Falsification determining method, image storing method, program, image storing device and falsification determining system

Abstract

To provide a falsification detecting method, an image storing method, a program, a drive recorder and a falsification determining system capable of detecting the presence or absence of falsification on image data without setting a secure region in the drive recorder.SOLUTION: A falsification determining method according to an embodiment calculates a first hash value based on a first hash initial value calculated in accordance with an initial value setting rule from the running data of a vehicle, and on picked-up image, stores the picked-up image, the initial value setting rule, and the first hash value in association with each other in an image storing device, and stores the running data in a running data storing device. When a falsification is determined, a second hash value is calculated based on a second hash initial value calculated based on the initial value setting rule stored in the image storing device, on the running data stored in the running data storing device, and on the picked-up image, and the falsification on the picked-up image is determined by comparing the first hash value with the second hash value.SELECTED DRAWING: Figure 9

Description

[Technical Field]

[0001] The present invention relates to a tampering determination method, an image storage method, a program, an image storage device, and a tampering determination system. [Background technology]

[0002] Conventionally, in order to detect tampering of acquired data, a technology is known in which a hash value is calculated based on initial data and the acquired data to be protected, and the calculated hash value is linked to the acquired data and stored (for example, Patent Document 1).

[0003] When checking the stored acquired data, the hash value is calculated again using the acquired data, making it possible to detect whether the acquired data has been tampered with. Specifically, if the stored acquired data has not been tampered with, the hash value calculated using the initial data and the acquired data will be equal to the stored hash value. On the other hand, if the stored acquired data has been tampered with, the hash value calculated using the initial data and the acquired data will be different from the stored hash value. In this way, by comparing the hash values, it is possible to detect whether the acquired data has been tampered with.

[0004] Image data stored in an image storage device such as a drive recorder is used as evidence of an accident or the like. For this reason, it is conceivable that the image data stored by the drive recorder is stored in the drive recorder together with a hash value. In this case, it is desirable that the hash value be stored in a secure area of ​​the drive recorder to prevent tampering with the hash value. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Patent Publication No. 2021-61576 Summary of the Invention [Problem to be solved by the invention]

[0006] However, when a secure area is provided in an image storage device such as a drive recorder to store hash values, a relatively expensive storage device corresponding to the secure area is required, which increases the cost of the image storage device.

[0007] The present invention has been made in view of the above, and an object of the present invention is to make it possible to detect whether image data has been tampered with without providing a secure area in an image storage device. [Means for solving the problem]

[0008] A tampering determination method according to one aspect of the embodiment is a tampering determination method for determining whether a captured image has been tampered with, the captured image having been captured by a camera mounted on a vehicle and stored in an image storage device. The tampering determination method acquires vehicle driving data, calculates a first hash initial value from the driving data in accordance with an initial value setting rule, calculates the first hash value based on the captured image and the first hash initial value, and stores the captured image, the initial value setting rule, and the first hash value in association with each other in the image storage device. The tampering determination method stores the driving data in a driving data storage device that is a separate device from the image storage device. When determining whether the captured image has been tampered with, the tampering determination method calculates a second hash initial value based on the initial value setting rule stored in the image storage device and the driving data stored in the driving data storage device, calculates a second hash value based on the captured image stored in the image storage device and the second hash initial value, and determines whether the captured image stored in the image storage device has been tampered with by comparing the first hash value and the second hash value stored in the image storage device. [Effects of the Invention]

[0009] According to one aspect of the embodiment, after calculating a first hash value corresponding to a captured image, the first hash initial value is deleted from the image storage device. To tamper with the first hash value in conjunction with tampering with the captured image, the already deleted first hash initial value is required. Therefore, it is not possible to calculate a hash value corresponding to a tampered captured image (a hash value that can be determined to be free of tampering). This prevents tampering. Furthermore, when determining whether or not a captured image has been tampered with, a second hash initial value (the same value as the first hash initial value) is calculated from the driving data acquired from the driving data storage device and the initial value setting rule, and the second hash value is calculated using the second hash initial value and the image to be determined. Then, by comparing the second hash value with the first hash value stored in the image storage device, it is possible to determine whether or not a captured image has been tampered with. Therefore, it is possible to determine whether or not a captured image has been tampered with without providing a secure area in the image storage device. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 1 is a diagram showing a tampering determination system according to an embodiment. [Figure 2] FIG. 2 is a block diagram of the vehicle-mounted device according to the embodiment. [Figure 3] FIG. 3 is a block diagram of the drive recorder according to the embodiment. [Figure 4] FIG. 4 is a diagram showing an example of the first hash initial value, protected image data, and the first hash value. [Figure 5] FIG. 5 is a diagram showing an event occurrence database stored in a storage medium. [Figure 6] FIG. 6 is a block diagram of a server device according to the embodiment. [Figure 7] FIG. 7 is a diagram showing a traveling database stored in the storage unit. [Figure 8] FIG. 8 is a block diagram of a terminal device according to the embodiment. [Figure 9]FIG. 9 is a diagram showing data generation when protected image data is stored in a storage medium of a drive recorder. [Figure 10] FIG. 10 is a diagram for explaining the process of determining whether or not the protected image data has been tampered with. [Figure 11] FIG. 11 is a flowchart illustrating the storage process of protected image data according to this embodiment. [Figure 12] FIG. 12 is a flowchart illustrating the tampering determination process according to the embodiment. [Figure 13] FIG. 13 is a diagram for explaining the occurrence of a specific event. DETAILED DESCRIPTION OF THE INVENTION

[0011] Hereinafter, a tampering determination method, an image storage method, a program, an image storage device, and a tampering determination system according to embodiments will be described in detail with reference to the accompanying drawings. Note that the present invention is not limited to the present embodiments.

[0012] A tampering determination system 1 according to an embodiment will be described with reference to Fig. 1. Fig. 1 is a diagram showing the tampering determination system 1 according to an embodiment. The tampering determination system 1 determines whether or not a captured image to be protected has been tampered with.

[0013] The tampering determination system 1 includes an in-vehicle device 2, a drive recorder 3 (image storage device), a server device 4 (driving data storage device), and a terminal device 5. The in-vehicle device 2 and the server device 4 are communicatively connected via a network N1 such as the Internet. The server device 4 and the terminal device 5 are communicatively connected via a network N2 such as the Internet. The in-vehicle device 2 and the drive recorder 3 are provided in a vehicle.

[0014] Next, the vehicle-mounted device 2 will be described with reference to Fig. 2. Fig. 2 is a block diagram of the vehicle-mounted device 2 according to the embodiment. The vehicle-mounted device 2 includes a communication unit 10, a storage unit 11, and a controller 12.

[0015] Here, the configuration and processing related to determining whether the protected image data of the in-vehicle device 2 has been tampered with will be described, and descriptions of other configurations will be omitted. The protected image data is an image captured by a camera 30 (see FIG. 3) mounted on the vehicle. The in-vehicle device 2 is a device different from the device that controls the vehicle's driving, but the controller 12 may control the vehicle's driving. The driving control includes, for example, control of devices such as the engine that generate driving force for the vehicle, control of a steering actuator that adjusts the steering angle of the vehicle, and control of a brake device that generates braking force for the vehicle.

[0016] The communication unit 10 is realized by a network adapter or the like. The communication unit 10 is a communication interface that is connected to the network N1 (see FIG. 1) so as to be capable of two-way communication, and transmits and receives any signals and information to and from the server device 4. The communication unit 10 may not be built into the vehicle-mounted device 2.

[0017] The storage unit 11 is configured to include a volatile memory and a non-volatile memory. The volatile memory may include, for example, a RAM (Random Access Memory). The non-volatile memory may include, for example, a ROM (Read Only Memory) or a flash memory. The non-volatile memory stores computer-readable programs and data. Note that at least a portion of the programs and data stored in the non-volatile memory may be obtained from another wirelessly connected computer device or a portable recording medium. The storage unit 11 stores the vehicle's on-board ID (Identification). The on-board ID is an identifier that identifies the vehicle. The on-board ID is set for each vehicle.

[0018] The controller 12 receives vehicle driving data from various sensors such as the vehicle speed sensor 20 via the in-vehicle network 6. The driving data includes information that changes as the vehicle drives, specifically, information that changes over time as the vehicle drives. For example, the driving data includes information related to the vehicle speed, steering angle, acceleration, and current position of the vehicle, as well as information on the time when the vehicle speed, etc., was detected. The driving data is not limited to these pieces of information. The in-vehicle network 6 includes, for example, a CAN (Controller Area Network) and an AVCLAN (Audio Visual Communication Local Area Network).

[0019] The controller 12 receives information relating to the vehicle speed from a vehicle speed sensor 20. The controller 12 receives information relating to the steering angle of the vehicle from a steering angle sensor 21. The controller 12 receives information relating to the acceleration of the vehicle from an acceleration sensor 22. The controller 12 receives information relating to the current position of the vehicle from a GPS (Global Positioning System) device 23.

[0020] The controller 12 transmits the driving data to the drive recorder 3 (see FIG. 1) via the in-vehicle network 6.

[0021] The controller 12 is a component equivalent to a so-called processor or control unit. The controller 12 is realized by a CPU (Central Processing Unit), an MPU (Micro Processing Unit), or the like executing various programs stored in the storage unit 11 using RAM as a work area. The controller 12 can also be realized by an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array).

[0022] The controller 12 links the driving data acquired from various sensors (vehicle speed sensor 20, steering angle sensor 21, acceleration sensor 22, GPS device 23) with the vehicle ID stored in the memory unit 11 and transmits the data to the server device 4 via the communication unit 10.

[0023] Next, the drive recorder 3 will be described with reference to Fig. 3. Fig. 3 is a block diagram of the drive recorder 3 according to the embodiment. The drive recorder 3 includes a camera 30, a communication unit 31, a storage unit 32, and a controller 33 (first controller).

[0024] The camera 30 photographs the exterior of the vehicle. Specifically, the camera 30 photographs the front side of the vehicle. The camera 30 may photograph the rear side of the vehicle in addition to the front side of the vehicle. Furthermore, the camera 30 may photograph the interior of the vehicle in addition to the front side of the vehicle. A plurality of cameras 30 may be provided.

[0025] The communication unit 31 is realized by a network adapter or the like. The communication unit 31 receives driving data from the in-vehicle device 2 (see FIG. 1) via the in-vehicle network 6. The communication unit 31 may also receive driving data from various sensors via the in-vehicle network 6.

[0026] The storage unit 32 is configured to include a volatile memory and a non-volatile memory. The volatile memory may include, for example, a RAM. The non-volatile memory may include, for example, a ROM or a flash memory. The non-volatile memory stores computer-readable programs and data. Note that at least a portion of the programs and data stored in the non-volatile memory may be obtained from another wirelessly connected computer device or a portable recording medium. The storage unit 32 stores the vehicle's on-board ID and an initial value setting rule. The initial value setting rule will be described later.

[0027] The storage unit 32 includes a storage medium 32a, such as an SD card that is detachable from the drive recorder 3. The storage medium 32a stores image data captured by the camera 30. Furthermore, if a specific event such as an accident or a near miss is detected while the vehicle is running, the storage medium 32a stores an initial value setting rule and a first hash value in association with the protected image data. The initial value setting rule, the first hash value, and the protected image data will be described later.

[0028] The controller 33 is a component equivalent to a so-called processor or control unit. The controller 33 is realized by a CPU, an MPU, or the like executing various programs stored in the storage unit 32 using the RAM as a work area. The controller 33 can also be realized by an integrated circuit such as an ASIC or an FPGA.

[0029] The controller 33 acquires image data from the camera 30. The controller 33 acquires driving data from the in-vehicle device 2 via the communication unit 31. The driving data is not stored in the drive recorder 3. Specifically, if the occurrence of a specific event is detected, the driving data is used to calculate a first hash initial value, which will be described later, and then deleted from the drive recorder 3. Furthermore, if the occurrence of a specific event is not detected, the driving data is deleted from the drive recorder 3. Note that the driving data not being stored in the drive recorder 3 includes the driving data being temporarily stored in the drive recorder 3 for purposes such as calculating a first hash initial value.

[0030] The controller 33 stores image data for a certain period of time (for example, 24 hours' worth) in the storage medium 32a. Furthermore, when the controller 33 detects the occurrence of a specific event, it sets the image data for a certain period of time before and after the detection time stored in the storage medium 32a to be overwrite-protected. In other words, when the controller 33 detects the occurrence of a specific event, it stores the image data for a certain period of time before and after the detection time in the storage medium 32a as protected image data to be protected.

[0031] For example, the controller 33 detects the occurrence of a specific event when the acceleration of the vehicle exceeds a predetermined acceleration. The predetermined acceleration is a determination threshold for determining whether an accident has occurred, and is set to an acceleration slightly lower than the acceleration that occurs when an accident occurs or when the brakes are applied suddenly. However, the conditions for detecting the occurrence of a specific event are not limited to this.

[0032] When the controller 33 detects the occurrence of a specific event, it calculates a first hash initial value. The controller 33 calculates the first hash initial value from the driving data in accordance with the initial value setting rule. That is, the first hash initial value is calculated from the driving data acquired by the drive recorder 3 in accordance with the initial value setting rule. The initial value setting rule is set in advance and stored in the storage unit 32. The initial value setting rule is a rule for calculating the value of the driving data when the specific event occurs as the hash initial value.

[0033] For example, the initial value setting rule is set as a rule that calculates the time when the specific event occurred and the value of the vehicle speed at the time when the specific event occurred as the hash initial value. In this case, the controller 33 calculates the time when the specific event occurred and the value of the vehicle speed at the time when the specific event occurred as the first hash initial value.

[0034] The type of driving data used in the initial value setting rule may be set for each drive recorder 3 (vehicle). For example, in one drive recorder 3, the type of driving data used in the initial value setting rule is vehicle speed. In another drive recorder 3, the type of driving data used in the initial value setting rule is steering angle. These values ​​may be processed using a predetermined arithmetic expression or the like to calculate the first hash initial value.

[0035] The initial value setting rule may be changed at predetermined time intervals. For example, the type of driving data used in the initial value setting rule is changed at predetermined time intervals by selecting one of the vehicle speed, steering angle, and current vehicle position.

[0036] The controller 33 calculates a first hash value from the first hash initial value and the protected image data. The controller 33 calculates the first hash value by performing a hash calculation using a preset hash algorithm. In this way, the first hash value is calculated from the first hash initial value and the protected image data.

[0037] Here, the relationship between the first hash initial value, protected image data, and first hash value will be described with reference to Fig. 4. Fig. 4 is a diagram showing an example of the first hash initial value, protected image data, and first hash value. Note that each first hash initial value in Fig. 4 indicates "year / month / day / hour / minute / value of type of traveling data." In addition, it is assumed here that the type of traveling data is vehicle speed.

[0038] Since the hash algorithm is a calculation process using the first hash initial value and the protected image data, the calculated hash values ​​will not be the same unless both the first hash initial value and the protected image data are the same. If they are not, the calculated hash values ​​will only be the same with an extremely low probability. For example, if the time when the occurrence of a specific event is detected is 12:30 on October 11, 2023, and the vehicle speed is 65 km / h, the first hash initial value will be "20231011123065." Similarly, if the time when the occurrence of a specific event is detected is 8:50 on September 18, 2023, and the vehicle speed is 65 km / h, the first hash initial value will be "20230918085065."

[0039] For example, in the first example where the first hash initial value is "20231011123065" and the protected image data is "A", the first hash value becomes, for example, "A1B3Grt8" by processing each of these data using the set hash algorithm.

[0040] Also, for example, in the case of a second example in which the first hash initial value is the same as in the first example, "20231011123065," and the protected image data is "B," which is different from "A" in the first example, processing using the same hash algorithm results in the first hash value of the second example being a value different from that of the first example, for example, "Gt87tig7."

[0041] In this way, even if the first hash initial value is the same, if the protected image data is different, a different first hash value is calculated.

[0042] Also, for example, in the case of a third example in which the first hash initial value is "20230918085065" which is different from the first example, and the protected image data to be protected is "A" which is the same as the first example, by processing using the same hash algorithm, the first hash value of the third example will be a value different from that of the first example, for example, "9Higt23S".

[0043] In this way, even if the protected image data is the same, if the first hash initial value is different, a different first hash value will be calculated.

[0044] Returning to FIG. 3 , after calculating the first hash value, the controller 33 deletes the first hash initial value from the drive recorder 3. In addition, the driving data acquired from the in-vehicle device 2 is also deleted from the drive recorder 3. Specifically, after the first hash value is calculated, the driving data is deleted from the drive recorder 3. In other words, after the first hash value is calculated, the first hash initial value related to the calculation of the first hash value and the driving data are no longer stored in the drive recorder 3.

[0045] The controller 33 associates the first hash value, the event occurrence time, and the initial value setting rule with the protected image data, and stores them in the storage medium 32a. The controller 33 also associates the protected image data and the like with the in-vehicle ID, and stores them in the storage medium 32a.

[0046] Specifically, when a specific event occurs, the controller 33 generates an event ID for the specific event. Then, the controller 33 associates the generated event ID with the protected image data, the first hash value, the time of the event occurrence, and the initial value setting rule, and stores the associated event ID in the storage medium 32a.

[0047] For example, the storage medium 32a stores an event occurrence database 60 shown in Fig. 5. Fig. 5 is a diagram showing the event occurrence database 60 stored in the storage medium 32a.

[0048] For example, if a specific event occurs at time "T-1" in a vehicle with an in-vehicle ID of "A001," an event ID of "D-1" is generated. For example, the initial value setting rule is "xxxx," the protected image data is "A-1," and the first hash value is "H-1." In this case, the in-vehicle ID "A001" and the event ID "D-1" are stored in association with the protected image data "A-1," the event occurrence time "T-1," the first hash value "H-1," and the initial value setting rule "xxxx."

[0049] In addition, if a specific event occurs at time "T-4" in a vehicle with an in-vehicle ID of "A001," an event ID of "D-4" is generated. For example, the initial value setting rule is "xxxx," the protected image data is "A-4," and the first hash value is "H-4." In this case, the in-vehicle ID "A001" and the event ID "D-4" are associated with the protected image data "A-4," the event occurrence time "T-4," the first hash value "H-4," and the initial value setting rule "xxxx." Note that the occurrence time of the specific event may also be set as the event ID.

[0050] In this way, when the drive recorder 3 detects the occurrence of a specific event, it stores the protected image data, the first hash value, the event occurrence time, and the initial value setting rule in the storage medium 32a. The event occurrence time may be included in the metadata of the protected image data.

[0051] Next, the server device 4 will be described with reference to FIG. 6. FIG. 6 is a block diagram of the server device 4 according to the embodiment. The server device 4 includes a communication unit 40, a storage unit 41, and a controller 42. The server device 4 acquires driving data from each vehicle and stores the driving data of each vehicle. The driving data of each vehicle stored in the server device 4 is used to provide various services such as traffic congestion prediction.

[0052] The server device 4 has a more secure area than the drive recorder 3 (see FIG. 1). That is, the server device 4 has a more secure protection function against external attacks than the drive recorder 3. For example, the server device 4 has a storage unit 41 that is more secure than the drive recorder 3.

[0053] The server device 4 can be accessed from the terminal device 5 of a user who has a specific authority. In other words, the server device 4 cannot be accessed from the terminal device 5 of a user who does not have the specific authority. A user who has the specific authority is, for example, a user who has a password that allows access to the server device 4. The specific authority may be given to, for example, the IP address of the terminal device 5. In other words, a terminal device 5 having an IP address that has been given the specific authority can access the server device 4.

[0054] The communication unit 40 is realized by a network adapter or the like, and is a communication interface that is connected to the network N1 (see FIG. 1) and the network N2 (see FIG. 1) so as to enable two-way communication via wire or wirelessly. The communication unit 40 is capable of transmitting and receiving signals and information to and from the in-vehicle device 2 via the network N1. The communication unit 40 is capable of transmitting and receiving signals and information to and from the terminal device 5 (see FIG. 1) via the network N2.

[0055] The communication unit 40 receives the driving data from the vehicle-mounted device 2. The communication unit 40 receives the driving data for each vehicle. The driving data transmitted from each vehicle is linked to the vehicle ID of each vehicle and transmitted from the vehicle-mounted device 2 of each vehicle.

[0056] The communication unit 40 receives a signal (hereinafter referred to as a "traveling data request signal") requesting transmission of vehicle travel data from the terminal device 5. The traveling data request signal includes the vehicle's on-board ID. The traveling data request signal also includes information specifying the travel data corresponding to the initial value setting rule.

[0057] For example, if the initial value setting rule is a rule that calculates the time when a specific event occurred and the value of the vehicle speed at the time when the specific event occurred as a hash value, the information that identifies the driving data that matches these conditions is included in the driving data request signal. The information that identifies the driving data is, for example, the time when the specific event occurred and the driving data type (vehicle speed information).

[0058] The storage unit 41 is configured to include a volatile memory and a non-volatile memory. The volatile memory may include, for example, a RAM. The non-volatile memory may include, for example, a ROM, a flash memory, or a hard disk drive. The non-volatile memory stores computer-readable programs and data. Note that at least a portion of the programs and data stored in the non-volatile memory may be obtained from another wirelessly connected computer device or a portable recording medium. The storage unit 41 stores the driving data received via the communication unit 40. The storage unit 41 stores the driving data for each vehicle ID. The driving data is stored in a secure area of ​​the server device 4.

[0059] The controller 42 is a component equivalent to a so-called processor or control unit. The controller 42 is realized by a CPU, an MPU, or the like executing various programs stored in the storage unit 41 using the RAM as a work area. The controller 42 can also be realized by an integrated circuit such as an ASIC or an FPGA.

[0060] The controller 42 acquires driving data from each vehicle via the communication unit 40. The controller 42 stores the driving data for each vehicle ID in the storage unit 41 according to the vehicle ID linked to the acquired driving data. That is, the controller 42 stores the driving data acquired from multiple vehicles in the storage unit 41 for each vehicle, specifically for each vehicle ID. The driving data is stored for each time the driving data was acquired by the vehicle-mounted device 2.

[0061] When the controller 42 acquires the traveling data, the controller 42 generates a traveling data ID for the traveling data, and stores in the storage unit 41 a data record in which the traveling data is linked to the generated traveling data ID.

[0062] For example, the storage unit 41 stores a traveling database 61 shown in Fig. 7. Fig. 7 is a diagram showing the traveling database 61 stored in the storage unit 41.

[0063] For example, if driving data is acquired at time "T-1" from a vehicle with an in-vehicle ID "A001," a driving data ID of "A001-1" is generated. The acquired driving data (time "T-1," vehicle speed "V1," steering angle "R1," acceleration "G1," and position "P1") are linked and stored with the in-vehicle ID "A001" and the driving data ID "A001-1."

[0064] Furthermore, if driving data is acquired at time "T-2" from a vehicle with an in-vehicle ID of "A001," a driving data ID of "A001-2" is generated. The acquired driving data (time "T-2," vehicle speed "V2," steering angle "R2," acceleration "G2," and position "P2") are linked and stored with the in-vehicle ID "A001" and the driving data ID "A001-2."

[0065] Furthermore, when driving data is acquired at time "T-1" from a vehicle with an in-vehicle ID "A002," "A002-1" is generated as the driving data ID. The acquired driving data (time "T-1," vehicle speed "V1," steering angle "R2," acceleration "G3," and position "P3") are linked and stored with the in-vehicle ID "A002" and the driving data ID "A002-1."

[0066] The controller 42 acquires the driving data request signal via the communication unit 40. Based on the driving data request signal, the controller 42 reads driving data from the storage unit 41. Specifically, the controller 42 reads from the storage unit 41 the driving data of a data record having an in-vehicle ID and a time that match the in-vehicle ID and the event occurrence time included in the driving data request signal. Then, based on the information identifying the driving data included in the driving data request signal, the controller 42 identifies the driving data that corresponds to the initial value setting rule from the read driving data.

[0067] Specifically, if the information identifying the driving data is, for example, a vehicle ID, a time when a specific event occurred (driving data ID (identifying a data record)), and a driving data type (vehicle speed information) (identifying a data type), the controller 42 identifies the vehicle speed as the driving data corresponding to the initial value setting rule from among the driving data stored in the data record identified by the vehicle ID and the time when the specific event occurred.

[0068] For example, if the information identifying the traveling data is a vehicle ID "A001," a specific event occurrence time "T-1," and the traveling data type is vehicle speed, the controller 42 identifies a data record by the vehicle ID "A001" and the time "T1" from the traveling database 61. Then, the controller 42 identifies the vehicle speed "V1" from the identified data record as the traveling data corresponding to the initial value setting rule.

[0069] The controller 42 transmits the travel data identified based on the travel data request signal to the terminal device 5 via the communication unit 40.

[0070] The controller 42 may transmit a somewhat limited range of driving data to the terminal device 5 without completely identifying the driving data corresponding to the initial value setting rule. In this case, the driving data corresponding to the initial value setting rule is identified by the terminal device 5. For example, data of a data record having an on-board ID that matches the on-board ID included in the driving data request signal may be transmitted to the terminal device 5, and the terminal device 5 may identify the necessary driving data based on the time the specific event occurred and the type of driving data.

[0071] Next, the terminal device 5 according to the embodiment will be described with reference to Fig. 8. Fig. 8 is a block diagram of the terminal device 5 according to the embodiment.

[0072] The terminal device 5 includes a laptop PC (Personal Computer), a desktop PC, a smartphone, a tablet device, a PDA (Personal Digital Assistant), etc. The terminal device 5 detects tampering of the protected image data stored by the drive recorder 3. The terminal device 5 includes a communication unit 50, a reading unit 51, a display unit 52, a storage unit 53, and a controller 54 (second controller).

[0073] The communication unit 50 is realized by a network adapter, etc. The communication unit 50 is connected to the network N2 (see FIG. 1) by wire or wirelessly, and is capable of transmitting and receiving signals and information to and from the server device 4 (see FIG. 1) via the network N2.

[0074] When the storage medium 32a (see FIG. 3) is inserted, the reading unit 51 reads information stored in the storage medium 32a from the storage medium 32a. The reading unit 51 is, for example, a card reader. Note that the reading unit 51 may be an external device separate from the terminal device 5.

[0075] The display unit 52 is, for example, a liquid crystal display panel, etc. The display unit 52 displays the protected image data, etc.

[0076] The storage unit 53 is configured to include a volatile memory and a non-volatile memory. The volatile memory may include, for example, a RAM. The non-volatile memory may include, for example, a ROM, a flash memory, or a hard disk drive. The non-volatile memory stores computer-readable programs and data. Note that at least some of the programs and data stored in the non-volatile memory may be obtained from another computer device or a portable recording medium connected wirelessly.

[0077] The controller 54 is a component equivalent to a so-called processor or control unit. The controller 54 is realized by a CPU, an MPU, or the like executing various programs stored in the storage unit 53 using the RAM as a work area. The controller 54 can also be realized by an integrated circuit such as an ASIC or an FPGA.

[0078] Note that a part or all of the processing in the controller 54 described below is executed based on the user's operation of an operation unit (not shown) when the storage medium 32a is inserted into the reading unit 51. A part or all of the processing in the controller 54 may be automatically executed by the controller 54 when the storage medium 32a is inserted into the reading unit 51, without the user's operation of the operation unit.

[0079] The controller 54 acquires the information stored in the storage medium 32a from the storage medium 32a read by the reading unit 51. Specifically, the controller 54 acquires the initial value setting rule, the first hash value, and the protected image data from the storage medium 32a. The controller 54 also acquires the in-vehicle ID from the storage medium 32a.

[0080] Note that data for multiple specific events may be stored in the event occurrence database 60 of the storage medium 32a. Therefore, specifically, when the user specifies protected image data for which tampering is to be checked, the controller 54 obtains each piece of information for the specified protected image data.

[0081] The controller 54 generates a driving data request signal. The driving data request signal includes the vehicle's on-board ID, the protected image to be checked (specifically, the corresponding event occurrence time), and information specifying the driving data corresponding to the initial value setting rule. The controller 54 generates the driving data request signal based on the acquired on-board ID, event occurrence time, and initial value setting rule. For example, if the driving data used to calculate the hash initial value based on the initial value setting rule is the vehicle speed value at the time a specific event occurred, the controller 54 generates a driving data request signal requesting the vehicle speed value in a data record that matches the on-board ID and event occurrence time. The controller 54 transmits the generated driving data request signal to the server device 4 via the communication unit 50.

[0082] The controller 54 receives the driving data from the server device 4 via the communication unit 50. Specifically, the controller 54 acquires the driving data identified by the server device 4 based on the driving data request signal from the server device 4. The driving data acquired from the server device 4 is the same as the driving data used by the drive recorder 3 to calculate the first hash initial value.

[0083] For example, suppose protected image data for an event occurrence time "T-1" is checked in the storage medium 32a storing the event occurrence database 60 shown in Figure 5. The initial value setting rule "xxxx" is the event occurrence time and the vehicle speed at the event occurrence time. In this case, the traveling data request signal includes information specifying the vehicle ID "A001", the event occurrence time "T-1", and the vehicle speed.

[0084] When the driving data request signal is sent to the server device 4, the server device 4 determines the vehicle speed "V1" from the data record for the vehicle ID "A001" at time "T-1" based on the driving database 61 shown in Figure 7.

[0085] Then, the controller 54 receives the driving data of the vehicle speed "V1" at the time "T-1" from the server device 4. In this way, the controller 54 acquires the driving data of the vehicle speed "V1" at the vehicle ID "A001" and the event occurrence time "T-1".

[0086] The controller 54 calculates the second hash initial value in accordance with the initial value setting rule from the driving data acquired from the server device 4. The driving data acquired from the server device 4 is the same as the driving data used to calculate the first hash initial value in the drive recorder 3. Therefore, the second hash initial value is calculated to be the same value as the first hash initial value.

[0087] The controller 54 calculates a second hash value from the second hash initial value and the protected image data obtained from the drive recorder 3 and corresponding to the driving data obtained from the server device 4. Specifically, the controller 54 calculates the second hash value from the second hash initial value and the corresponding protected image data obtained from the storage medium 32a. The controller 54 calculates the second hash value by performing a hash calculation using a preset hash algorithm. Note that the hash algorithm used to calculate the second hash value is the same as the hash algorithm used to calculate the first hash value.

[0088] The controller 54 determines whether the second hash value matches the first hash value. The second hash initial value is equal to the first hash initial value. Therefore, if the protected image data obtained from the storage medium 32a is the same as the protected image data used to calculate the first hash value, the second hash value matches the first hash value. Therefore, if the first hash value and the second hash value match, the controller 54 determines that the protected image data has not been tampered with. In other words, the controller 54 detects that the protected image data has not been tampered with.

[0089] On the other hand, if the protected image data retrieved from the storage medium 32a is not identical to the protected image data used to calculate the first hash value, the second hash value will not match the first hash value. Therefore, if the first hash value and the second hash value do not match, the controller 54 determines that the protected image data has been tampered with. In other words, the controller 54 detects that the protected image data has been tampered with.

[0090] Next, data generation in the tampering determination system 1 will be described with reference to Fig. 9. Fig. 9 is a diagram showing data generation when protected image data is stored in the storage medium 32a of the drive recorder 3.

[0091] When protected image data (images relating to a specific event that has occurred) is stored in the storage medium 32a, the driving data at the time the event occurred is transmitted from the in-vehicle device 2 to the drive recorder 3. The driving data at the time the event occurred is also transmitted from the in-vehicle device 2 to the server device 4 via the network N1. The drive recorder 3 sets a first hash initial value from the driving data in accordance with the initial value setting rule. The drive recorder 3 then calculates a first hash value from the first hash initial value and the protected image data. Note that, for each event that occurs, corresponding protected image data is generated, and the required data is stored in each device as described above.

[0092] After the first hash value is calculated, the drive recorder 3 associates the event ID with the protected image data, the event occurrence time, the first hash value, and the initial value setting rule, and stores them in the storage medium 32a, as shown in Fig. 5. In addition, the driving data and the first hash initial value are deleted from the drive recorder 3.

[0093] Next, the tampering determination in the tampering determination system 1 will be described with reference to Fig. 10. Fig. 10 is a diagram for explaining the tampering determination of protected image data.

[0094] When the protected image data is to be checked, the user or the like inserts the storage medium 32a into the terminal device 5. The terminal device 5 acquires the initial value setting rule, the first hash value, and the protected image data from the storage medium 32a. Note that these processes are performed for the protected image for which the user wants to check whether it has been tampered (for example, the protected image is specified by the user through an operation or the like). Specifically, as shown in FIG. 10, the terminal device 5 acquires the initial value setting rule, the first hash value, and the protected image data from the storage medium 32a. The terminal device 5 also acquires the driving data (at the time of the occurrence of the relevant event) corresponding to the protected image from the server device 4 via the network N2. Note that the server device 4 transmits the driving data based on the driving data request signal to the terminal device 5.

[0095] The terminal device 5 calculates a second hash initial value from the driving data acquired from the server device 4 in accordance with the initial value setting rule. Then, the terminal device 5 calculates a second hash value from the second hash initial value and the protected image data. The terminal device 5 compares the first hash value with the second hash value, and if the first hash value and the second hash value do not match, it determines that the protected image data has been tampered with. In other words, tampering of the protected image data is detected. On the other hand, if the first hash value and the second hash value match, it determines that the protected image data has not been tampered with.

[0096] Next, the storage process of protected image data according to this embodiment will be described with reference to Fig. 11. Fig. 11 is a flowchart illustrating the storage process of protected image data according to this embodiment. The storage process of protected image data is executed by the drive recorder 3. This process starts when the ignition of the vehicle is turned on and the drive recorder 3 is started, and is executed repeatedly until the ignition of the vehicle is turned off.

[0097] The controller 33 acquires the driving data from the vehicle-mounted device 2 (S100). The driving data is also transmitted from the vehicle-mounted device 2 to the server device 4 via the network N1. That is, the same driving data as that acquired by the drive recorder 3 is also transmitted to the server device 4. The driving data is stored in the server device 4 together with the vehicle ID of the vehicle from which the driving data was acquired (the vehicle ID of the vehicle) and the time data of the acquisition of the driving data.

[0098] The controller 33 stores image data in the storage medium 32a (S101). Specifically, the controller 33 stores image data captured by the camera 30 in the storage medium 32a. The controller 33 stores the image data in a captured image recording area in the storage medium 32a. When there is no free storage capacity in the captured image recording area of ​​the storage medium 32a, the controller 33 overwrites the oldest image data with newly acquired image data and stores the newly acquired image data in the storage medium 32a.

[0099] Next, the controller 33 determines whether or not the occurrence of a specific event has been detected (S102). For example, the controller 33 detects the occurrence of a specific event when the acceleration of the vehicle is equal to or greater than a predetermined acceleration.

[0100] If the controller 33 has not detected the occurrence of a specific event (S102: No), the controller 33 returns to step S100 and repeats the above processing.

[0101] When the controller 33 detects the occurrence of a specific event (S102: Yes), the controller 33 stores the protected image data in a state protected from image deletion processing (S103). Specifically, the controller 33 sets image data for a certain period of time before and after the detection of the occurrence of the specific event as protected image data and prohibits it from being overwritten. As a result, the controller 33 stores the protected image data in the storage medium 32a in a state protected from image deletion processing.

[0102] Next, the controller 33 calculates a first hash initial value (S104). The controller 33 calculates the first hash initial value from the driving data (driving data when the specific event occurred) in accordance with the initial value setting rule. For example, the controller 33 calculates the time when the specific event occurred and the value of the vehicle speed at the time when the specific event occurred as the first hash initial value.

[0103] Next, the controller 33 calculates a first hash value (S105). The controller 33 calculates the first hash value from the first hash initial value and the protected image data. The controller 33 performs a hash calculation to calculate the first hash value from the first hash initial value and the protected image data.

[0104] Next, the controller 33 deletes the first hash initial value and the driving data (S106). That is, after calculating the first hash value, the controller 33 deletes the first hash initial value from the drive recorder 3. As a result, the drive recorder 3 is put into a state where the first hash initial value and the driving data are not stored.

[0105] Next, the controller 33 associates the first hash value, the event occurrence time, and the initial value setting rule with the protected image data and stores them in the storage medium 32a (S107). The storage medium 32a also stores the vehicle ID and the event ID. Therefore, the storage medium 32a stores the protected image data, the first hash value, the event occurrence time, and the initial value setting rule in association with the vehicle ID and the event ID.

[0106] Next, the tampering determination process according to the embodiment will be described with reference to Fig. 12. Fig. 12 is a flowchart illustrating the tampering determination process according to the embodiment. The tampering determination process is executed by the terminal device 5. The tampering determination is started, for example, when the storage medium 32a of the drive recorder 3 is inserted into the reading unit 51 and the protected image data for which the user wishes to check the tampering determination is designated. That is, the tampering determination process is executed on the protected image data for which the user wishes to check the tampering determination.

[0107] The controller 54 acquires the information stored in the storage medium 32a from the storage medium 32a (S200). Specifically, the controller 54 acquires the protected image data for which the user has confirmed the tampering determination, the event occurrence time, the first hash value, and the initial value setting rule. That is, the controller 54 acquires the protected image data, the first hash value, the event occurrence time, and the initial value setting rule from the drive recorder 3 (see FIG. 1). The controller 54 also acquires the vehicle's on-board ID. When an operation is performed to specify the protected image data for which the user wishes to confirm the tampering determination, the controller 54 acquires the protected image data for which the user wishes to confirm the tampering determination, the event occurrence time, the first hash value, and the initial value setting rule from the storage medium 32a.

[0108] Next, the controller 54 generates a driving data request signal corresponding to the protected image data for which the user wants to check the tampering determination, based on the initial value setting rule (S201). The controller 54 generates the driving data request signal (including information on the vehicle ID, the event occurrence time, and the driving data type) for identifying the driving data based on the initial value setting rule.

[0109] Next, the controller 54 transmits a driving data request signal to the server device 4 (S202). The controller 54 transmits the driving data request signal to the server device 4 via the communication unit 50.

[0110] Next, the controller 54 acquires the driving data from the server device 4 (S203). The controller 54 acquires the driving data via the communication unit 50. Specifically, the controller 54 acquires the driving data identified based on the initial value setting rule corresponding to the protected image data for which the user wishes to check the tampering determination. The controller 54 acquires from the server device 4 the same driving data as the driving data for which the drive recorder 3 has calculated the first hash initial value corresponding to the protected image data for which the user wishes to check the tampering determination.

[0111] Next, the controller 54 calculates a second hash initial value (S204). Specifically, the controller 54 calculates the second hash initial value from the driving data acquired from the server device 4 in accordance with the initial value setting rule acquired from the drive recorder 3. Note that the driving data used to calculate the second hash initial value is driving data corresponding to the protected image data for which the user wants to check the tampering determination, and is the same as the driving data used to calculate the first hash initial value in the drive recorder 3. Therefore, the second hash initial value is calculated to be the same value as the first hash initial value.

[0112] Next, the controller 54 calculates a second hash value (S205). Specifically, the controller 54 calculates the second hash value from the second hash initial value and the protected image data acquired from the drive recorder 3. The controller 54 performs a hash calculation to calculate the second hash value from the second hash initial value and the protected image data.

[0113] Next, the controller 54 determines whether the second hash value matches the first hash value obtained from the drive recorder 3 and corresponding to the protected image for which the user wants to check whether the image has been tampered with (S206). The second hash initial value is the same as the first hash initial value. Therefore, if the protected image data obtained from the drive recorder 3 has not been tampered with, the second hash value matches the first hash value.

[0114] If the second hash value matches the first hash value (S206: Yes), the controller 54 detects that the protected image data obtained from the drive recorder 3 has not been tampered with (S207). In other words, the controller 54 determines that the protected image data has not been tampered with.

[0115] If the second hash value does not match the first hash value (S206: No), the controller 54 detects whether the protected image data obtained from the drive recorder 3 has been tampered with (S208). That is, the controller 54 determines that the protected image data has been tampered with.

[0116] To tamper with the protected image data without detecting the tampering, it is necessary to tamper with the first hash value using the tampered protected image data and the first hash initial value.

[0117] However, after calculating the first hash value, the drive recorder 3 deletes the first hash initial value and the driving data from the drive recorder 3, and therefore the first hash initial value is not stored in the drive recorder 3. Therefore, if the protected image data is tampered with, the drive recorder 3 can prevent the first hash value from being tampered with to a hash value corresponding to the tampered protected image data. In other words, the drive recorder 3 can prevent the first hash value from being tampered with. Therefore, it is possible to detect whether the protected image data has been tampered with using the first hash value.

[0118] Furthermore, the driving data required to calculate the first hash initial value is stored in the secure server device 4. Therefore, a user without specific authority cannot obtain the driving data from the server device 4, and cannot calculate the first hash initial value required to tamper with the first hash value. Therefore, the tampering determination system 1 can prevent the first hash value from being tampered with.

[0119] The terminal device 5 calculates a second hash initial value from the driving data acquired from the server device 4 and the initial value setting rule, and calculates a second hash initial value using the second hash initial value. Then, the terminal device 5 compares the second hash value with the first hash value acquired from the drive recorder 3, thereby detecting whether the protected image data has been tampered with.

[0120] Furthermore, the tampering determination system 1 can detect whether or not the protected image data has been tampered with by the terminal device 5 without providing a secure area in the drive recorder 3. That is, the tampering determination system 1 can detect whether or not the protected image data has been tampered with while, for example, suppressing an increase in the cost of the drive recorder 3. Furthermore, the tampering determination system 1 can delete the first hash initial value (traveling data) from the drive recorder 3 by using the travel data stored in the server device 4 as the second hash initial value.

[0121] The initial value setting rule stored in the storage medium 32a of the drive recorder 3 may be an identification number corresponding to the initial value setting rule. The identification number indicates the type of driving data.

[0122] For example, the initial value setting rule with identification number "1" indicates that the type of driving data is vehicle speed. The initial value setting rule with identification number "2" indicates that the type of driving data is steering angle. The initial value setting rule with identification number "3" indicates that the type of driving data is vehicle position information. The initial value setting rule with identification number "4" indicates that the type of driving data is changed every first predetermined time. The initial value setting rule with identification number "5" indicates that the type of driving data is changed every second predetermined time. The first predetermined time and the second predetermined time are preset times that are different from each other. The identification number is set for each vehicle or each drive recorder 3.

[0123] In this case, the terminal device 5 stores in advance a correspondence table (database) that shows the relationship between the identification number of the initial value setting rule and the type of driving data for calculating the hash initial value.The terminal device 5 then reads from the correspondence table the initial value rule with the identification number that matches the identification number stored in the storage medium 32a, extracts the initial value setting rule corresponding to the identification number, recognizes the type of driving data from the content of the rule, and generates a driving data request signal.The terminal device 5 then transmits the generated driving data request signal to the server device 4.

[0124] The terminal device 5 calculates a second hash initial value using the extracted initial value setting rule and the driving data acquired from the server device 4. Then, the terminal device 5 calculates a second hash value using the calculated second hash initial value, and determines whether the protected image data has been tampered with by comparing the calculated second hash value with the first hash value stored in the storage medium 32a.

[0125] For example, if the initial value setting rule is a rule that uses the value of vehicle speed as the hash value, the initial value setting rule includes the time when the specific event occurred and the identification number "1." In this case, the terminal device 5 extracts the initial value setting rule for the identification number "1" based on the identification number "1" in the correspondence table stored in the storage medium 32a, recognizes that the type of traveling data is vehicle speed based on the content of the rule, and generates a traveling data request signal.

[0126] For example, when the type of driving data changes at a predetermined time, such as the above-mentioned identification number "4," the relationship between the predetermined time and the time is stored in the correspondence table along with the type of driving data. For example, when the first predetermined time is one hour, the type of driving data that changes every hour starting from midnight is set in advance and stored in the correspondence table. For example, the type of driving data is set to "vehicle speed" from "0:00 to 0:59," and the type of driving data is set to "steering angle" from "1:00 to 1:59," and stored in the correspondence table. The relationship between the predetermined time, time, and type of driving data (the correspondence table) is also stored in the drive recorder 3.

[0127] In addition, if the initial value setting rule itself is stored in association with the protected image data in the storage medium 32a of the drive recorder 3, the terminal device 5 can generate the traveling data request signal without storing the correspondence table.

[0128] When a specific event occurs, the drive recorder 3 may calculate the first hash initial value using the shooting time of the protected image data to be stored in the storage medium 32a instead of the event occurrence time. For example, when a specific event occurs, the drive recorder 3 may calculate the first hash initial value using the shooting time of the protected image data to be stored in the storage medium 32a and the vehicle speed at the shooting time of the protected image data to be stored in the storage medium 32a. In this case, the initial value acquisition rule is the shooting time of the protected image data to be stored in the storage medium 32a and the vehicle speed at the shooting time of the protected image data to be stored in the storage medium 32a.

[0129] The shooting time of the protected image data to be stored in the storage medium 32a when a specific event occurs is, for example, the earliest time within a certain period of time before or after the occurrence of the specific event. In other words, the shooting time of the protected image data to be stored in the storage medium 32a when a specific event occurs is the shooting start time of the protected image data to be stored in the storage medium 32a when the specific event occurs.

[0130] For example, as shown in Fig. 13, if a specific event occurs at time T1, the drive recorder 3 stores image data for a certain period of time from time T0, which is before time T1, to time T2, which is after time T1, in the storage medium 32a as protected image data. In this case, time T0 is set as the capture time of the protected image data. Then, for example, time T0 and the vehicle speed value at time T0 are set as the first hash initial value. Fig. 13 is a diagram for explaining the occurrence of a specific event.

[0131] In addition, the shooting time of the protected image data to be stored in the storage medium 32a when a specific event occurs may be the time when shooting of the protected image data to be stored in the storage medium 32a ends (for example, time T2) when a specific event occurs.

[0132] The shooting time of the protected image data to be stored in the storage medium 32a when a specific event occurs may be stored as metadata of the protected image data. In this way, when a specific event occurs, the drive recorder 3 does not need to store the event occurrence time in the storage medium 32a.

[0133] The vehicle-mounted device 2 may transmit the driving data to the server device 4 at a predetermined transmission interval. Specifically, the vehicle-mounted device 2 transmits the driving data to the server device 4 at a time corresponding to the predetermined transmission interval. In this case, when a specific event occurs, the drive recorder 3 may calculate, as the first hash initial value, a time corresponding to the predetermined transmission interval that has a predetermined relationship with the time when the specific event occurred, and, for example, the value of the vehicle speed at the time corresponding to the predetermined transmission interval. The time corresponding to the predetermined transmission interval is, for example, the time corresponding to the predetermined transmission interval immediately after the time when the specific event occurred. In other words, the drive recorder 3 calculates, as the first hash initial value, a time that is synchronized with the time when the vehicle-mounted device 2 transmits the driving data to the server device 4, which has a predetermined relationship with the time when the specific event occurred, and the vehicle speed at the synchronized time.

[0134] The drive recorder 3 may store, as protected image data, in the storage medium 32a image data for a certain period of time, from a time synchronized with the time when the in-vehicle device 2 transmits the driving data to the server device 4, to a time including the time when the specific event occurred. In this case, the time synchronized with the time when the in-vehicle device 2 transmits the driving data to the server device 4 is stored in the storage medium 32a as metadata of the protected image data, and the first hash initial value may be calculated based on the driving data at this time.

[0135] Traveling data such as vehicle speed at each time is stored in the server device 4. Therefore, the tampering determination system 1 can calculate a hash initial value using a time that has a specific relationship with the protected image data and the vehicle speed at that time, without using the occurrence time of a specific event and the vehicle speed at the occurrence time of the specific event. The tampering determination system 1 can delete the first hash initial value in the drive recorder 3 by using the travelling data stored in the server device 4 that can collect travelling data and provide services using the travelling data as the hash initial value. Therefore, the tampering determination system 1 can detect whether the protected image data has been tampered with without providing a secure area in the drive recorder 3.

[0136] Further advantages and modifications will readily occur to those skilled in the art. Therefore, the invention in its broader aspects is not limited to the specific details and representative embodiments shown and described above. Accordingly, various modifications may be made without departing from the spirit or scope of the general inventive concept as defined by the appended claims and their equivalents. [Explanation of symbols]

[0137] 1. Tampering detection system 2 On-vehicle device 3. Drive recorder (image storage device) 4. Server device (driving data storage device) 5 Terminal Devices 30 Camera 32 Storage section 32a Storage medium 33 Controller (1st Controller) 41 Storage section 42 Controller 53 Storage section 54 Controller (Second Controller)

Claims

1. A method for determining whether an image captured by a camera mounted on a vehicle and stored in an image storage device has been tampered with, comprising: Acquire driving data of the vehicle; Calculating a first hash initial value from the driving data in accordance with an initial value setting rule; calculating a first hash value based on the captured image and the first hash initial value; storing the photographed image, the initial value setting rule, and the first hash value in an image storage device in association with each other; The traveling data is stored in a traveling data storage device separate from the image storage device, When determining whether or not a tamper has occurred, Calculating a second hash initial value based on the initial value setting rule stored in the image storage device and the driving data stored in the driving data storage device; calculating a second hash value based on the photographed image stored in the image storage device and the second hash initial value; The first hash value stored in the image storage device is compared with the second hash value to determine whether the captured image stored in the image storage device has been tampered with. Tamper detection method.

2. The tampering determination method according to claim 1 , wherein the driving data is deleted from the image storage device.

3. The traveling data storage device has a more secure area than the image storage device, The tampering determination method according to claim 1 , wherein the driving data is stored in the secure area of ​​the driving data storage device.

4. Acquire vehicle driving data, Calculating a first hash initial value from the driving data in accordance with an initial value setting rule; calculating a first hash value based on an image captured by a camera mounted on the vehicle and the first hash initial value; After calculating the first hash value, delete the first hash initial value; an image storage method for storing the captured image, the initial value setting rule, and the first hash value in association with each other in an image storage device;

5. acquiring a first hash initial value, a first hash value calculated from an image captured by a camera mounted on a vehicle, an initial value setting rule, and the captured image from an image storage device; acquiring driving data of the vehicle from a driving data storage device separate from the image storage device; Calculating a second hash initial value based on the initial value setting rule stored in the image storage device and the driving data stored in the driving data storage device; calculating a second hash value based on the photographed image stored in the image storage device and the second hash initial value; determining whether the photographed image stored in the image storage device has been tampered with by comparing the first hash value stored in the image storage device with the second hash value; The first hash initial value is calculated by the image storage device from the driving data in accordance with the initial value setting rule.

6. A procedure for acquiring vehicle driving data; calculating a first hash initial value from the driving data in accordance with an initial value setting rule; a step of calculating a first hash value based on an image captured by a camera mounted on a vehicle and the first hash initial value; a step of deleting the first hash initial value after calculating the first hash value; a step of storing the photographed image, the initial value setting rule, and the first hash value in an image storage device in association with each other; A program that causes a computer to execute the following.

7. a step of acquiring a first hash initial value, a first hash value calculated from an image captured by a camera mounted on a vehicle, an initial value setting rule, and the captured image from an image storage device; acquiring driving data of the vehicle from a driving data storage device separate from the image storage device; a step of calculating a second hash initial value based on the initial value setting rule stored in the image storage device and the driving data stored in the driving data storage device; a step of calculating a second hash value based on the photographed image stored in the image storage device and the second hash initial value; a step of determining whether the photographed image stored in the image storage device has been tampered with by comparing the first hash value stored in the image storage device with the second hash value; on the computer, The first hash initial value is calculated by the image storage device from the driving data in accordance with the initial value setting rule.

8. An image storage device having a controller that stores images captured by a camera mounted on a vehicle, The controller Acquire vehicle driving data, Calculating a first hash initial value from the driving data in accordance with an initial value setting rule; calculating a first hash value based on the captured image and the first hash initial value; After calculating the first hash value, delete the first hash initial value; an image storage device that stores the captured image, the initial value setting rule, and the first hash value in association with each other;

9. an image storage device having a first controller for storing images captured by a camera mounted on the vehicle; a determination device having a second controller that determines whether the photographed image stored by the image storage device has been tampered with; Equipped with The first controller Acquire vehicle driving data, Calculating a first hash initial value from the driving data in accordance with an initial value setting rule; calculating a first hash value based on the captured image and the first hash initial value; After calculating the first hash value, delete the first hash initial value; storing the photographed image, the initial value setting rule, and the first hash value in association with each other; The second controller Calculating a second hash initial value based on the initial value setting rule stored in the image storage device and the driving data stored in a driving data storage device that is separate from the image storage device; calculating a second hash value based on the photographed image stored in the image storage device and the second hash initial value; A tampering determination system that determines whether the captured image stored in the image storage device has been tampered with by comparing the first hash value stored in the image storage device with the second hash value.

Images