of the plurality of first mobile bodies in accordance with the first formation control information; The second control server acquires the first formation position information from the relay server or from the first control server via the relay server, creates second formation control information for controlling the second formation so that the second formation does not come into contact with the first formation based on the first formation position information and the second formation position information, and transmits the second formation control information to the second commander mobile body via the relay server; A navigation assistance system is provided in which the second commander mobile body is configured to receive the second formation control information via the relay server and control the flight of the multiple second mobile bodies in accordance with the second formation control information. [Effects of the Invention]

[0010] According to the present invention, a navigation assistance system is provided that efficiently transmits position information of a formation of multiple mobile objects. [Brief explanation of the drawings]

[0011] [Figure 1] A diagram illustrating multiple formations flying in the same direction. [Figure 2] FIG. 1 is a diagram illustrating a solid body surrounding multiple moving objects forming a formation. [Figure 3] FIG. 1 shows a communication system (operation assistance system). [Figure 4] FIG. 2 is a diagram illustrating a member moving body. [Figure 5] FIG. 1 is a diagram illustrating a leader mobile unit. [Figure 6] FIG. 2 is a diagram for explaining a base station server. [Figure 7] FIG. 2 is a diagram illustrating a control server. [Figure 8] A sequence diagram showing the process from collecting location information to delivering commands. [Figure 9] 10 is a flowchart showing processing from acquisition of position information in a mobile object to execution of a command. [Figure 10] 10 is a flowchart showing the process of transmitting formation position information in the leader mobile body. [Figure 11] 10 is a flowchart showing the process of transferring and distributing formation position information in the base station server. [Figure 12] 10 is a flowchart showing the process of receiving the company's formation position information in the control server. [Figure 13] 10 is a flowchart showing the process of receiving other companies' formation position information and transmitting formation control information in the control server. [Figure 14]10 is a flowchart showing a process of distributing formation control information in a base station server. [Figure 15] 10 is a flowchart showing a method for controlling mobile units based on formation control information in the leader mobile unit. [Figure 16] 10 is a flowchart showing a method for generating formation position information. [Figure 17] 10 is a flowchart showing a method for creating formation control information. DETAILED DESCRIPTION OF THE INVENTION

[0012] Hereinafter, the embodiments will be described in detail with reference to the accompanying drawings. Note that the following embodiments do not limit the scope of the invention as claimed, and not all combinations of features described in the embodiments are necessarily essential to the invention. Two or more of the features described in the embodiments may be arbitrarily combined. Furthermore, the same reference numerals are used for the same or similar components, and redundant explanations will be omitted.

[0013] (1) Formation flight FIG. 1 shows multiple moving objects 100 flying in the same direction at a certain altitude. The moving objects 100 are primarily unmanned aerial vehicles such as drones, but may also be manned aircraft. Moving objects 100a-1 to 100a-z are moving objects flying in formation 1200a. Formation 1200a may be formed, for example, from moving objects belonging to logistics company A. Moving objects 100b-1 to 100b-z are moving objects flying in formation 1200b. Formation 1200a may be formed, for example, from moving objects belonging to logistics company B, or from moving objects belonging to logistics company A. The lowercase letters a and b added to the reference numbers indicate the company to which the moving objects 100 belong. Furthermore, the hyphenated numbers (or letters) added at the end of the reference numbers are used to distinguish multiple moving objects belonging to the same formation or logistics company. It should be noted that the letters ab and letters with hyphens may be omitted when describing matters common to multiple moving bodies 100. It should be noted that this principle of reference symbols also applies to objects other than moving bodies.

[0014] Generally, multiple logistics companies are rivals, and therefore do not share sensitive information such as location information (e.g., spatial coordinates, direction of movement, speed, acceleration, and the time at which these information was acquired). Therefore, each logistics company can prevent contact by exchanging (sending and receiving) location information only among the multiple mobile objects 100 belonging to its own company.

[0015] On the other hand, in a scenario in which a large number of mobile bodies 100, such as one million, are moving through the sky, even if each mobile body flies with a certain margin in three-dimensional space, it may not be possible to avoid collisions without location information of other mobile bodies 100 located in the vicinity.

[0016] Alternatively, if location information could be exchanged safely across company boundaries, it would enable the safe flight of a large number of moving bodies 100. Furthermore, if location information of surrounding moving bodies 100 were available, multiple moving bodies 100 would be able to fly closer together, enabling effective use of three-dimensional space.

[0017] In FIG. 1, leader mobile units 100a-z are mobile units that function as leader aircraft in formation 1200a. Leader mobile units 100b-z are mobile units that function as leader aircraft in formation 1200b. Thus, the hyphenated z attached to the reference symbol indicates that the mobile unit is a leader mobile unit. For example, leader mobile unit 100-z aggregates position value information of multiple mobile units 100 belonging to its own formation 1200 and distributes flight control commands (control information) to multiple mobile units 100. The flight control commands may be determined by leader mobile unit 100-z or by ground equipment (e.g., a base station server, a control server, etc.) that wirelessly communicates with leader mobile unit 100-z. In formation 1200, mobile units 100 other than leader mobile unit 100-z may be referred to as member mobile units 100.

[0018] 2 shows an example of a contact warning area 200 for a formation 1200. Here, for simplicity of the drawing, each moving object 100 is represented by a circle. The contact warning area 200 is a solid (e.g., a polyhedron) defined so as to surround all moving objects 100 belonging to the formation 1200. However, it is desirable that the number of vertices of the polyhedron or the number of variables used to express the coordinates of the vertices be less than the number of moving objects present inside the polyhedron.

[0019] FIG. 2 illustrates a rectangular parallelepiped as the contact warning area 200. The coordinates of the eight vertices defining the rectangular parallelepiped are (X1, Y1, Z1), (X1, Y1, Z2), (X1, Y2, Z1), (X1, Y2, Z2), (X2, Y1, Z1), (X2, Y1, Z2), (X2, Y2, Z1), and (X2, Y2, Z2). Therefore, the contact warning area 200 can be defined by six values: X1, X2, Y1, Y2, Z1, and Z2. Conventionally, if there are N moving bodies 100, all N coordinates must be transmitted to ground equipment. For example, if there are 100 moving bodies 100 in the formation 1200, 100 sets of coordinate data must be transmitted to ground equipment. On the other hand, in this embodiment, since only six pieces of position data need to be transferred, the information compression effect is high if the number of mobile objects belonging to the formation 1200 is seven or more. In particular, the information compression effect is extremely high in an airspace where one million drones fly, as envisioned in Non-Patent Document 1. Note that if prioritizing the placement of more formations closely together in the flight space, the position data may be compressed using a polyhedron with more vertices than a rectangular parallelepiped. The solid may also be a sphere or an ellipsoid. A sphere can be defined by its central coordinates and radius, so it will likely have a higher information compression effect than a rectangular parallelepiped. An ellipsoid can be defined by its central coordinates and the diameters of each of its three axes, so it will likely achieve the same information compression effect as a hexahedron.

[0020] (2) Communication system (operation support system) FIG. 3 shows a communication system. As an example, a convoy 1200a consists of mobile bodies 100a-1 to 100a-n of Company A and a leader mobile body 100a-z. The mobile bodies 100a-1 to 100a-n of Company A each transmit individual location information to the leader mobile body 100a-z. The individual location information is the location information for each mobile body 100. Note that the individual location information may be assigned a message authentication code of the member mobile body 100. In this case, the leader mobile body 100a-z adopts the individual location information for which the message authentication code has been successfully verified and discards the individual location information for which the message authentication code has not been verified. The leader mobile body 100a-z aggregates the individual position information of the mobile bodies 100a-1 to 100a-n and the individual position information of the leader mobile body 100a-z, creates formation position information that defines the three-dimensional shape of the contact warning area 200 of the formation 1200a, and transmits it to the base station server 110. The formation position information may also be assigned a message authentication code of the leader mobile body 100a-z. The base station server 110 transfers the formation position information received from the leader mobile body 100a-z to the control server 120a.

[0021] The control server 120a verifies the message authenticator of the leader mobile unit 100a-z that is attached to the formation position information, and transmits the verification result to the base station server 110. The verification result may be accompanied by the formation position information and the message authenticator.

[0022] If the control server 120a successfully verifies the message authenticator for the formation position information received from the leader mobile unit 100a-z, the base station server 110 delivers the formation position information received from the leader mobile unit 100a-z or accompanying the verification result to the control server 120b.

[0023] The formation 1200b consists of mobile bodies 100b-1 to 100b-m of company B and a leader mobile body 100m-z. The mobile bodies 100b-1 to 100b-m of company B transmit their individual position information to the leader mobile body 100b-z. The individual position information may be assigned a message authentication code of the member mobile body 100. The leader mobile body 100b-z aggregates the individual position information of the mobile bodies 100b-1 to 100b-m and the individual position information of the leader mobile body 100b-z, creates formation position information for the formation 1200b, and transmits it to the base station server 110. The formation position information may be assigned a message authentication code of the leader mobile body 100b-z. The base station server 110 transfers the formation position information received from the leader mobile body 100b-z to the control server 120b.

[0024] The control server 120b verifies the message authenticator of the leader mobile unit 100b-z that is attached to the formation position information, and transmits the verification result to the base station server 110. The verification result may be accompanied by the formation position information and the message authenticator.

[0025] If the control server 120b successfully verifies the message authenticator for the formation position information received from the leader mobile unit 100b-z, the base station server 110 delivers the formation position information received from the leader mobile unit 100b-z or accompanying the verification result to the control server 120a.

[0026] Based on the formation position information of formation 1200a and the formation position information of formation 1200b, control server 120a creates formation control information (formation control commands) indicating the flight speed, flight direction, etc. of formation 1200a so that the solid (e.g., rectangular parallelepiped) defining formation 1200a does not come into contact with the solid (e.g., rectangular parallelepiped) defining formation 1200b, and transmits this information to base station server 110. Based on the formation position information of formation 1200a and the formation position information of formation 1200b, control server 120b creates formation control information (formation control commands) indicating the flight speed, flight direction, etc. of formation 1200b so that the polyhedron (e.g., rectangular parallelepiped) defining formation 1200b does not come into contact with the polyhedron (e.g., rectangular parallelepiped) defining formation 1200a, and transmits this information to base station server 110.

[0027] The base station server 110 transmits the formation control information received from the control server 120a to the leader mobiles 100a-z. The base station server 110 transmits the formation control information received from the control server 120b to the leader mobiles 100b-z.

[0028] Based on the formation control information, the leader mobile unit 100a-z creates individual control information (individual commands) to be applied to each of the moving units 100a-1 to 100a-n and distributes the individual commands to the moving units 100a-1 to 100a-n. Based on the formation control information, the leader mobile unit 100b-z creates individual control information (individual commands) to be applied to each of the moving units 100b-1 to 100b-m and distributes the individual commands to the moving units 100b-1 to 100b-m.

[0029] Basically, the moving bodies 100a-1 to 100a-n fly in the same direction and at the same speed, so the flight speed and flight direction specified by the formation control information are applied as is to each individual moving body 100. However, there is some variation in the flight speed and flight direction of each moving body 100a-1 to 100a-n. Therefore, to avoid collisions between the moving bodies 100a-1 to 100a-n within the formation 1200a, the leader moving body 100a-z may slightly adjust the flight speed and flight direction specified by the formation control information for each moving body 100a-1 to 100a-n.

[0030] Because the moving bodies 100b-1 to 100b-m fly in the same direction and at the same speed, the flight speed and flight direction specified by the formation control information are applied directly to each individual moving body. However, there is some variation in the flight speed and flight direction of each moving body 100b-1 to 100b-m. Therefore, to avoid collisions between the moving bodies 100b-1 to 100b-m within the formation 1200b, the leader moving body 100b-z may slightly adjust the flight speed and flight direction specified by the formation control information for each moving body 100b-1 to 100b-m.

[0031] (3) Structure of the moving body (3-1) Member mobility FIG. 4 shows the structure of mobile objects 100a-1 to 100a-n and 100b-1 to 100b-m (hereinafter referred to as mobile object 100). CPU 300 controls various electrical and mechanical components of mobile object 100 according to a control program stored in memory 301. CPU is an abbreviation for central processing unit. Note that all or part of the functions realized by CPU 300 may be realized by multiple CPU cores, an application specific integrated circuit (ASIC), a digital signal processing circuit (DSP), a field programmable gate array (FPGA), or the like. Memory 301 includes storage circuits such as read-only memory (ROM) and random access memory (RAM).

[0032] The power supply circuit 303 supplies power from the battery 302 to the CPU 300, memory 301, wireless communication circuit 304, positioning circuit 305, and moving mechanism 306. The wireless communication circuit 304 is a communication circuit for wireless communication with the base station server 110. The type of wireless communication may be any of wireless LAN, 5G, Beyond 5G, 6G, etc. The wireless communication circuit 304 may simultaneously perform wireless communication using multiple different wireless communication methods. The positioning circuit 305 measures the position of the moving object 100 by receiving signals from a GNSS (Global Navigation Satellite System) and outputs position information indicating the position of the moving object 100. The moving mechanism 306 includes multiple propellers and motors for driving the propellers.

[0033] The CPU 300 performs various functions according to a control program. The position acquisition unit 311 controls the positioning circuit 305 to acquire position information m of the mobile unit 100. The position information m includes, for example, the mobile unit ID of the member mobile unit 100, individual position information in the narrow sense (spatial coordinates (latitude, longitude, altitude), flight speed, flight direction), time information, and a challenge. The authenticator assignment unit 312 assigns a message authenticator to the position information m. For example, a message authenticator is authentication information assigned to prevent tampering and impersonation of location information. A common key k required for assigning and verifying the message authenticator is created in advance for each mobile unit 100. The created common key k of the leader mobile unit is held only by the leader mobile unit itself, the member mobile units belonging to the formation managed by the leader mobile unit, and the corresponding control server. The created common key k of the member mobile unit is held only by the member mobile unit itself and the leader mobile unit of the formation to which the member mobile unit belongs. However, the common key k of the member mobile units may be held by the control server for another purpose. For example, the common key ka-1 of the mobile unit 100a-1 of Company A is held only by the mobile unit 100a-1 of Company A and the leader mobile unit 100a-z. The common key kb-m of the mobile unit 100b-m of Company B is held only by the mobile unit 100b-m of Company B and the leader mobile unit 100b-z. The location transmission unit 313 transmits the individual location information m with the message authentication code t to the leader mobile unit 100-z via the wireless communication circuit 304. The individual location information m may include a member mobile unit ID, a challenge, etc., which are identification information unique to the mobile unit 100. Here, the time information indicates the time when the individual location information m was generated. The leader mobile body 100-z monitors the time when the individual position information m is received for each member mobile body 100, and if a predetermined time has passed since the time indicated by the time information of the previously received individual position information m and the next individual position information m is not received from that member mobile body 100, the leader mobile body 100-z or the control server 120 may exclude that member mobile body 100 from the formation 1200. Alternatively, in such a case, the leader mobile body 100-z may send a notification to the control server 120, and the control server 120 may instruct subsequent actions.The challenge is used by the leader mobile unit 100-z to generate a response from the challenge. The member mobile unit 100 receives the response sent from the leader mobile unit 100-z along with the individual command and determines whether the response corresponds to the challenge sent by the member mobile unit 100. This may confirm the security of the individual command.

[0034] The command receiving unit 321 receives an individual command transmitted from the leader mobile body 100-z via the wireless communication circuit 304. The authenticator verification unit 322 verifies the message authenticator assigned by the leader mobile body 100-z to the individual command. This message authenticator is created using a common key of the leader mobile body 100-z held by the member mobile bodies 100 and the leader mobile body 100-z. If the verification of the message authenticator of the leader mobile body 100-z is successful, the movement control unit 323 controls the movement mechanism 306 according to the individual command. The individual command may include a traveling direction, a moving speed, a destination, etc.

[0035] (3-2) Leader's Mobile Unit Figure 5 shows the structure of the leader mobile bodies 100a-z, 100b-z. The leader mobile body 100-z may have a structure similar to that of other mobile bodies (hereinafter referred to as member mobile bodies) other than the own aircraft in the formation 1200. Among the elements shown in Figure 5, elements already explained using Figure 4 are given the same reference numerals, and their explanation will be omitted.

[0036] 5, each of the leader mobile bodies 100a-z and 100b-z also has the function of a member mobile body 100. The leader function 1300 is a function that is realized by the CPU 300 in accordance with a control program.

[0037] The leader function 1300 has the function of aggregating the individual position information of the member mobile bodies 100 to create formation position information and transmit it to the base station server 110, and the function of receiving formation control information from the base station server 110 and creating and distributing individual commands. The former function includes a position receiving unit 1301, an authenticator verifying unit 1302, a formation area calculating unit 1303, an authenticator assigning unit 1304, and a formation area transmitting unit 1305. The latter function includes a formation control information receiving unit 1311, an authenticator verifying unit 1312, an individual command generating unit 1313, and an individual command transmitting unit 1315.

[0038] The location receiving unit 1301 controls the wireless communication circuit 404 to receive location information m with a message authenticator t attached, transmitted from a member mobile unit 100. For example, location information ma-1 with a message authenticator ta-1 attached is received from the mobile unit 100a-1. Location information ma-n with a message authenticator ta-n is received from the mobile unit 100a-n. Location information mb-1 with a message authenticator tb-1 is received from the mobile unit 100b-1. Location information mb-m with a message authenticator tb-m is received from the mobile unit 100b-m.

[0039] The authenticator verification unit 1302 verifies the message authenticator t assigned to the position information m using the common key k of the member mobile body 100. If the verification of the message authenticator t is successful, the formation area calculation unit 1303 calculates the three-dimensional coordinate data defining the contact warning area 200 based on the individual position information (position information m) received from the multiple member mobile bodies 100. If the shape of the contact warning area 200 is a rectangular parallelepiped, the minimum value of X (X1), maximum value of X (X2), minimum value of Y (Y1), maximum value of Y (Y2), minimum value of Z (Z1), and maximum value of Z (Z2) are calculated based on the current individual position information (X, Y, Z) received from the multiple member mobile bodies 100. Furthermore, the formation area calculation section 1303 may determine the predicted position of the contact warning area 200 after a preset unit time (minimum value of X (X1), maximum value of X (X2), minimum value of Y (Y1), maximum value of Y (Y2), minimum value of Z (Z1), maximum value of Z (Z2)). For example, the unit time may be the interval between acquisitions of formation position information of other formations.

[0040] The authenticator assigning unit 1304 creates a message authenticator Tz using the common key of the leader mobile unit 100-z and assigns it to the formation position information. For example, the message authenticator Tz is calculated by applying the common key of the leader mobile unit 100b-z to the formation position information M (e.g., formation ID, three-dimensional coordinate data defining the contact warning area 200 (formation position information in the narrow sense), time information, challenge). The message authenticator Tz is assigned to the formation position information M. The formation ID is unique identification information for each formation. Here, the time information indicates the time when the formation position information M was generated. The control server 120 monitors the time when the formation position information M is received for each leader mobile body 100-z. If the next formation position information M is not received from the leader mobile body 100-z even after a predetermined time has passed since the time indicated by the time information of the last received formation position information M, the control server 120 may exclude the leader mobile body 100-z from monitoring. The challenge is used by the control server 120 to generate a response from the challenge. The leader mobile body 100-z receives the response transmitted from the control server 120 along with the formation control information and determines whether the response corresponds to the challenge it transmitted. This may confirm the security of the formation control information.

[0041] The message authenticator Tz of the formation 1200a may be written as message authenticator Ta-z, and the formation position information M may be written as formation position information Ma. The message authenticator Tz of the formation 1200b may be written as message authenticator Tb-z, and the formation position information M may be written as formation position information Mb. The message authenticator of the member mobile body 100 is not assigned to the formation position information M, but rather the message authenticator of the leader mobile body 100-z is assigned. This makes it possible to reduce the amount of traffic associated with the message authenticators.

[0042] The formation area transmitter 1305 controls the wireless communication circuit 304 to transmit the formation position information with the message authenticator to the base station server 110. For example, the formation area transmitter 1305 transmits the formation position information MT-z with the message authenticator to the control server 120a.

[0043] The formation control information receiver 1311 controls the wireless communication circuit 304 to receive formation control information transmitted from the control server 120 and forwarded by the base station server 110. The authenticator verification unit 1312 verifies the message authenticator attached to the formation control information. This message authenticator is generated by the control server 120 using the common key of the leader mobile unit 100-z. The formation control information may include a formation ID, a control command to be applied to the formation (e.g., flight speed, flight direction, etc.), time information, a response, etc.

[0044] Here, the time information indicates the time when the formation position information is transmitted from the control server 120. The leader mobile body 100-z calculates the difference (delay time) between the time information (transmission time) attached to the formation position information and the time when the formation control information is received (reception time). If this difference exceeds a threshold, the leader mobile body 100-z may determine that some abnormality has occurred and may transmit a notification indicating the occurrence of the abnormality to the base station server 110 or the control server 120. This may instruct the leader mobile body 100-z on the next action to be taken from the base station server 110 or the control server 120. The leader mobile body 100-z uses the response to determine whether it corresponds to the challenge attached to the formation position information. As described above, the control server 120 generates a response from the challenge received from the leader mobile body 100-z and transmits it to the leader mobile body 100-z via the base station server 110 together with the formation control information. The leader mobile body 100-z also generates a response for comparison from the challenge based on the same calculation method as the control server 120, and compares it with the response received from the control server 120. This allows the leader mobile body 100-z to detect a replay attack. Here, the calculation method may be a method using the common key k of the leader mobile body 100-z.

[0045] The individual command generation unit 1313 generates an individual command for the member mobile unit 100 (e.g., the member mobile unit 100's mobile unit ID, control information (flight speed, flight direction), time information, and response) based on the formation control information for which the message authenticator has been successfully verified. The individual command generation unit 1313 also generates an individual command for the leader mobile unit 100-a based on the formation control information for which the message authenticator has been successfully verified, and stores it in memory 301. This individual command is executed by the movement control unit 323. Note that the authenticator assignment unit individual command generation unit 1313 may apply the common key of the member mobile unit 100 to the individual command to create a message authenticator, assign the message authenticator to the individual command, and transmit it to the member mobile unit 100. As described above, the member mobile unit 100 assigns time information and transmits the individual position information m to the leader mobile unit 100-z, and receives the individual command with the time information assigned. If the time difference (delay time) calculated from these two pieces of time information exceeds a threshold, the member mobile body 100 may discard the individual command or send a predetermined notification to the base station server 110 or the control server 120 to inquire about instructions for the next action. The response is used to detect replay attacks. The member mobile body 100 sends the individual location information m along with a challenge to the leader mobile body 100-z and receives the individual command along with a response from the leader mobile body 100-z. In addition, the member mobile body 100 and the leader mobile body 100-z can generate a response from the challenge using the same calculation method (e.g., the common key k of the member mobile body 100). Therefore, the member mobile body 100 may generate a response from the challenge itself and compare it with the response received from the leader mobile body 100-z to ensure the security of the individual command.

[0046] The individual command transmission unit 1315 transmits an individual command to each member mobile body 100. The individual command may include the mobile body ID of the destination member mobile body, control content (e.g., flight speed, flight direction), time information, a response, etc.

[0047] (4) Basic server structure 6 shows the structure of the base station server 110. A CPU 400 controls various electrical components of the base station server 110 in accordance with a control program stored in a memory 401. All or part of the functions implemented by the CPU 400 may be implemented by multiple CPU cores, an ASIC, a DSP, an FPGA, or the like. The memory 401 includes storage devices such as a ROM, a RAM, a solid-state drive (SSD), and a hard disk drive (HDD).

[0048] The power supply circuit 403 converts AC supplied from a commercial AC power source or the like into DC, and supplies DC voltage to the CPU 400, the memory 401, the wireless communication circuit 404, and the wired communication circuit 407. The wireless communication circuit 404 is a communication circuit for wireless communication with the mobile object 100. The type of wireless communication may be any of wireless LAN, 5G, Beyond 5G, 6G, etc. The wired communication circuit 407 is a communication circuit (network interface circuit) for communicating with the control server 120.

[0049] The formation area transfer unit 1401 controls the wireless communication circuit 404 to communicate with the leader mobile units 100a-z, receive the formation position information (with message authenticator) of the formation 1200a, and transfer the formation position information to the control server 120a. Similarly, the formation area transfer unit 1401 controls the wireless communication circuit 404 to communicate with the leader mobile units 100b-z, receive the formation position information (with message authenticator) of the formation 1200b, and transfer the formation position information to the control server 120b.

[0050] The result receiving unit 1411 receives from the control server 120 the verification result (authentication result) of the formation position information with the message authenticator. This verification result is digitally signed using the private key of the control server 120. The signature verification unit 1412 verifies the digital signature using the public key of the control server 120. For example, the signature verification unit 1412 may restore the information received from the control server 120 (e.g., the ID of the control server 120, the formation position information (with the message authenticator)) by applying the public key of the control server 120 to the digital signature attached to the information and verify whether the restored information matches the hash information of the information received from the control server 120. If the verification result received from the control server 120a is OK (True) and the attached digital signature is successfully verified, the formation position information Ma of Company A's formation 1200a, which accompanies the verification result, can be transferred to the control server 120b of another company, Company B. Similarly, if the verification result received from control server 120b is OK and the verification of the attached digital signature is successful, the formation position information Mb of Company B's formation 1200b accompanying the verification result can be transferred to control server 120a of another company, Company A.

[0051] Based on the verification result received by the result receiving unit 1411, the judgment unit 1413 judges whether the verification of the message authentication code of the leader mobile unit 100-z attached to the formation position information M was successful in the control server 120.

[0052] The signature adding unit 1414 adds a digital signature using the private key of the base station server 110 to the formation position information M that is to be transferred to another control server.

[0053] The formation area transmitter 1415 transfers the formation position information M with the digital signature to the other companies' control servers 120. The formation position information Ma of Company A's formation 1200a is transmitted to Company B's control server 120b. The formation position information Mb of Company B's formation 1200b is transmitted to Company A's control server 120a.

[0054] The formation control information receiving unit 1421 controls the wired communication circuit 407 to receive formation control information for each formation 1200 transmitted from the control server 120. Formation control information for formation 1200a is received from control server 120a. Formation control information for formation 1200b is received from control server 120b. Here, the formation control information is provided with a digital signature from each control server 120.

[0055] The signature verification unit 1422 verifies the digital signature of control server 120 that is attached to the formation control information. For example, the signature verification unit 1422 verifies the digital signature attached to the formation control information using the public key of control server 120a. For example, the signature verification unit 1422 calculates a hash value of the formation control information (e.g., formation ID, formation control content (with message authenticator), time response) received from control server 120, and a hash value of the formation control information by applying the public key of control server 120a to the digital signature, and verifies whether these two hash values match. Similarly, the signature verification unit 1422 verifies the digital signature attached to the formation control information using the public key of control server 120b.

[0056] The formation control information transmitter 1423 controls the wireless communication circuit 404 to transmit formation control information whose digital signature has been successfully verified to the leader mobile body 100-z of the corresponding formation 1200. The formation control information may include a formation ID, control details for each formation (e.g., flight speed, flight direction, etc.), time information, a response, and a message authentication code generated by the control server 120 using the common key of the leader mobile body 100. For example, the formation control information transmitter 1423 transfers formation control information received from the control server 120a by the formation control information receiver 1421, whose digital signature has been verified by the signature verification unit 1422, to the leader mobile bodies 100a-z. Similarly, the formation control information transmitter 1423 transfers formation control information received from the control server 120b by the formation control information receiver 1421, whose digital signature has been verified by the signature verification unit 1422, to the leader mobile bodies 100b-z.

[0057] (5) Details of the control server 120 7 shows the structure of the control server 120. A CPU 500 controls various electrical components of the control server 120 in accordance with a control program stored in a memory 501. All or part of the functions implemented by the CPU 500 may be implemented by multiple CPU cores, an ASIC, a DSP, an FPGA, or the like. The memory 501 includes storage devices such as a ROM, a RAM, an SSD, and a hard disk drive HDD.

[0058] The power supply circuit 503 converts AC supplied from a commercial AC power source or the like into DC and supplies DC voltage to the CPU 500, memory 501, and wired communication circuit 507. The wired communication circuit 507 is a communication circuit (network interface circuit) for communicating with the base station server 110.

[0059] The formation area receiving unit 511 receives its own formation position information from the base station server 110 via the wired communication circuit 507.

[0060] The authenticator verification unit 512 verifies the message authenticator attached to the formation position information of its own formation 1200. For example, the authenticator verification unit 512 performs verification based on the formation position information (e.g., formation ID, coordinate data defining the contact warning area 200 of the formation 1200 (formation position information in the narrow sense), time information, challenge), the message authenticator attached to the formation position information, and the common key of the leader mobile body 100-z. More specifically, the authenticator verification unit 512 may apply the common key of the leader mobile body 100-z to the formation position information to create a message authenticator for verification, and verify whether it matches the message authenticator attached to the formation position information. This verification method is used not only by the control server 120, but also by the member mobile bodies 100 and the leader mobile body 100-z.

[0061] The signature assignment unit 513 assigns a digital signature to the verification result regarding the formation position information and the message authentication code using the private key of the control server 120. This prevents tampering with the verification result and spoofing. The verification result may include the formation position information and the message authentication code.

[0062] The result transmission unit 514 transmits the verification result, bearing the digital signature of the control server 120, to the base station server 110. For example, the result transmission unit 514 of the control server 120a transmits the verification result for the formation 1200a to the base station server 110. The result transmission unit 514 of the control server 120b transmits the verification result for the formation 1200b to the base station server 110.

[0063] The formation area receiver 521 receives formation position information of other companies via the wired communication circuit 507. For example, the formation area receiver 521 of the control server 120a receives formation position information of the formation 1200b from the base station server 110. The formation area receiver 521 of the control server 120b receives formation position information of the formation 1200a from the base station server 110.

[0064] The signature verification unit 522 verifies the digital signature of the base station server 110 that is attached to the formation position information about the other company's formation 1200. This verification is performed using the public key of the base station server 110.

[0065] The formation control information creation unit 523 creates control information (commands) for its own company's formation 1200 based on the formation position information of other companies' formations 1200 whose digital signatures have been successfully verified and the formation position information of its own company's formation 1200. For example, the formation control information creation unit 523 of control server 120a creates commands (maneuvering commands, course change commands, etc.) for the formation 1200 of interest based on the coordinates, speed, and flight direction of the formation 1200a of interest and the coordinates, speed, and flight direction of another formation 1200b flying around it, so that these formations 1200 can move to their destination without coming into contact with each other. For example, the formation control information creation unit 523 determines the flight speed and flight direction for the rectangular parallelepiped of the formation 1200a of interest so that the rectangular parallelepiped of the formation 1200a of interest does not come into contact with the rectangular parallelepiped of the other formation 1200b that is flying around it, and creates commands indicating the determined flight speed and flight direction. In this way, formation control information is created individually for each formation 1200.

[0066] The authenticator assigning unit 524 assigns a message authenticator to the formation control information using the common key of the leader mobile body 100-z. The message authenticator is generated by applying the common key of the leader mobile body 100-z to the formation control information (e.g., formation ID, formation control information in the narrow sense (control command), time information, response). For example, a message authenticator is generated for the formation control information for the formation 1200a using the common key of the leader mobile body 100a-z. A message authenticator is generated for the formation control information for the formation 1200b using the common key of the leader mobile body 100b-z. Each of these message authenticators is verified by the authenticator verifying unit 1312 of the leader mobile body 100-z.

[0067] The signature assigner 525 assigns a digital signature to the formation control information (with a message authenticator) using the private key of the control server 120. This digital signature is verified by the signature verifying unit 1422 of the base station server 110.

[0068] The formation control information transmitter 526 transmits the formation control information with the digital signature to the base station server 110. Control server 120a transmits the formation control information for formation 1200a to the base station server 110. Control server 120b transmits the formation control information for formation 1200b to the base station server 110.

[0069] (6) Signal Sequence Figure 8 is a sequence diagram of signals involved in a series of processes from collecting formation position information to distributing control information. Here, it is assumed that both digital signature verification and message authentication code verification are successful.

[0070] In Sq1, the member mobiles 100a-1 to 100a-n of the formation 1200a each transmit individual location information with a message authenticator to the leader mobile 100a-z. The leader mobile 100a-z receives the individual location information with a message authenticator from each of the member mobiles 100a-1 to 100a-n.

[0071] In Sq2, the leader mobile unit 100a-z creates formation position information based on the received individual position information of the member mobile units 100a-1 to 100a-n and its own individual position information, generates a message authenticator for the leader mobile unit 100a-z, attaches it to the formation position information, and transmits it to the base station server 110. The base station server 110 receives the formation position information with the message authenticator from the leader mobile unit 100a-z.

[0072] In Sq3, the base station server 110 forwards the formation position information with the message authenticator received from the leader mobile units 100a-z to the control server 120a. The control server 120a receives the formation position information with the message authenticator for the formation 1200a from the base station server 110.

[0073] In Sq4, the control server 120a attaches its digital signature to the verification result of the message authenticator and transmits the verification result with the digital signature to the base station server 110. The verification result may include whether the verification was successful (True / False) and the formation position information of the formation 1200a. The base station server 110 receives the verification result with the digital signature from the control server 120a.

[0074] In Sq5, base station server 110 appends its digital signature to the formation position information of formation 1200a and transmits it to control server 120b. Control server 120b receives the formation position information of formation 1200a from base station server 110.

[0075] In Sq11, the member mobile bodies 100b-1 to 100b-m of the formation 1200b each transmit individual position information with a message authenticator to the leader mobile body 100b-z. The leader mobile body 100b-z receives the individual position information with a message authenticator from each of the member mobile bodies 100b-1 to 100b-m.

[0076] In Sq12, the leader mobile unit 100b-z creates formation position information based on the received individual position information of the member mobile units 100b-1 to 100b-m and its own individual position information, generates a message authenticator for the leader mobile unit 100b-z, attaches it to the formation position information, and transmits it to the base station server 110. The base station server 110 receives the formation position information with the message authenticator for the formation 1200b from the leader mobile unit 100b-z.

[0077] In Sq13, the base station server 110 transfers the formation position information with the message authenticator received from the leader mobile unit 100b-z to the control server 120b. The control server 120b receives the formation position information with the message authenticator for the formation 1200b from the base station server 110.

[0078] In Sq14, the control server 120b attaches its digital signature to the verification result of the message authenticator and transmits the verification result with the digital signature to the base station server 110. The verification result may include whether the verification was successful and the formation position information of the formation 1200b. The base station server 110 receives the verification result with the digital signature from the control server 120b.

[0079] In Sq15, the base station server 110 adds the digital signature of the base station server 110 to the formation position information of the formation 1200b and transmits it to the control server 120a. The control server 120a receives the formation position information of the formation 1200b from the base station server 110.

[0080] In Sq6, based on the formation position information Ma of Company A's formation 1200a and the formation position information Mb of Company B's formation 1200b, Company A's control server 120a creates formation control information to prevent formation 1200a from coming into contact with other formations 1200b flying around it, attaches the message authenticator of the leader mobile unit 100a-z and the digital signature of control server 120a to the formation control information, and transmits it to base station server 110. The base station server 110 receives the formation control information (with message authenticator) with the digital signature attached from control server 120a. Here, for convenience of explanation, it is assumed that the digital signature is successfully verified.

[0081] In Sq7, the base station server 110 verifies the digital signature and transmits the formation control information (with message authenticator) for the formation 1200a to the leader mobiles 100a-z. The leader mobiles 100a-z receive the formation control information (with message authenticator) for the formation 1200a from the base station server 110.

[0082] In Sq8, the leader mobile unit 100a-z generates individual commands (with message authenticators for each member mobile unit 100) based on the formation control information received from the base station server 110, and transfers each individual command (with message authenticator) to the member mobile units 100a-1 to 100a-n. The member mobile units 100a-1 to 100a-n receive and execute the individual commands (with message authenticators) addressed to them. The leader mobile unit 100a-z stores the individual commands addressed to it in memory 301 and executes them.

[0083] In Sq16, based on the formation position information Mb of Company A's formation 1200b and the formation position information Mb of Company B's formation 1200b, Company A's control server 120b creates formation control information to prevent formation 1200b from coming into contact with other formations 1200b flying around it, adds a message authenticator of the leader mobile unit 100b-z and a digital signature of control server 120b to the formation control information, and transmits it to base station server 110. Base station server 110 receives the formation control information (with message authenticator) with the digital signature added from control server 120b. Again, for convenience of explanation, it is assumed that the digital signature is successfully verified.

[0084] In Sq17, the base station server 110 verifies the digital signature and transmits the formation control information (with message authenticator) for the formation 1200b to the leader mobile 100b-z. The leader mobile 100b-z receives the formation control information (with message authenticator) for the formation 1200b from the base station server 110.

[0085] In Sq18, the leader mobile unit 100b-z generates individual commands (with message authenticators for each member mobile unit 100) based on the formation control information received from the base station server 110, and transfers each individual command (with message authenticator) to the member mobile units 100b-1 to 100b-m. The member mobile units 100b-1 to 100b-m receive and execute the individual commands (with message authenticators) addressed to them. The leader mobile unit 100b-z stores the individual commands addressed to it in memory 301 and executes them.

[0086] (7) Flowchart of member movement FIG. 9 is a flowchart showing the processing executed by the CPU 300 of the moving object 100 in accordance with the control program.

[0087] In S901, the CPU 300 (position acquisition unit 311) determines whether it is acquisition timing. For example, the CPU 300 acquires the current time from a real-time clock (RTC) and determines whether the current time matches the acquisition timing. Note that the acquisition timing may be, for example, a timing that occurs at a fixed interval. If the current time is acquisition timing, the CPU 300 proceeds from S901 to S902. If the current time is not acquisition timing, the CPU 300 proceeds from S901 to S905.

[0088] In S902, the CPU 300 (position acquisition unit 311) acquires position information by controlling the positioning circuit 305. The positioning circuit 305 may be a GNSS receiver.

[0089] In S903, the CPU 300 (the authenticator assigner 312) assigns a message authenticator to the location information. The message authenticator is generated using a common key held only by the mobile object 100 and the control server 120.

[0090] In S904, the CPU 300 (location transmitting unit 313) controls the wireless communication circuit 304 to transmit the location information (individual location information) with the message authenticator to the base station server 110. The individual location information may be provided with mobile unit identification information for distinguishing each mobile unit, and identification information of the logistics company to which each mobile unit belongs (or identification information of the control server 120), etc.

[0091] In S905, the CPU 300 (command receiving unit 321) controls the wireless communication circuit 304 to determine whether a command has been received from the base station server 110. If a command has been received, the CPU 300 proceeds from S905 to S906. If a command has been received, the CPU 300 ends this processing. In other words, the CPU 300 proceeds from S905 to S901.

[0092] In S906, the CPU 300 (the authenticator verification unit 322) verifies the message authenticator attached to the command using the common key that it possesses.

[0093] In S907, the CPU 300 (mobile control unit 323) determines whether the verification of the message authentication code was successful. If the verification failed, the CPU 300 discards the received command without executing it. On the other hand, if the verification was successful, the CPU 300 proceeds from S907 to S908.

[0094] In S908, the CPU 300 (movement control unit 323) executes the received command. After that, the CPU 300 proceeds to S901. In this manner, S901 to S908 are repeatedly executed.

[0095] (8) Flowchart of the leader mobile unit (aggregation and transfer of individual location information) 10 shows the location information aggregation and transfer process executed by the CPU 300 of the leader mobile units 100a-z in accordance with a control program. The CPU 300 of the leader mobile units 100b-z also executes similar processes.

[0096] In S1001, the CPU 300 (position receiving unit 1301) receives individual position information (with message authentication code) from each of the member mobile objects 100a-1 to 100a-n.

[0097] In S1002, the CPU 300 (authenticator verification unit 1302) verifies the message authenticator attached to the individual location information received from each of the member mobile objects 100a-1 to 100a-n. If the verification of the message authenticator is successful, the CPU 300 proceeds from S1002 to S103. If the verification of the message authenticator fails, the CPU 300 discards the received individual location information.

[0098] In S1003, the CPU 300 (position acquisition unit 311) acquires position information (for example, coordinates, speed, direction, time, etc.) of the own vehicle (the leader mobile body 100b-z) from the positioning circuit 305.

[0099] In S1004, CPU 300 (formation area calculation unit 1303) generates formation position information that defines contact warning area 200 of formation 1200a based on the individual position information of each of member moving bodies 100a-1 to 100a-n and the individual position information of its own vehicle.

[0100] In S1005, the CPU 300 (the authenticator assigning unit 1304) creates a message authenticator for the leader mobile object 100a-z and assigns the message authenticator to the formation position information.

[0101] In S1006, the CPU 300 (formation area transmission unit 1305) controls the wireless communication circuit 304 to transmit the formation position information (with a message authenticator) to the base station server 110.

[0102] (9) Base station server flowchart (9-1) Location information transfer process FIG. 11 shows a location information transfer process executed by the CPU 400 of the base station server 110 in accordance with a control program.

[0103] In S1101, the CPU 400 (formation area transfer unit 1401) controls the wireless communication circuit 404 to determine whether formation position information has been received from the leader mobile unit 100a-z (or leader mobile unit 100b-z). If formation position information has been received, the CPU 400 proceeds from S1101 to S1102. If formation position information has not been received, the CPU 400 proceeds from S1101 to S1111.

[0104] In S1102, the CPU 400 (formation area transfer unit 1401) controls the wired communication circuit 407 to transfer the formation position information received from the leader mobile unit 100a-z (or the leader mobile unit 100b-z) to the control server 120a (or the control server 120b).

[0105] (9-2) Distribution of formation position information In S1111, the CPU 400 (result receiving unit 1411) determines whether or not the verification result of the authenticator has been received from the control server 120. If the verification result has been received from the control server 120, the CPU 400 proceeds from S1111 to S111. If the verification result has not been received from the control server 120, the CPU 400 proceeds from S1111 to S1101.

[0106] In S1112, the CPU 400 (signature verification unit 1412) verifies the digital signature of the control server 120 that is attached to the verification result. The CPU 400 verifies the digital signature using the public key of the control server 120.

[0107] In S1113, the CPU 400 (signature verification unit 1412) determines whether or not the verification of the digital signature has been successful. If the verification of the digital signature has been successful, the CPU 400 proceeds from S1113 to S1114. If the verification of the digital signature has failed, the CPU 400 proceeds from S1113 to S1101.

[0108] In S1114, the CPU 400 (determination unit 1413) determines whether the verification of the message authenticator attached to the formation position information was successful based on the received verification result. If the verification of the message authenticator is successful, the CPU 400 proceeds from S1114 to S1115. If the verification of the message authenticator is unsuccessful, the CPU 400 proceeds from S1114 to S1101.

[0109] In S1115, CPU 400 (signature assignment unit 1414) assigns the digital signature of base station server 110 to the formation position information of a certain formation of a certain company.

[0110] In S1116, the CPU 400 (formation area transmitter 1415) transmits the formation position information to be transferred, with the digital signature of the base station server 110 attached, to the control server 120, which is the transfer destination. That is, the formation position information of formation 1200a is transferred to control server 120b. The formation position information of formation 1200b is transferred to control server 120a.

[0111] (10) Control server flow chart FIG. 12 is a flowchart showing the process of receiving the company's formation position information, which is executed by the CPU 500 in accordance with the control program.

[0112] In S1201, the CPU 500 (formation area receiving unit 511) determines whether or not it has received its own formation position information from the base station server 110. For example, it may be determined whether or not the formation position information is of its own formation based on the formation ID included in the formation position information. If the formation position information includes the moving object ID of the leader moving object 100-z, it may be determined whether or not the formation position information is of its own formation based on the moving object ID. If it has received its own formation position information, the CPU 500 proceeds from S1201 to S1202. If it has not received its own formation position information, the CPU 500 repeats S1201.

[0113] In S1202, the CPU 500 (the authenticator verification unit 512) verifies the message authenticator attached to the formation position information.

[0114] In S1203, the CPU 500 (authenticator verification unit 512) determines whether the verification of the message authenticator is successful. If the verification of the message authenticator is successful, the CPU 500 proceeds from S1203 to S1204. If the verification of the message authenticator is not successful, the CPU 500 discards the received formation position information of its own company and proceeds to S1205.

[0115] In S1204, CPU 500 (formation area receiver 511) stores the formation position information of its own company in memory 501.

[0116] In S1205, the CPU 500 (signature adding unit 513) adds a digital signature to the verification result of the message authentication code using the private key of the control server 120.

[0117] In S1206, the CPU 500 (result sending unit 514) controls the wired communication circuit 507 to send the verification result of the message authenticator (with a digital signature) to the base station server 110. The verification result may be accompanied by the formation position information and the message authenticator of the leader mobile unit 100-z received from the base station server 110. The CPU 500 proceeds from S1206 to S1201.

[0118] FIG. 13 is a flowchart showing the process of receiving other companies' formation position information, which is executed by the CPU 500 in accordance with a control program.

[0119] In S1301, the CPU 500 (formation area receiving unit 521) determines whether or not it has received formation position information of another company from the base station server 110. Whether or not the formation position information is of another company can be determined based on the formation ID included in the formation position information or the moving body ID of the leader moving body 100-z. If it has received formation position information of another company, the CPU 500 proceeds from S1301 to S1302. If it has not received formation position information of another company, the CPU 500 repeats S1301.

[0120] In S1302, CPU 500 (signature verification unit 522) verifies the digital signature of base station server 110 that is attached to the formation position information.

[0121] In S1303, the CPU 500 (signature verification unit 522) determines whether the verification of the digital signature of the base station server 110 has been successful. If the verification is successful, the CPU 500 proceeds from S1303 to S1304. If the verification is unsuccessful, the CPU 500 discards the received formation position information of other companies and proceeds to S1301.

[0122] In S1304, CPU 500 (formation control information generation unit 523) stores the formation position information of other companies in memory 501.

[0123] At S1305, the CPU 500 (formation control information creation unit 523) creates formation control information for the company's own formation based on the formation position information of the company's own formation and the formation position information of surrounding formations (other company's formations). As described above, the formation control information for the company's own formation is created so that the contact warning area 200 of the company's own formation does not come into contact with the contact warning area 200 of another formation flying adjacent to it.

[0124] In S1306, the CPU 500 (authentication code assignment unit 524, signature assignment unit 525) creates a message authentication code for the formation control information using the common key of the commander mobile unit 100-z, creates a digital signature for the control server 120, and assigns the message authentication code and digital signature to the formation control information.

[0125] In S1307, CPU 500 (formation control information transmitter 526) transmits the formation control information with the digital signature and message authentication code to base station server 110. CPU 500 proceeds from S1307 to S1301.

[0126] (11) Flowchart of base station server (distribution of formation control information) FIG. 14 is a flowchart showing the formation control information distribution process executed by the CPU 400 in accordance with the control program.

[0127] In S1401, the CPU 400 (formation control information receiver 1421) determines whether or not formation control information has been received from the control server 120. If formation control information has been received, the CPU 400 proceeds from S1401 to S1402. If formation control information has not been received, the CPU 400 ends the distribution process (repeating S1401).

[0128] In S1402, the CPU 400 (signature verification unit 1422) verifies the digital signature of the control server 120 that is attached to the formation control information.

[0129] In S1403, the CPU 400 (signature verification unit 1422) determines whether or not the verification of the digital signature of the control server 120 has been successful. If the verification is successful, the CPU 400 proceeds from S1403 to S1404. If the verification is not successful, the CPU 400 proceeds from S1403 to S1401.

[0130] In S1404, the CPU 400 (formation control information transmitter 1423) transmits formation control information to the leader mobile body 100-z. For example, the formation control information transmitter 1423 transmits formation control information addressed to the formation 1200a or the leader mobile body 100a-z to the leader mobile body 100a-z. The formation control information transmitter 1423 transmits formation control information addressed to the formation 1200b or the leader mobile body 100b-z to the leader mobile body 100b-z. The CPU 400 then proceeds from S1404 to S1401.

[0131] (12) Receiving formation control information and generating and distributing individual commands at the leader vehicle FIG. 15 is a flowchart showing the process of receiving formation control information and generating and distributing individual commands, which is executed by the CPU 300 of the leader vehicle 100-z in accordance with a control program.

[0132] In S1501, CPU 300 (formation control information receiver 1311) controls wireless communication circuit 304 to receive formation control information with a message authentication code from base station server 110.

[0133] In S1502, the CPU 300 (the authenticator verification unit 1312) verifies the message authenticator attached to the formation control information.

[0134] In S1503, the CPU 300 (authenticator verification unit 1312) determines whether the verification of the message authenticator is successful. If the verification of the message authenticator is successful, the CPU 300 proceeds from S1503 to S1504. If the verification of the message authenticator is unsuccessful, the CPU 300 discards the formation control information and proceeds to S1501.

[0135] In S1504, the CPU 300 (individual command generation unit 1313) generates individual commands for each member moving body 100 belonging to the formation 1200 based on the formation control information. Here, the individual position information of each member moving body 100 is taken into consideration, and the individual commands may be slightly modified so that multiple member moving bodies 100 flying adjacent to each other do not come into contact with each other.

[0136] In S1505, the CPU 300 (authentication unit 1314) generates a message authentication code from the common key of the member mobile body 100 and the individual command (e.g., the mobile body ID of the member mobile body 100, the control content (individual command in the narrow sense), time information, response), and assigns it to the individual command.

[0137] In S1506, the CPU 300 (individual command transmission unit 1315) controls the wireless communication circuit 304 to transmit the corresponding individual command to each member mobile object 100.

[0138] In S1507, the CPU 300 (individual command generation unit 1313) generates an individual command for the own aircraft (leader mobile body 100-z) based on the formation control information. Here, the individual position information of each member mobile body 100 and the individual position information of the leader mobile body 100-z are taken into consideration, and the individual command may be slightly modified so that the leader mobile body 100-z and multiple member mobile bodies 100 flying adjacent to each other do not come into contact with each other.

[0139] In S1508, the CPU 300 (movement control unit 323) executes an individual command for the leader mobile object 100-z.

[0140] (13) Creation of formation position information FIG. 16 is a flowchart showing a method for calculating formation position information that is executed by the CPU 300 (formation area calculation unit 1303) of the leader mobile unit 100-z in accordance with a control program.

[0141] In S1601, the CPU 300 (formation area calculation unit 1303) calculates the predicted positions of the multiple moving bodies 100 (including the member moving bodies 100 and the leader moving body 100-z) belonging to the formation 1200 managed by the leader moving body 100-z after a unit time based on their individual position information. The individual position information includes current coordinate data, time information indicating the time of acquisition, flight speed, and flight direction. Based on this, the predicted position of each moving body 100 after a unit time is calculated.

[0142] In S1601, the CPU 300 (formation area calculation unit 1303) determines, as formation control information, the coordinates of the vertices that define a solid (e.g., a rectangular prism) that can enclose all of the predicted positions determined for the member mobile bodies 100 and the leader mobile body 100-z.

[0143] Note that a rectangular parallelepiped is merely an example, and coordinate data defining a sphere or an ellipsoid may also be used.

[0144] (14) Creation of formation control information FIG. 17 is a flowchart showing a formation control information calculation method executed by the CPU 500 (formation control information generation unit 523) of the control server 120 in accordance with a control program. In S1701, the CPU 500 (formation control information generation unit 523) identifies other formations (surrounding formations) flying around the formation of interest based on the formation position information.

[0145] At S1702, the CPU 500 (formation control information creation unit 523) determines coordinates that define a target rectangular parallelepiped such that the formation position information of the formation of interest (contact warning area 200) does not overlap with the formation position information of the surrounding formations (contact warning areas 200), based on the formation position information of the formation of interest and the formation position information of the identified surrounding formations. A rectangular parallelepiped is one example, and the target rectangular parallelepiped may be a three-dimensional object such as a polyhedron, sphere, or ellipsoid.

[0146] In S1703, the CPU 500 (formation control information generation unit 523) obtains the difference between the coordinates of the rectangular parallelepiped of the formation of interest and the coordinates of the target rectangular parallelepiped as formation control information.

[0147] <Other> The individual location information may include challenge data (random numbers) in addition to latitude, longitude, altitude, time, message authentication code, and identification information (e.g., identification information for distinguishing a company, a mobile unit, a formation, etc.). In this case, the command may be accompanied by response data generated from the challenge data and time attached to the individual location information. In this case, the mobile unit 100 may generate comparison data from the challenge data attached to the individual location information and the time, and compare it with the response data attached to the command to determine the validity of the command.

[0148] <Technical ideas derived from examples> [Point 1] The moving bodies 100a-1 to 100a-z are an example of a plurality of first moving bodies flying in a first flight formation (e.g., formation 1200a). The moving bodies 100b-1 to 100b-z are an example of a plurality of second moving bodies flying in a second flight formation (e.g., formation 1200b). The base station server 110 functions as a relay server that wirelessly communicates with a first leader moving body (e.g., leader moving body 100a-z) that acts as a leader aircraft in the first flight formation among the plurality of first moving bodies, and a second leader moving body (e.g., leader moving body 100b-z) that acts as a leader aircraft in the second flight formation among the plurality of second moving bodies. The control server 120a functions as a first control server that controls the first flight formation. The control server 120b functions as a second control server that controls the second flight formation.

[0149] The first commander mobile body transmits first formation position information defining a first solid (e.g., contact warning area 200) surrounding the multiple first moving bodies forming the first flight formation to the first control server via the relay server. The second commander mobile body transmits second formation position information defining a second solid (e.g., contact warning area 200) surrounding the multiple second moving bodies forming the second flight formation to the second control server via the relay server.

[0150] The first control server (e.g., control server 120a) acquires second formation position information from the relay server or from the second control server via the relay server. Based on the first formation position information and the second formation position information, the first control server (e.g., control server 120a) creates first formation control information for controlling the first flight formation so that the first flight formation does not come into contact with the second flight formation, and transmits the first formation control information to the first flight formation leader mobile body via the relay server. The first flight formation leader mobile body (e.g., leader mobile body 100a-z) receives the first formation control information via the relay server and controls the flight of the multiple first flight formations in accordance with the first formation control information.

[0151] The second control server (e.g., control server 120b) acquires first formation position information from the relay server or from the first control server via the relay server. Based on the first formation position information and the second formation position information, the second control server (e.g., control server 120b) creates second formation control information for controlling the second flight formation so that the second flight formation does not come into contact with the first flight formation, and transmits the second formation control information to the second commander mobile body via the relay server. The second commander mobile body (e.g., commander mobile body 100b-z) is configured to receive the second formation control information via the relay server and control the flight of multiple second moving bodies in accordance with the second formation control information. In this way, by approximating the shape of each formation to a three-dimensional shape and using the three-dimensional position information as formation position information, a navigation assistance system is provided that efficiently transmits position information of a formation consisting of multiple moving bodies.

[0152] [Point 2] The first commander mobile unit (e.g., commander mobile unit 100a-z) may attach first authentication information (e.g., a message authentication code of the commander mobile unit 100a-z) to the first formation position information and transmit it. The first control server (e.g., control server 120a) may transmit a first verification result, which is the verification result of the first authentication information attached by the first commander mobile unit, to the relay server. The first verification result may be accompanied by the first formation position information and the first authentication information. If the first verification result indicates successful verification of the first authentication information for the first formation position information at the first control server, the relay server (e.g., base station server 110) may transmit the first formation position information to the second control server (e.g., control server 120b). The verification function of the first control server may be installed in the relay server. In this case, the relay server performs verification of the first authentication information, and if the verification is successful, the relay server may transmit the first formation position information to the second control server.

[0153] The second commander mobile unit (e.g., commander mobile unit 100b-z) may attach second authentication information (e.g., message authentication code of commander mobile unit 100b-z) to the second formation position information and transmit it. The second control server (e.g., control server 120b) may transmit a second verification result, which is the verification result of the second authentication information attached by the second commander mobile unit, to the relay server. The second verification result may be accompanied by the second formation position information and the second authentication information. The relay server (e.g., base station server 110) may transmit the second formation position information to the first control server if the second verification result indicates that the second control server has successfully verified the second authentication information for the second formation position information. The functionality of the second control server may be incorporated in the relay server. In this case, the relay server may perform verification of the second authentication information, and if the verification is successful, the relay server may transmit the second formation position information to the first control server.

[0154] This will make it easier to verify the identity and non-tampering of formation position information.

[0155] [Point 3] The first control server (e.g., control server 120a) may add third authentication information (e.g., message authenticator) to the first formation control information and transmit it to the first commander mobile body. The first commander mobile body (e.g., commander mobile body 100a-z) may receive the first formation control information with the added third authentication information via the relay server, and if verification of the third authentication information is successful, may control the flight of the multiple first mobile bodies according to the first formation control information.

[0156] The second control server (e.g., control server 120b) may add fourth authentication information (e.g., message authenticator) to the second formation control information and transmit it to the second commander mobile body. The second commander mobile body (e.g., commander mobile body 100b-z) may receive the second formation control information with the fourth authentication information added via the relay server, and if verification of the fourth authentication information is successful, may control the flight of the multiple first mobile bodies according to the second formation control information.

[0157] This will facilitate verification of the identity and non-tampering of the formation control information between the control server 120 and the leader vehicle 100-z.

[0158] [Point 4] The first formation position information transmitted from the relay server to the first control server may be given a digital signature (e.g., the digital signature of the base station server 110) by the relay server. The first verification result transmitted from the first control server to the relay server may be given a digital signature (e.g., the digital signature of the control server 120a) by the first control server. The second formation position information transmitted from the relay server to the second control server may be given a digital signature (e.g., the digital signature of the base station server 110) by the relay server. The second verification result transmitted from the second control server to the relay server may be given a digital signature (e.g., the digital signature of the control server 120b) by the second control server. This may make it possible to prevent information tampering and spoofing between the relay server and the control server.

[0159] [Point 5] The first solid and the second solid may be rectangular parallelepipeds, which reduces the size of the formation position information.

[0160] [Point 6] The first formation position information and the second formation position information may include six values (e.g., X1, X2, Y1, Y2, Z1, Z2) that define the eight vertices of a rectangular parallelepiped, which further reduces the information size of the formation position information.

[0161] [Point 7] The six values may be two values in the latitude direction, two values in the longitude direction, and two values in the altitude direction.

[0162] [Point 8] The first verification result may be accompanied by first formation position information and first authentication information, and the second verification result may be accompanied by second formation position information and second authentication information.

[0163] [Point 9] a plurality of first moving bodies flying in a first flight formation; a plurality of second moving bodies flying in a second flight formation; a relay server that wirelessly communicates with a first commander mobile unit that operates as a commander aircraft in a first flight formation among a plurality of first mobile units, and a second commander mobile unit that operates as a commander aircraft in a second flight formation among a plurality of second mobile units; a first control server that controls the first flight formation; a second control server that controls a second flight formation; There may be provided a control method for a travel assistance system having the following: The first commander mobile body transmits first formation position information defining a first solid surrounding the plurality of first mobile bodies forming the first flight formation to the first control server via the relay server; The second commander mobile body transmits second formation position information defining a second solid body surrounding the plurality of second mobile bodies forming the second flight formation to the second control server via the relay server; the first control server acquires the second flight formation position information from the relay server or from the second control server via the relay server, creates first flight formation control information for controlling the first flight formation so that the first flight formation does not come into contact with the second flight formation based on the first flight formation position information and the second flight formation position information, and transmits the first flight formation control information to the first flight formation commander mobile body via the relay server; the first commander mobile body receives the first formation control information via the relay server and controls the flight of the plurality of first mobile bodies in accordance with the first formation control information; The second control server acquires the first flight formation position information from the relay server or from the first control server via the relay server, creates second flight formation control information for controlling the second flight formation so that the second flight formation does not come into contact with the first flight formation based on the first flight formation position information and the second flight formation position information, and transmits the second flight formation control information to the second flight formation commander mobile body via the relay server; The second commander mobile body receives the second formation control information via the relay server and controls the flight of the plurality of second mobile bodies in accordance with the second formation control information; In this way, by approximating the shape of each formation to a three-dimensional shape and using the position information of that three-dimensional shape as formation position information, it becomes possible to efficiently transmit the position information of a formation consisting of multiple moving bodies.

[0164] [Point 10] a plurality of first moving bodies flying in a first flight formation; a plurality of second moving bodies flying in a second flight formation; a relay server that wirelessly communicates with a first commander mobile unit that operates as a commander aircraft in a first flight formation among a plurality of first mobile units, and a second commander mobile unit that operates as a commander aircraft in a second flight formation among a plurality of second mobile units; a first control server that controls the first flight formation; a second control server that controls a second flight formation; In such a navigation assistance system, a mobile unit that operates as a first leader mobile unit may be provided.

[0165] The CPU 300 and the formation area calculation unit 1303 are an example of a generating means for generating first formation position information that defines a first solid surrounding the multiple first moving objects forming the first flight formation. The wireless communication circuit 304 and the formation area transmission unit 1305 are an example of a transmitting means for transmitting the first formation position information to the first control server via the relay server. The wireless communication circuit 304 and the formation control information receiving unit 1311 are an example of a receiving means for receiving first formation control information generated and transmitted by the first control server via the relay server. The CPU 300, the commander function 1300, and the movement control unit 323 are an example of a control means for controlling the flight of the multiple first moving objects in accordance with the first formation control information.

[0166] The second commander mobile unit transmits second formation position information, which defines a second solid surrounding the multiple second mobile units forming the second flight formation, to the second control server via the relay server. The first control server acquires the second formation position information from the relay server or from the second control server via the relay server, and creates first formation control information for controlling the first flight formation so that the first flight formation does not come into contact with the second flight formation based on the first formation position information and the second formation position information. The first formation control information is then transmitted to the first commander mobile unit via the relay server. In this way, by approximating the shape of each formation to a solid and using the position information of that solid as formation position information, it is possible to efficiently transmit the position information of a formation consisting of multiple mobile units. The relay server may also verify the second authentication information, and if the verification is successful, the relay server may transmit the second formation position information to the first control server. In other words, it is not necessary for the second authentication information to be transmitted to the second control server.

[0167] [Point 11] The moving object may be, for example, a drone.

[0168] [Point 12] The control server 120 is an example of a server computer operating as a first control server. The wired communication circuit 507, CPU 500, and formation area receiving unit 511 are an example of a receiving means for receiving first formation position information, which defines a first solid surrounding the multiple first moving objects forming the first flight formation and is transmitted by the first commander moving object via the relay server. The wired communication circuit 507, CPU 500, and formation area receiving unit 521 are an example of an acquiring means for acquiring second formation position information, which defines a second solid surrounding the multiple second moving objects forming the second flight formation and is generated by the second commander moving object, from the relay server or from the second control server via the relay server. As described above, the second formation position information may be acquired from the relay server without going through the second control server. The CPU 500 and the formation control information creation unit 523 are an example of a creation means that creates first formation control information for controlling the first flight formation so that the first flight formation does not come into contact with the second flight formation based on the first flight formation position information and the second flight formation position information. The wired communication circuit 507, the CPU 500, and the formation control information transmission unit 526 are an example of a transmission means that transmits the first formation control information to the first commander mobile body via a relay server. In this way, by approximating the shape of each formation to a three-dimensional shape and using the position information of that three-dimensional shape as formation position information, it is possible to efficiently transmit the position information of a formation consisting of multiple mobile bodies.

[0169] The invention is not limited to the above-described embodiment, and various modifications and variations are possible within the scope of the gist of the invention. [Explanation of symbols]

[0170] 100: Mobile unit, 110: Base station server, 120: Control server

Claims

1. a plurality of first moving bodies flying in a first flight formation; a plurality of second moving bodies flying in a second flight formation; a relay server that wirelessly communicates with a first commander mobile unit that acts as a commander aircraft in the first flight formation among the plurality of first moving units, and a second commander mobile unit that acts as a commander aircraft in the second flight formation among the plurality of second moving units; a first control server that controls the first flight formation; a second control server that controls the second flight formation; A driving assistance system having: The first commander mobile body transmits first formation position information defining a first solid surrounding the plurality of first mobile bodies forming the first flight formation to the first control server via the relay server; The second commander mobile body transmits second formation position information defining a second solid surrounding the plurality of second mobile bodies forming the second flight formation to the second control server via the relay server; The first control server acquires the second formation position information from the relay server or from the second control server via the relay server, creates first formation control information for controlling the first formation so that the first formation does not come into contact with the second formation based on the first formation position information and the second formation position information, and transmits the first formation control information to the first commander mobile body via the relay server; the first commander mobile body receives the first formation control information via the relay server, and controls the flight of the plurality of first mobile bodies in accordance with the first formation control information; The second control server acquires the first formation position information from the relay server or from the first control server via the relay server, creates second formation control information for controlling the second formation so that the second formation does not come into contact with the first formation based on the first formation position information and the second formation position information, and transmits the second formation control information to the second commander mobile body via the relay server; A flight assistance system in which the second commander mobile body is configured to receive the second formation control information via the relay server and control the flight of the multiple second mobile bodies in accordance with the second formation control information.

2. The first commander mobile unit transmits the first formation position information together with first authentication information; The first control server transmits a first verification result, which is a verification result of the first authentication information granted by the first leader mobile body, to the relay server; the relay server, when the first verification result indicates successful verification of the first authentication information for the first formation position information in the first control server, transmits the first formation position information to the second control server; The second commander mobile unit transmits the second formation position information together with second authentication information; The second control server transmits a second verification result, which is a verification result of the second authentication information granted by the second leader mobile body, to the relay server; 2. The navigation assistance system according to claim 1, wherein the relay server is configured to transmit the second formation position information to the first control server when the second verification result indicates that the second authentication information for the second formation position information at the second control server has been successfully verified.

3. the first control server adds third authentication information to the first formation control information and transmits the information to the first commander mobile unit; The first commander mobile body receives the first formation control information to which the third authentication information is assigned via the relay server, and when the verification of the third authentication information is successful, controls the flight of the plurality of first mobile bodies in accordance with the first formation control information; the second control server adds fourth authentication information to the second formation control information and transmits the information to the second commander mobile unit; The second commander mobile body receives the second formation control information to which the fourth authentication information is assigned via the relay server, and when the verification of the fourth authentication information is successful, controls the flight of the plurality of first mobile bodies in accordance with the second formation control information. The travel assistance system according to claim 1 , wherein the travel assistance system is configured as follows:

4. a digital signature is added by the relay server to the first formation position information transmitted from the relay server to the first control server; a digital signature is added by the first control server to the first verification result transmitted from the first control server to the relay server; the second formation position information transmitted from the relay server to the second control server is digitally signed by the relay server; The traffic assistance system according to claim 2 , wherein the second verification result transmitted from the second control server to the relay server is digitally signed by the second control server.

5. The navigation assistance system according to claim 1 , wherein the first solid and the second solid are rectangular parallelepipeds.

6. The navigation assistance system according to claim 5 , wherein the first formation position information and the second formation position information include six values that define eight vertices of the rectangular parallelepiped.

7. 7. The navigation assistance system according to claim 6, wherein the six values are two values in the latitude direction, two values in the longitude direction, and two values in the altitude direction.

8. The first verification result is accompanied by the first formation position information and the first authentication information; The navigation assistance system according to claim 2 , wherein the second verification result is accompanied by the second formation position information and the second authentication information.

9. a plurality of first moving bodies flying in a first flight formation; a plurality of second moving bodies flying in a second flight formation; a relay server that wirelessly communicates with a first commander mobile unit that acts as a commander aircraft in the first flight formation among the plurality of first moving units, and a second commander mobile unit that acts as a commander aircraft in the second flight formation among the plurality of second moving units; a first control server that controls the first flight formation; a second control server that controls the second flight formation; A control method for a driving assistance system having The first commander mobile body transmits first formation position information defining a first solid surrounding the plurality of first mobile bodies forming the first flight formation to the first control server via the relay server; The second commander mobile body transmits second formation position information defining a second solid surrounding the plurality of second mobile bodies forming the second flight formation to the second control server via the relay server; The first control server acquires the second formation position information from the relay server or from the second control server via the relay server, creates first formation control information for controlling the first formation based on the first formation position information and the second formation position information so that the first formation does not come into contact with the second formation, and transmits the first formation control information to the first commander mobile body via the relay server; The first leader mobile body receives the first formation control information via the relay server and controls the flight of the plurality of first mobile bodies in accordance with the first formation control information; The second control server acquires the first formation position information from the relay server or from the first control server via the relay server, creates second formation control information for controlling the second formation so that the second formation does not come into contact with the first formation based on the first formation position information and the second formation position information, and transmits the second formation control information to the second commander mobile body via the relay server; The second leader mobile body receives the second formation control information via the relay server and controls the flight of the plurality of second mobile bodies in accordance with the second formation control information; A method for controlling a driving assistance system, including:

10. a plurality of first moving bodies flying in a first flight formation; a plurality of second moving bodies flying in a second flight formation; a relay server that wirelessly communicates with a first commander mobile unit that acts as a commander aircraft in the first flight formation among the plurality of first moving units, and a second commander mobile unit that acts as a commander aircraft in the second flight formation among the plurality of second moving units; a first control server that controls the first flight formation; a second control server that controls the second flight formation; In a navigation assistance system having the above, a mobile body that operates as the first leader mobile body, a generation means for generating first formation position information that defines a first solid body surrounding the plurality of first moving bodies forming the first flight formation; a transmitting means for transmitting the first formation position information to the first control server via the relay server; a receiving means for receiving, via the relay server, first formation control information generated and transmitted by the first control server; and control means for controlling flight of the plurality of first moving bodies in accordance with the first formation control information; The second commander mobile body transmits second formation position information defining a second solid surrounding the plurality of second mobile bodies forming the second flight formation to the second control server via the relay server; The first control server acquires the second formation position information from the relay server or from the second control server via the relay server, creates first formation control information for controlling the first formation based on the first formation position information and the second formation position information so that the first formation does not come into contact with the second formation, and transmits the first formation control information to the first commander mobile body via the relay server.

11. The moving body according to claim 10, wherein the moving body is a drone.

12. a plurality of first moving bodies flying in a first flight formation; a plurality of second moving bodies flying in a second flight formation; a relay server that wirelessly communicates with a first commander mobile unit that acts as a commander aircraft in the first flight formation among the plurality of first moving units, and a second commander mobile unit that acts as a commander aircraft in the second flight formation among the plurality of second moving units; a first control server that controls the first flight formation; a second control server that controls the second flight formation; In a travel assistance system having the above, a server computer that operates as the first control server, a receiving means for receiving first formation position information that defines a first solid body surrounding the plurality of first moving bodies forming the first flight formation and that is transmitted by the first commander moving body via the relay server; An acquisition means for acquiring second formation position information that defines a second solid surrounding the plurality of second moving bodies forming the second flight formation, generated by the second commander moving body, from the relay server or from the second control server via the relay server; a generating means for generating first formation control information for controlling the first flight formation so that the first flight formation does not come into contact with the second flight formation, based on the first flight formation position information and the second flight formation position information; a transmitting means for transmitting the first formation control information to the first commander mobile unit via the relay server; a server computer having:

Images