Information processing device and information processing method

Abstract

To aggregate encrypted measurement data for each measurement environment.SOLUTION: An information processing device has a control unit that receives, from a first vehicle, encrypted first data including one or more pieces of measurement data acquired by the first vehicle and one or more pieces of first dummy data simulating the measurement data, and second data including one or more pieces of environmental data indicating a measurement environment of each piece of the measurement data, and one or more second dummy data simulating the environmental data corresponding to the first dummy data, and performs statistical processing of each piece of data included in the first data for each measurement environment indicated by each piece of data included in the second data.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present disclosure relates to an information processing system that encrypts and aggregates collected data. [Background technology]

[0002] There is known a technology for encrypting data and aggregating the encrypted data without decrypting it. In this regard, for example, Patent Document 1 discloses a vehicle information collection system that acquires vehicle information, performs homomorphic encryption on the vehicle information, performs predetermined statistical processing on the encrypted vehicle information, exchanges the encrypted vehicle information with other vehicles, and communicates with a center device. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2020-119230 Summary of the Invention [Problem to be solved by the invention]

[0004] The present disclosure aims to aggregate encrypted measurement data for each measurement environment. [Means for solving the problem]

[0005] One aspect of an embodiment of the present disclosure is The information processing device has a control unit that executes the following operations: receiving encrypted first data from a first vehicle, the encrypted first data including one or more measurement data acquired by the first vehicle and one or more first dummy data simulating the measurement data; one or more environmental data indicating the measurement environment of each of the measurement data; and one or more second dummy data simulating the environmental data corresponding to the first dummy data; and performing statistical processing of each data included in the first data for each measurement environment indicated by each data included in the second data.

[0006] Another aspect of the present disclosure is an information processing device mounted on a first vehicle, the information processing device having a control unit that executes the following operations: acquiring one or more pieces of measurement data generated by the first vehicle and one or more pieces of environmental data indicating a measurement environment of each of the measurement data; generating one or more pieces of first dummy data that imitate the measurement data acquired by the first vehicle; generating one or more pieces of second dummy data that imitate the environmental data corresponding to the first dummy data; generating first data by adding the first dummy data to one or more pieces of measurement data; generating second data by adding the second dummy data to one or more pieces of environmental data; encrypting each piece of data included in the first data; and transmitting the first data and the second data to an information processing device mounted on a second vehicle. It is an information processing device.

[0007] Another aspect of the present disclosure is The information processing device has a control unit that receives encrypted first data including one or more measurement data acquired by a first vehicle and one or more first dummy data simulating the measurement data, second data including one or more environmental data indicating the measurement environment of each of the measurement data and one or more second dummy data simulating the environmental data corresponding to the first dummy data, and the results of statistical processing performed on each data included in the first data (still encrypted) for each measurement environment indicated by each data included in the second data, and decrypts the received first data.

[0008] Another aspect of the present disclosure is An information processing method including the steps of: receiving from a first vehicle encrypted first data including one or more measurement data acquired by the first vehicle and one or more first dummy data simulating the measurement data; one or more environmental data indicating the measurement environment of each of the measurement data; and one or more second dummy data simulating the environmental data corresponding to the first dummy data; and performing statistical processing of each data included in the first data for each measurement environment indicated by each data included in the second data.

[0009] Another aspect of the present disclosure is An information processing method performed by an information processing device mounted on a first vehicle, the information processing method including the steps of acquiring one or more measurement data generated by the first vehicle and one or more environmental data indicating the measurement environment of each measurement data; generating one or more first dummy data that imitate the measurement data acquired by the first vehicle; generating one or more second dummy data that imitate the environmental data corresponding to the first dummy data; generating first data by adding the first dummy data to one or more of the measurement data; generating second data by adding the second dummy data to one or more of the environmental data; encrypting each data included in the first data; and transmitting the first data and the second data to an information processing device mounted on a second vehicle.

[0010] Another aspect of the present invention is a program for causing a computer to execute the above-described method, or a computer-readable storage medium that non-transitoryly stores the program. [Effects of the Invention]

[0011] According to the present disclosure, encrypted measurement data can be aggregated for each measurement environment. [Brief explanation of the drawings]

[0012] [Figure 1]FIG. 2 is a diagram showing an overview of processing executed by the information processing system according to the embodiment. [Figure 2] FIG. 2 is a diagram illustrating components of an information processing system according to an embodiment. [Figure 3] 10 is a flowchart of measurement data encryption processing executed by a control unit of a first vehicle-mounted device included in the information processing system according to the embodiment. [Figure 4] 6 is a flowchart of a dummy data generation process executed by a control unit of a first vehicle-mounted device included in the information processing system according to the embodiment. [Figure 5] 6 is a flowchart of a process executed by a control unit of a second vehicle-mounted device included in the information processing system according to the embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0013] (overview) It is conceivable to utilize various data measured by vehicles. For example, by collecting data measured by vehicles and performing statistical processing on the collected data, data that can be used for vehicle operation can be obtained. In this case, rather than using a center server device that originally aggregates the measured data, an arbitrary vehicle may receive data measured by other vehicles, perform statistical processing on the data, and then transmit the results to a center server device. In such cases, since the measured data contains information related to the privacy of the user of the vehicle that measured the data, it is desirable for the vehicle that measured the data to encrypt the data and transmit it to the vehicle that aggregates the data. Even if the data is encrypted, by using a specific encryption method, the vehicle that aggregates the data can perform statistical processing on the received data while it remains encrypted. Generally, when data is encrypted, the data does not need to be decrypted. However, by using a specific encryption method such as homomorphic encryption, it is possible to perform statistical processing on encrypted data without decrypting it.

[0014] For example, it is desirable to use measured data to detect the presence or absence of events that indicate road conditions, such as road closures, frozen roads, depressions, and congestion. In this case, there is a need to obtain statistical values ​​of data for each measurement point (or measurement area) where a vehicle has performed data measurements. However, the types of operations that can be performed on encrypted data using homomorphic encryption or the like are limited. Specifically, while it is possible to perform simple numerical addition or multiplication indicating, for example, mileage on encrypted data, it is not possible to obtain data statistics for each measurement point or measurement area. This disclosure provides a technology that enables a vehicle that aggregates data to aggregate encrypted data for each measurement point or measurement area and perform statistical processing.

[0015] A first information processing device according to an embodiment of the present disclosure includes: The information processing device has a control unit that executes the following operations: receiving encrypted first data from a first vehicle, the encrypted first data including one or more measurement data acquired by the first vehicle and one or more first dummy data simulating the measurement data; one or more environmental data indicating the measurement environment of each of the measurement data; and one or more second dummy data simulating the environmental data corresponding to the first dummy data; and performing statistical processing of each data included in the first data for each measurement environment indicated by each data included in the second data.

[0016] The measurement data is various data measured using sensors and the like provided on the first vehicle while the first vehicle is traveling.

[0017] The environmental data is data indicating the measurement environment in which the first vehicle acquired the measurement data. For example, the environmental data may be location information indicating the location where the first vehicle acquired the measurement data. In this case, the environmental data may include latitude and longitude information of the location where the measurement data was acquired.

[0018] The first dummy data is data that simulates measurement data acquired by the first vehicle, and includes fictitious values ​​of the same type of data as data detected by at least one of the various sensors equipped in the first vehicle.

[0019] The second dummy data is fictitious data set as the environment in which the first dummy data was measured. For example, if the environmental data is location information indicating the location where the first vehicle acquired the measurement data, the second dummy data may include fictitious latitude and longitude information corresponding to the first dummy data.

[0020] The information processing device according to the present disclosure receives the first data and the second data, and performs statistical processing on the encrypted first data for each measurement environment indicated by the unencrypted second data. That is, the information processing device according to the present disclosure can aggregate the encrypted measurement data for each measurement environment.

[0021] The control unit may perform the statistical processing without decoding each piece of data included in the first data.

[0022] As a result, the information processing device according to the present disclosure can protect the privacy of the vehicle user by processing the data in an encrypted state.

[0023] The control unit may also perform the statistical processing on homomorphically encrypted data.

[0024] As a result, the information processing device according to the present disclosure can acquire the encrypted measurement data acquired by the first vehicle, and then perform statistical processing on the data while it remains encrypted.

[0025] The control unit may also perform the statistical processing when it determines that a number of the first data and the second data equal to or greater than a reference value has been received for one or more observation points indicated by the environmental data.

[0026] As a result, the information processing device according to the present disclosure can secure a sufficient number of data and obtain statistical results for the measurement data.

[0027] In addition, in the statistical processing, the control unit may calculate an average value of each piece of data included in the first data for each measurement environment indicated by each piece of data included in the second data.

[0028] This allows the information processing device according to the present disclosure to acquire data trends in the measurement environment for each road.

[0029] The control unit may also transmit a result of the statistical processing to a second information processing device.

[0030] This allows the information processing device according to the present disclosure to transmit the results of statistical processing to a dedicated computing device or the like.

[0031] In addition, an information processing device according to the present disclosure is an information processing device mounted on a first vehicle, and has a control unit that performs the following operations: acquires one or more measurement data generated by the first vehicle and one or more environmental data indicating the measurement environment of each of the measurement data; generates one or more first dummy data that imitate the measurement data acquired by the first vehicle; generates one or more second dummy data that imitate the environmental data corresponding to the first dummy data; generates first data by adding the first dummy data to one or more of the measurement data; generates second data by adding the second dummy data to one or more of the environmental data; encrypts each data included in the first data; and transmits the first data and the second data to an information processing device mounted on a second vehicle.

[0032] As a result, the information processing device according to the present disclosure generates first data by adding first dummy data to the measurement data, generates second data by adding second dummy data to the environmental data, encrypts the first data, and transmits the first data and the second data.

[0033] For example, an information processing device according to the present disclosure generates first data by adding a large number of first dummy data to one piece of measurement data in order to conceal the measurement data, and generates second data by adding a large number of second dummy data to one piece of environmental data in order to conceal the environmental data.

[0034] In this way, a vehicle receiving the first data and the second data cannot guess which is the actual measurement data.

[0035] Therefore, the information processing device according to the present disclosure can conceal the measurement data and the environmental data representing the measurement environment in which the measurement data was acquired using false data and transmit them to another information processing device.

[0036] The control unit may encrypt each piece of data included in the first data using homomorphic encryption.

[0037] As a result, the information processing device according to the present disclosure enables another information processing device that receives the measurement data to perform statistical processing on the data that remains encrypted.

[0038] In addition, the environmental data may be position information of the point where the measurement data was acquired, and the control unit may generate, as the second dummy data, position information of a point on a virtual route set as a driving route of a second vehicle, which is a virtual vehicle simulating the first vehicle.

[0039] As a result, the information processing device according to the present disclosure can generate a virtual route, thereby creating natural fake data.

[0040] The control unit may also generate, as the second dummy data, position information indicating a predetermined number of positions randomly selected from points on a road in the vicinity of the observation point indicated by the environmental data.

[0041] This allows the information processing device according to the present disclosure to create more likely false data.

[0042] In addition, when the statistical processing uses an addition operation, the control unit may generate a value of 0 as the first dummy data, and when the statistical processing uses a multiplication operation, the control unit may generate a value of 1 as the first dummy data.

[0043] This allows the information processing device according to the present disclosure to add a value that does not affect statistical processing as dummy data to real data.

[0044] The control unit may set a fictitious measurement point where the second dummy data is assumed to have been measured, and when the fictitious measurement point is mixed with the actual measurement point indicated by the environmental data, determine whether the probability of being able to identify the actual measurement point is less than a predetermined threshold, and if it determines that the probability of being able to identify the actual measurement point is less than the predetermined threshold, transmit the first data and the second data to an information processing device installed in the second vehicle.

[0045] This allows the information processing device according to the present disclosure to transmit data that has been reliably concealed by false data to another information processing device.

[0046] The information processing device of the present disclosure has a control unit that receives encrypted first data including one or more measurement data acquired by a first vehicle and one or more first dummy data simulating the measurement data, second data including one or more environmental data indicating the measurement environment of each of the measurement data and one or more second dummy data simulating the environmental data corresponding to the first dummy data, and the results of statistical processing performed on each data included in the first data that remains encrypted for each measurement environment indicated by each data included in the second data, and decrypts the received first data and the results.

[0047] As a result, the information processing device according to the present disclosure can decrypt and use statistical results that have been encrypted and securely transmitted.

[0048] Specific embodiments of the present disclosure will be described below with reference to the accompanying drawings. Unless otherwise specified, the hardware configuration, module configuration, functional configuration, etc. shown are not intended to limit the technical scope of the disclosure to only those.

[0049] (Embodiment) <Outline of information processing system processing> An overview of processing performed by an information processing system according to an embodiment will be described with reference to FIG. 1. FIG. 1 is a diagram illustrating an overview of processing performed by an information processing system 100 according to an embodiment. Here, the information processing system 100 according to the embodiment includes, for example, a first in-vehicle device 101 mounted on each of a plurality of vehicles 10 that are vehicles that sense data, and a second in-vehicle device 201 mounted on a vehicle 20 that is a vehicle that has a function of aggregating the data. The first in-vehicle device 101 and the second in-vehicle device 201 may be information terminals for implementing a car navigation system, or may be dedicated information terminals built into the vehicles 10 and 20. The first in-vehicle device 101 encrypts measurement data detected by sensors and the like mounted on the vehicle 10, and transmits the data to the second in-vehicle device 201 together with plaintext environmental data. The second in-vehicle device 201 then statistically processes the data received from the plurality of vehicles 10 while keeping the data encrypted, and transmits the received data, the results of the statistical processing, and the like to an external server device or the like.

[0050] First, the first in-vehicle device 101 of the information processing system 100 acquires measurement data and environmental data via sensors or the like provided in the vehicle 10. Here, the measurement data is data acquired by the sensors. For example, the measurement data may be an image captured by an in-vehicle camera, or data indicating the speed or acceleration of the vehicle 10 detected by an acceleration sensor, or the presence or absence of obstacles on the road detected by a LiDAR or the like mounted on the vehicle 10. Furthermore, the environmental data is data indicating the measurement environment of each measurement data. Specifically, the environmental data may be location information of the location where each measurement data was measured.

[0051] Next, the first in-vehicle device 101 generates dummy data corresponding to each of the measurement data and the environmental data. For example, the dummy data of the measurement data may be fictitious measurement data. Specifically, the dummy data of the measurement data may be data having a value of 0 or 1. The dummy data of the measurement data is referred to as measurement dummy data. The measurement dummy data is an example of "first dummy data." Furthermore, the dummy data of the environmental data is data that corresponds to the dummy data of the measurement data and indicates a fictitious measurement environment in which the dummy data is set to have been measured. For example, the dummy data of the environmental data may be fictitious location information. The dummy data of the environmental data is referred to as environmental dummy data. The environmental dummy data is an example of "second dummy data."

[0052] Next, the first in-vehicle device 101 adds a plurality of pieces of measured dummy data to the measured data and encrypts it. For example, the first in-vehicle device 101 encrypts the measured data and the measured dummy data using homomorphic encryption. Homomorphic encryption is an encryption method that allows calculations to be performed on ciphertext as is.

[0053] Then, the first in-vehicle device 101 adds multiple sets of environmental dummy data to the environmental data. The first in-vehicle device 101 does not encrypt the environmental data and the environmental dummy data. In other words, the first in-vehicle device 101 generates data by adding multiple sets of encrypted measured dummy data and corresponding plaintext environmental dummy data to a set of encrypted measured data and corresponding plaintext environmental data.

[0054] Next, the first in-vehicle device 101 transmits the encrypted set of measurement data and measurement dummy data and the unencrypted set of environmental data and environmental dummy data to the second in-vehicle device 201 of the vehicle 20. The second in-vehicle device 201 then performs statistical processing on the encrypted data without decrypting it. For example, The device 201 may calculate a statistical value of the measurement data for each measurement environment indicated by the environmental data that corresponds one-to-one with the measurement data. Here, the statistical value may be an average value of the measurement data calculated for each measurement environment.

[0055] Then, the second vehicle-mounted device 201 transmits the statistical data to the center device 200. The center device 200 decrypts the received statistical data using the decryption key, and uses the decrypted data for various calculations.

[0056] Thus, in this embodiment, the information processing system 100 generates data by adding a set of encrypted measurement dummy data and plaintext environmental dummy data to a set of encrypted measurement data and plaintext environmental data, and performs statistical processing on them without decrypting them.

[0057] <Configuration of information processing system> FIG. 2 is a diagram illustrating components of the information processing system 100 according to the embodiment.

[0058] The information processing system 100 according to this embodiment includes a first in-vehicle device 101 and a second in-vehicle device 201. The first in-vehicle device 101 includes a control unit 110, a storage unit 120, and a communication unit 130. The second in-vehicle device 201 includes a control unit 210, a storage unit 220, and a communication unit 230. In the information processing system 100, the first in-vehicle devices 101 installed in multiple vehicles 10 transmit encrypted data to second in-vehicle devices 201 installed in a smaller number of vehicles 20, and the second in-vehicle devices 201 aggregate the received data. Note that there may be multiple vehicles 20. The first in-vehicle device 101 and the second in-vehicle device 201 may be, for example, in-vehicle terminals that implement a car navigation system or the like, or may be in-vehicle terminals dedicated to executing the processing described in this embodiment.

[0059] Vehicle 20 is a vehicle for collecting statistics on data generated by vehicle 10. Vehicle 20 may be selected by a management device that manages information processing system 100. For example, when statistics are to be obtained for each of a plurality of areas, the management device may select vehicle 20 from a plurality of vehicles traveling within a predetermined area.

[0060] First, the components of the first vehicle-mounted device 101 will be described.

[0061] The control unit 110 is realized by a processor such as a CPU (Central Processing Unit) or a GPU (Graphics Processing Unit) and a memory. The control unit 110 includes, as functional modules, an acquisition unit 111, a dummy generation unit 112, a data generation unit 113, an encryption unit 114, and a transmission unit 115. These functional modules may be realized by the control unit 110 executing a program. The control unit 110 is a specific example of a first control unit.

[0062] The acquisition unit 111 acquires measurement data acquired by sensors and the like equipped in the vehicle 10 and environmental data indicating the measurement environment of the measurement data. The acquisition unit 111 may acquire the measurement data and the environmental data by communicating with an ECU that controls the sensors and the like mounted on the vehicle 10 via the communication unit 130.

[0063] The dummy generation unit 112 generates measured dummy data, which is dummy data that imitates measured data, and environmental dummy data, which is dummy data that imitates environmental data corresponding to the measured dummy data. The dummy generation unit 112 can set a value as the measured dummy data that does not affect the statistical calculation of the measured data. Specifically, when the statistical processing of the measured data uses an addition operation, the dummy generation unit 112 can set a value of 0 as the measured dummy data, and when the statistical processing of the measured data uses a multiplication operation, the dummy generation unit 112 can set a value of 1 as the measured dummy data.

[0064] The data generating unit 113 generates first data by adding one or more pieces of measured dummy data to one or more pieces of measured data. Add one or more environmental dummy data corresponding to the measurement dummy data to the above environmental data. In other words, the data generating unit 113 generates second data by adding one or more pairs of measurement dummy data and environmental dummy data to one or more pairs of measurement data and environmental data. Generate the data.

[0065] The encryption unit 114 encrypts each piece of data included in the first data. That is, the encryption unit 114 encrypts the measured data and the measured dummy data. The encryption unit 114 may encrypt each piece of data included in the first data using homomorphic encryption.

[0066] The transmission unit 115 transmits one or more pairs of encrypted first data and plaintext second data to the second in-vehicle device 201. The transmission unit 115 performs wireless communication with the communication unit 230 of the second in-vehicle device 201 via the communication unit 130. The transmission unit 115 may transmit the data to the second in-vehicle device 201 by communication via a wide area network, or may transmit the data to the second in-vehicle device 201 by vehicle-to-vehicle communication.

[0067] The storage unit 120 is a main storage device such as RAM or ROM, an EPROM, a hard disk drive, or an auxiliary storage device such as removable media. The auxiliary storage device stores an operating system (OS), various programs, various tables, etc., and by executing the programs stored therein, it is possible to realize functions that match the predetermined purpose of each unit of the control unit 110. However, some or all of the functions may be realized by hardware circuits such as ASICs or FPGAs.

[0068] The storage unit 120 stores data and the like used or generated in the processing performed by the control unit 110. The storage unit 120 may also store a program and the like used for encrypting data.

[0069] The communication unit 130 is configured with a communication circuit that performs wireless communication. The communication unit 130 may be, for example, a communication circuit that performs wireless communication using 4G (4th Generation) or a communication circuit that performs wireless communication using 5G (5th Generation). The communication unit 130 may also be a communication circuit that performs wireless communication using LTE (Long Term Evolution) or a communication circuit that performs wireless communication using LPWA (Low Power Wide Area). The communication unit 130 may be a communication circuit that performs communication using the Wi-Fi (registered trademark) standard.

[0070] Next, the components of the second vehicle-mounted device 201 will be described.

[0071] The control unit 210 is realized by a processor such as a CPU or a GPU and a memory. The control unit 210 includes, as functional modules, an acquisition unit 211, a statistics unit 212, and a transmission unit 213. These functional modules may be realized by the control unit 210 executing a program. The control unit 210 is a specific example of a second control unit.

[0072] The acquisition unit 211 acquires one or more encrypted first data and plaintext second data from the first in-vehicle device 101. The acquisition unit 211 may receive one or more encrypted first data and plaintext second data from the first in-vehicle device 101 via the communication unit 230.

[0073] The statistical unit 212 performs statistical processing on each piece of data included in the first data for each measurement environment indicated by each piece of data included in the second data. The statistical unit 212 performs statistical processing on the encrypted first data based on each piece of data included in the plaintext second data. For example, The calculation unit 212 may calculate the average value of the measurement data for each measurement point (or measurement area) of each measurement data indicated by the second data, without decoding the measurement data.

[0074] The transmission unit 213 transmits the statistical data calculated by the statistics unit 212 to an external server device or the like. Here, the external server device or the like refers to a center device or the like that performs calculations to use the measurement data measured by the vehicle 10 for various applications. The transmission unit 213 transmits the statistical data to the external server device or the like via the communication unit 230 and a wide area network such as the Internet.

[0075] The storage unit 220 is a main storage device such as RAM or ROM, an EPROM, a hard disk drive, or an auxiliary storage device such as removable media. The auxiliary storage device stores an operating system (OS), various programs, various tables, etc., and by executing the programs stored therein, it is possible to realize functions that match the predetermined purpose of each unit of the control unit 210. However, some or all of the functions may be realized by hardware circuits such as ASICs or FPGAs.

[0076] The storage unit 220 stores data and the like used or generated in the processing performed by the control unit 210. The storage unit 220 may also store programs and the like used in statistical processing of the first data.

[0077] The communication unit 230 is configured with a communication circuit that performs wireless communication. The communication unit 230 may be, for example, a communication circuit that performs wireless communication using 4G, or a communication circuit that performs wireless communication using 5G. The communication unit 230 may also be a communication circuit that performs wireless communication using LTE, or a communication circuit that performs communication by LPWA. The communication unit 230 may also be a communication circuit that performs wireless communication using Wi-Fi (registered trademark).

[0078] <Operation of the first in-vehicle device> Next, a description will be given of specific details of the processing performed by the first in-vehicle device 101 included in the information processing system 100. First, a description will be given of the processing performed by the first in-vehicle device 101 to encrypt data measured by the vehicle 10. Fig. 3 is a flowchart of the measurement data encryption processing performed by the control unit 110 of the first in-vehicle device 101 included in the information processing system 100 according to the embodiment.

[0079] 3 when the vehicle 10 equipped with the first in-vehicle device 101 starts traveling, and periodically repeats the process at regular intervals. The first in-vehicle device 101 may start the process of step S10 when receiving some input from the user of the vehicle 10.

[0080] First, in step S10, the acquisition unit 111 acquires measurement data via a sensor provided in the vehicle 10. Specifically, the measurement data may be an image captured by an on-board camera. Alternatively, the measurement data may be data indicating the speed or acceleration of the vehicle 10 detected by an acceleration sensor, the presence or absence of an obstacle on the road detected by a LiDAR or the like mounted on the vehicle 10, or the like.

[0081] Subsequently, in step S11, the encryption unit 114 homomorphically encrypts the measurement data acquired by the acquisition unit 111 in step S10. Here, as the homomorphic encryption, Okamoto-Uchiyama encryption, Paillier encryption, ElGamal encryption, RSA encryption, Boneh-Goh-Nissim encryption, lattice encryption, Gentry's lattice-based fully homomorphic encryption, etc. may be used.

[0082] Next, in step S12, the acquisition unit 111 acquires environmental data indicating the environment in which the measurement data acquired in step S10 was measured. One piece of environmental data corresponds to one piece of measurement data. The environmental data may be, for example, location information indicating the location where each piece of measurement data was measured. Specifically, the environmental data may be latitude and longitude information (which may include altitude information) of the location where the measurement data was measured. The environmental data is not limited to location information indicating the location where the measurement data was measured, and may be any data as long as it is data indicating the environment in which the measurement data was measured.

[0083] For example, the environmental data may be information indicating the time period when the measurement data was measured, the ID of the road link on the road where the measurement data was acquired, the lane of the road where the measurement data was acquired, etc. Furthermore, for example, the environmental data may be information indicating the traveling direction of the vehicle that acquired the measurement data when the measurement data was acquired, the vehicle speed of the vehicle that acquired the measurement data when the measurement data was acquired, the model or type of the vehicle that acquired the measurement data, etc.

[0084] Next, in step S13, the data generation unit 113 assigns 1 to a counter value corresponding to the environmental data. The counter value is data transmitted by the first in-vehicle device 101 to the second in-vehicle device 201 together with the measurement data and the corresponding environmental data. The counter value is incremented by 1 each time the sensor mounted on the vehicle 10 performs sensing once in a certain measurement environment. In other words, the counter value indicates the number of measurement data acquired in the measurement environment indicated by the environmental data. The second in-vehicle device 201 can recognize how many pieces of measurement data corresponding to a specific measurement environment it has collected by adding up the counter values ​​included in the collected transmission data.

[0085] Then, in step S14, the data generation unit 113 generates transmission data including the measurement data encrypted in step S11, environmental data corresponding to the measurement data, and the counter value to which 1 was assigned in step S13. The data generation unit 113 may pair the encrypted measurement data with plaintext environmental data corresponding to the measurement data as transmission data, or may include a plaintext counter value separately from the pair of measurement data and environmental data.

[0086] Next, a process will be described in which the first in-vehicle device 101 generates dummy data to conceal data measured by the vehicle 10. Fig. 4 is a flowchart of the dummy data generation process executed by the control unit 110 of the first in-vehicle device 101 included in the information processing system 100 according to the embodiment.

[0087] The first in-vehicle device 101 included in the information processing system 100 starts the process described in FIG. 4 when the vehicle 10 equipped with the first in-vehicle device 101 starts traveling, and periodically repeats the process at regular intervals. The first in-vehicle device 101 may start the process of step S10 when it receives some input from the user of the vehicle 10. The process described in FIG. 4 may be performed in parallel with the process described in FIG. 3, or may be performed after the process described in FIG. 3. When the process described in FIG. 3 and the process described in FIG. 4 are repeated, the process described in FIG. 3 and the process described in FIG. 4 may be performed alternately.

[0088] First, in step S20, the dummy generation unit 112 generates measured dummy data, which is dummy data that imitates the measured data. The measured dummy data has a value that does not affect the calculation results in the calculation of the statistical processing of the measured data. For example, if the statistical processing of the measured data includes an additive operation, the measured dummy data may have a value of 0. Also, if the statistical processing of the measured data includes a multiplicative operation, the measured dummy data may have a value of 1.

[0089] Next, in step S21, the encryption unit 114 homomorphically encrypts the measured dummy data using the same method as in step S11.

[0090] Next, in step S22, the dummy generation unit 112 generates environmental dummy data that imitates the environmental data corresponding to the measured dummy data. Specifically, the dummy generation unit 112 generates environmental dummy data that indicates a value indicating the environment in which the measured dummy data is set to have been measured. For example, the dummy generation unit 112 generates environmental dummy data that indicates position information (e.g., latitude and longitude information (which may include altitude information)) indicating the position in which the measured dummy data is set to have been measured. Specifically, the environmental dummy data may be position information indicating a predetermined number of positions randomly selected from points on roads surrounding the actual observation point indicated by the real environmental data. Alternatively, the dummy generation unit 112 may set a predetermined number of dummy vehicles and generate fictitious trajectories on which the dummy vehicles have traveled. Then, a predetermined number of positions may be extracted from the fictitious trajectory, and the position information indicating the positions may be used as the environmental dummy data.

[0091] In step S23, the data generation unit 113 assigns 1 to the counter value corresponding to the environmental dummy data. That is, the counter value indicates that one piece of measured dummy data has been acquired (set) in the measurement environment indicated by the environmental dummy data.

[0092] In step S24, the data generation unit 113 adds the measured dummy data encrypted in step S21, the environmental dummy data corresponding to the measured dummy data, and the counter value to which 1 was assigned in step S23 to the transmission data. The data generation unit 113 may add the encrypted measured dummy data and the plaintext environmental dummy data corresponding to the measured dummy data as a pair to the transmission data. Here, the transmission data refers to the transmission data generated in the process (step S14) of FIG. 3.

[0093] In step S25, the data generating unit 113 determines whether or not the pair of measurement data and environmental data is sufficiently concealed by the pair of measurement dummy data and environmental dummy data in the transmission data generated in step S24.

[0094] For example, the data generation unit 113 may determine whether the number of pairs of measurement dummy data and environmental dummy data in the transmission data is greater than the number of pairs of measurement data and environmental data by a certain number or more. Alternatively, the data generation unit 113 may determine whether the number of pairs of measurement dummy data and environmental dummy data in the transmission data is greater than a certain ratio to the number of pairs of measurement data and environmental data. Alternatively, the data generation unit 113 may determine whether the probability of identifying an actual measurement point when a fictitious measurement point used as environmental dummy data is mixed with an actual measurement point indicated by environmental data is less than a predetermined threshold.

[0095] If the data generating unit 113 determines that the pair of measurement data and environmental data in the transmission data is sufficiently concealed by the pair of measurement dummy data and environmental dummy data, this step results in a positive determination.

[0096] If the determination in this step is affirmative, the process ends.

[0097] If the determination in this step is negative, the process proceeds to step S20.

[0098] 3 and 4 are completed, the transmitting unit 115 transmits the transmission data, i.e., data including one or more pairs of measurement data and environmental data, and one or more pairs of measurement dummy data and environmental dummy data, to the second vehicle-mounted device 201. In addition, when the processing described in FIG. 3 and the processing described in FIG. 4 are repeatedly performed, the processing is performed as follows. In this case, when step S14 and the same number of steps as step S14 are completed, data including one or more pairs of measured data and environmental data and one or more pairs of measured dummy data and environmental dummy data may be transmitted to the second in-vehicle device 201. The above process may be repeated at the above-mentioned timing.

[0099] <Operation of the second in-vehicle device> Next, specific details of the processing performed by the second in-vehicle device 201 included in the information processing system 100 will be described. Specifically, the operation of the second in-vehicle device 201 performing statistical processing on data received by the vehicle 20 will be described. FIG. 5 is a flowchart of processing performed by the control unit 210 of the second in-vehicle device 201 included in the information processing system 100 according to the embodiment. The control unit 210 repeats the processing from step S30 to step S34 for each observation point. Here, the observation point may be a local point or a certain range (observation area). "Each observation point" may be a point or area determined in advance. For example, if the target area includes multiple areas divided by a mesh, the processing from step S30 to step S34 may be repeated for each of the multiple areas.

[0100] First, in step S30, the acquisition unit 211 receives transmission data from the first in-vehicle device 101 mounted on the vehicle 10. The acquisition unit 211 receives the transmission data generated by the first in-vehicle device 101 in steps S14 and S25. That is, the acquisition unit 211 receives data including one or more pairs of measurement data and environmental data, and one or more pairs of measurement dummy data and environmental dummy data, which have been transmitted from the first in-vehicle device 101 to the second in-vehicle device 201.

[0101] Next, in step S31, the statistical unit 212 determines whether a number of pieces of measurement data acquired at the target observation point has been received that is equal to or greater than a reference value, or whether a certain amount of time has passed since the start of collection of the measurement data. Because the environmental data is in plain text, the statistical unit 212 can determine the observation point corresponding to each of the multiple pieces of measurement data. For example, if the target area includes multiple areas divided by a mesh, it may be determined whether a predetermined number of pieces of measurement data has been acquired for each of the multiple areas.

[0102] If the statistical unit 212 determines that it has received a number of measurement data acquired at the target observation point that is equal to or greater than the reference value, or that a certain amount of time has elapsed since the start of collection of the measurement data, this step will be judged as positive.

[0103] If the determination in this step is affirmative, the process proceeds to step S32.

[0104] If the determination in this step is negative, the process proceeds to step S30.

[0105] When the process proceeds to step S32, the statistical unit 212 performs statistical processing on a certain number of measurement data acquired at the observation point P while the data remains encrypted. For example, the statistical unit 212 may perform processing to calculate an average value of the measurement data acquired at the observation point P while the data remains encrypted.

[0106] Next, in step S33, the transmission unit 213 transmits the encrypted data, which is the result of the statistical processing calculated in step S32, to an external server device. The transmission unit 213 transmits the encrypted result of the statistical processing to an external server device, such as a center device, that has the function of receiving data from the vehicles 10 and 20 and using the received data for various calculations. The result of the statistical processing may be transmitted together with data indicating the corresponding observation point (point or area). Furthermore, the transmission unit 213 may transmit not only the result of the statistical processing but also the data itself received from the first in-vehicle device 101 to the external server device at the same time.

[0107] The center device or the like that receives the statistical processing results from the second in-vehicle device 201 decrypts the encrypted statistical processing results using the decryption key, and can then use the decrypted statistical values ​​for various calculations.

[0108] As a result, in this embodiment, the information processing system 100 can conceal the real measurement data and environmental data by using dummy data that imitates the measurement data and environmental data measured by the vehicle 10, and perform statistical processing on the measurement data while keeping them encrypted. In other words, the information processing system 100 can transmit measurement data related to the privacy of the user of the vehicle 10 to the vehicle 20 in a concealed state, and the vehicle 20 can perform statistical processing on the measurement data that remains concealed.

[0109] (Variation 1) In the above embodiment, all the first in-vehicle devices 101 transmitted measurement data measured in various measurement environments to the second in-vehicle device 201. However, only the first in-vehicle devices 101 of the vehicles 10 that satisfy specific measurement positions or measurement conditions specified by a center device or the like may transmit only the measurement data that satisfies the conditions to the second in-vehicle device 201. In other words, when the center device specifies measurement positions or measurement conditions, only the first in-vehicle devices 101 mounted on the vehicles 10 that can satisfy the conditions encrypt and transmit the measurement data to the second in-vehicle device 201. At this time, the first in-vehicle device 101 may transmit only the measurement data to the second in-vehicle device 201 without adding environmental data to the transmission data. This is because the measurement positions or measurement conditions are limited in advance, so that the measurement data can be subjected to statistical processing as is without being classified by measurement position or measurement environment.

[0110] However, if only the first in-vehicle device 101 of a specific vehicle 10 that satisfies the measurement conditions transmits transmission data to the second in-vehicle device 201, there is a risk that the vehicle 20 may acquire the location information history of that vehicle 10 or other situation history. Therefore, the first in-vehicle devices 101 mounted on vehicles 10 that do not satisfy the specified measurement conditions also transmit encrypted dummy measurement data to the second in-vehicle device 201 at a certain rate. The second in-vehicle device 201 then statistically processes the measurement data received from the specific vehicle 10 that satisfies the measurement conditions and the dummy measurement data received from vehicles 10 that do not satisfy the measurement conditions while keeping them encrypted. This makes it possible to acquire statistical values ​​of measurement data acquired in a specified measurement environment while preventing leakage of privacy information about the specific vehicle 10 that satisfies the measurement conditions.

[0111] (Other variations) The above-described embodiment is merely an example, and the present disclosure can be modified and implemented as appropriate within the scope that does not deviate from the gist of the disclosure.

[0112] The present disclosure can also be realized by providing a computer program implementing the functions described in the above embodiments to a computer, and having one or more processors in the computer read and execute the program. Such a computer program may be provided to the computer via a non-transitory computer-readable storage medium connectable to the computer's system bus or via a network. Non-transitory computer-readable storage media include, for example, any type of disk, such as a magnetic disk (e.g., a floppy disk, a hard disk drive (HDD), etc.), an optical disk (e.g., a CD-ROM, a DVD disk, a Blu-ray disk), a read-only memory (ROM), a random-access memory (RAM), an EPROM, an EEPROM, a magnetic card, a flash memory, an optical card, or any type of medium suitable for storing electronic instructions. [Explanation of symbols]

[0113] 100 Information Processing Systems 101...1st in-vehicle device 110, 210... Control unit 111, 211... Acquisition part 112 Dummy generation section 113 Data Generation Unit 114...Encryption section 115, 213... Transmitter 120, 220...Storage section 130, 230... Communications Department 201...2nd onboard device 212...Statistics Department

Claims

1. encrypted first data including one or more pieces of measurement data acquired by a first vehicle and one or more pieces of first dummy data simulating the measurement data; second data including one or more environmental data indicating a measurement environment of each of the measurement data and one or more second dummy data simulating the environmental data corresponding to the first dummy data; from the first vehicle; performing statistical processing of each piece of data included in the first data for each measurement environment indicated by each piece of data included in the second data; a control unit that executes the following: Information processing device.

2. The control unit performing the statistical processing without decoding each piece of data included in the first data; The information processing device according to claim 1 .

3. the control unit performs the statistical processing on the homomorphically encrypted data. The information processing device according to claim 2 .

4. The control unit performing the statistical processing when it is determined that the first data and the second data are received in numbers equal to or greater than a reference value for one or more observation points indicated by the environmental data; The information processing device according to claim 1 .

5. The control unit In the statistical processing, an average value of each data included in the first data is calculated for each measurement environment indicated by each data included in the second data. The information processing device according to claim 1 .

6. The control unit transmitting the result of the statistical processing to a second information processing device; The information processing device according to claim 1 .

7. An information processing device mounted on a first vehicle, acquiring one or more pieces of measurement data generated by the first vehicle and one or more pieces of environmental data indicating a measurement environment of each of the measurement data; generating one or more first dummy data simulating the measurement data acquired by the first vehicle; generating one or more second dummy data that imitate the environmental data corresponding to the first dummy data; generating first data by adding the first dummy data to one or more of the measurement data; generating second data by adding the second dummy data to one or more of the environmental data; encrypting each piece of data included in the first data; transmitting the first data and the second data to an information processing device mounted on a second vehicle; a control unit that executes the following: Information processing device.

8. The control unit encrypting each piece of data included in the first data by homomorphic encryption; The information processing device according to claim 7 .

9. the environmental data is location information of a point where the measurement data was acquired, the control unit generates, as the second dummy data, position information of points on a virtual route set as a travel route of a second vehicle that is a virtual vehicle simulating the first vehicle; The information processing device according to claim 7 .

10. the control unit generates, as the second dummy data, position information indicating a predetermined number of positions randomly selected from points on a road in the vicinity of the observation point indicated by the environmental data; The information processing device according to claim 7 .

11. When the statistical processing of each data included in the first data, which is performed for each measurement environment indicated by each data included in the second data, uses an addition operation, the control unit generates a value of 0 as the first dummy data, If the statistical processing uses multiplication operations, the control unit generates a value of 1 as the first dummy data. The information processing device according to claim 7 .

12. The control unit setting a fictitious measurement point where the second dummy data is assumed to have been measured; determining whether or not the probability of being able to distinguish the actual measurement point when the fictitious measurement point and the actual measurement point indicated by the environmental data are mixed is less than a predetermined threshold value; transmitting the first data and the second data to an information processing device mounted on a second vehicle when it is determined that the probability of being able to identify the actual measurement point is less than a predetermined threshold value; The information processing device according to claim 7 .

13. encrypted first data including one or more pieces of measurement data acquired by a first vehicle and one or more pieces of first dummy data simulating the measurement data; second data including one or more environmental data indicating a measurement environment of each of the measurement data and one or more second dummy data simulating the environmental data corresponding to the first dummy data; receiving a result of statistical processing performed on each data included in the first data while the data remains encrypted for each measurement environment indicated by each data included in the second data; and decoding the received first data and the result. Information processing device.

14. encrypted first data including one or more pieces of measurement data acquired by a first vehicle and one or more pieces of first dummy data simulating the measurement data; second data including one or more environmental data indicating a measurement environment of each of the measurement data and one or more second dummy data simulating the environmental data corresponding to the first dummy data; from the first vehicle; performing statistical processing of each piece of data included in the first data for each measurement environment indicated by each piece of data included in the second data; Including, Information processing methods.

15. In the step of performing the statistical processing, the statistical processing is performed without decoding each data included in the first data. The information processing method according to claim 14.

16. In the step of performing the statistical processing, the statistical processing is performed on the homomorphically encrypted data. The information processing method according to claim 15.

17. In the step of performing the statistical processing, performing the statistical processing when it is determined that the first data and the second data are received in numbers equal to or greater than a reference value for one or more observation points indicated by the environmental data; The information processing method according to claim 14.

18. In the step of performing the statistical processing, calculating an average value of each data item included in the first data for each measurement environment indicated by each data item included in the second data; The information processing method according to claim 14.

19. further comprising a step of transmitting a result of the statistical processing to a second information processing device. The information processing method according to claim 14.

20. An information processing method performed by an information processing device mounted on a first vehicle, acquiring one or more pieces of measurement data generated by the first vehicle and one or more pieces of environmental data indicating a measurement environment of each of the measurement data; generating one or more first dummy data simulating the measurement data acquired by the first vehicle; generating one or more second dummy data that imitate the environmental data corresponding to the first dummy data; generating first data by adding the first dummy data to one or more of the measurement data; generating second data by adding the second dummy data to one or more of the environmental data; encrypting each piece of data included in the first data; transmitting the first data and the second data to an information processing device mounted on a second vehicle; Including, Information processing methods.

Images