Information processing system, method for controlling information processing system, and storage medium

Abstract

To accurately detect falsification of vehicle data.SOLUTION: An information processing system for detecting tampering of vehicle data includes a vehicle data acquisition unit configured to acquire first vehicle data and second vehicle data, a first tampering detection unit configured to detect a possibility of tampering of the vehicle data based on the first vehicle data and the second vehicle data, and a second tampering detection unit configured to detect tampering of the first vehicle data based on first evaluation data for evaluating the first vehicle data and detect tampering of the second vehicle data based on second evaluation data for evaluating the second vehicle data when the first tampering detection unit detects the possibility of tampering.SELECTED DRAWING: Figure 6

Description

[Technical Field]

[0001] The present invention relates to a technique for detecting tampering with vehicle data. [Background technology]

[0002] Patent document 1 discloses that a first vehicle speed V1 is calculated based on a pulse signal proportional to the rotational speed of the drive wheels 12 output from a vehicle speed sensor 14, a second vehicle speed V2 is calculated from a change in the vehicle position measured by a GPS receiver 16 or an output signal from the GPS receiver 16, and whether or not the vehicle speed signal (first vehicle speed V1) has been tampered with is determined based on a comparison between the first vehicle speed V1 and the second vehicle speed V2. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2012-126273 Summary of the Invention [Problem to be solved by the invention]

[0004] However, the technology described in Patent Document 1 assumes that the second vehicle speed V2 is a correct value, but if the second vehicle speed V2 is falsified, it is not possible to determine whether the first vehicle speed V1 is correct. Thus, Patent Document 1 has a problem in that it is difficult to accurately determine which of the two signals being compared has been falsified.

[0005] The present invention has been made in view of the above-mentioned problems, and aims to provide a technology for accurately detecting tampering with vehicle data, thereby improving passenger safety and traffic safety, thereby contributing to the development of a sustainable transportation system. [Means for solving the problem]

[0006] An information processing system according to one aspect of the present invention that achieves the above object comprises: An information processing system for detecting tampering of vehicle data, a vehicle data acquisition means for acquiring first vehicle data and second vehicle data; a first tampering detection means for detecting a possibility of tampering with the vehicle data based on the first vehicle data and the second vehicle data; a second tampering detection means for detecting tampering of the first vehicle data based on first evaluation data for evaluating the first vehicle data when the first tampering detection means detects the possibility of tampering, and for detecting tampering of the second vehicle data based on second evaluation data for evaluating the second vehicle data; The present invention is characterized by comprising: [Effects of the Invention]

[0007] According to the present invention, tampering with vehicle data can be detected with high accuracy. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 1 is a block diagram of a vehicle and a control device according to an embodiment. [Figure 2] FIG. 1 is a diagram showing an example of the configuration of an information processing system according to an embodiment. [Figure 3] FIG. 1 is a diagram showing an example of the hardware configuration of an information processing apparatus according to an embodiment. [Figure 4] FIG. 2 is a diagram showing an example of a functional configuration of a control device provided in a vehicle according to an embodiment. [Figure 5] FIG. 1 is a diagram showing an example of the functional configuration of an information processing apparatus according to an embodiment. [Figure 6] FIG. 2 is a processing sequence diagram of an information processing system according to an embodiment. [Figure 7] FIG. 2 is a diagram illustrating the relationship between the turning radius, wheel base, and tire steering angle of a vehicle according to an embodiment. [Figure 8] 5A and 5B are diagrams illustrating a motor regenerative torque allocable upper limit value and a motor regenerative torque allocation value according to an embodiment. [Figure 9] FIG. 10 is an explanatory diagram of a falsification pattern of a motor regenerative torque allocation value according to an embodiment. [Figure 10] FIG. 2 is a diagram showing an example of vehicle data and its evaluation data according to an embodiment. [Figure 11] FIG. 2 is a diagram showing an example of vehicle data and its evaluation data according to an embodiment. [Figure 12] FIG. 2 is a diagram showing an example of vehicle data and its evaluation data according to an embodiment. [Figure 13] FIG. 10 is an explanatory diagram of an example of simple tampering detection processing according to an embodiment. [Figure 14] FIG. 10 is an explanatory diagram of an example of detailed tampering detection processing according to an embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0009] Hereinafter, the embodiments will be described in detail with reference to the accompanying drawings. Note that the following embodiments do not limit the scope of the invention as claimed, and not all combinations of features described in the embodiments are necessarily essential to the invention. Two or more of the features described in the embodiments may be arbitrarily combined. Furthermore, the same reference numerals are used for the same or similar components, and redundant explanations will be omitted.

[0010] (Embodiment) The measurement values ​​and command values ​​of devices equipped with sensors and actuators may be tampered with by cyber attacks, but if the values ​​are tampered with and become outside the design values, they can be detected by normal fault detection processing. For example, if the vehicle speed shows a value exceeding the vehicle's maximum speed, it can be determined that there is an obvious fault.

[0011] However, if a large change in a value occurs within the design value, it cannot be detected by normal fault detection. For example, if the actual vehicle speed is 50 km / h but is falsified to show 80 km / h by adding +30 km / h, this is a falsification within the range that can occur as a vehicle speed, and is difficult to detect by normal fault detection processing. However, a large change in a value within the design value may lead to a serious incident. Therefore, it is necessary to detect a large change in a value within the design value. In this embodiment, an example will be described in which falsification is detected even when there is a large change in a value within such a design value.

[0012] <Control device and its application examples> FIG. 1 is a block diagram of a control device CNT according to one embodiment, and a schematic diagram of a vehicle V as an application example thereof. In FIG. 1, the vehicle V is shown in a plan view and a side view. The vehicle V of this embodiment is, as an example, a four-wheeled sedan-type passenger vehicle, and may be, for example, a parallel hybrid vehicle. Note that the vehicle V is not limited to a four-wheeled passenger vehicle, and may be a saddle-type vehicle (motorcycle, motor tricycle), or a large vehicle such as a truck or bus.

[0013] The control device CNT includes a controller 1, which is an electronic circuit that controls the vehicle V, including driving assistance for the vehicle V. The controller 1 is equipped with multiple ECUs (Electronic Control Units). An ECU is provided, for example, for each function of the control device CNT. Each ECU includes a processor represented by a CPU (Central Processing Unit), a storage device such as a semiconductor memory, an interface with an external device, etc. The storage device stores programs executed by the processor and data used by the processor for processing, etc. The interface includes an input / output interface and a communication interface. Each ECU may be equipped with multiple processors, multiple storage devices, and multiple interfaces. The programs stored in the storage device may be stored in the storage device by being installed in the control device CNT using a storage medium such as a CD-ROM.

[0014] The controller 1 controls the drive (acceleration) of the vehicle V by controlling a power unit (power plant) 2. The power unit 2 is a traveling drive unit that outputs drive force to rotate the drive wheels of the vehicle V, and may include an internal combustion engine, a motor, and an automatic transmission. The motor can be used as a drive source to accelerate the vehicle V, and can also be used as a generator during deceleration, etc. (regenerative braking).

[0015] In this embodiment, the controller 1 controls the output of the internal combustion engine and the motor and controls the shifting of the gears of the automatic transmission in response to the driving operation of the driver detected by the operation detection sensor 2a provided on the accelerator pedal AP and the operation detection sensor 2b provided on the brake pedal BP, and the vehicle speed of the vehicle V detected by the rotation speed sensor 2c. The automatic transmission is provided with a rotation speed sensor 2c that detects the rotation speed of the output shaft of the automatic transmission as a sensor that detects the running state of the vehicle V. The vehicle speed of the vehicle V can be calculated from the detection result of the rotation speed sensor 2c.

[0016] The controller 1 controls the braking (deceleration) of the vehicle V by controlling the hydraulic device 3. The driver's braking operation on the brake pedal BP is converted into hydraulic pressure in the brake master cylinder BM and transmitted to the hydraulic device 3. The hydraulic device 3 is an actuator that can control the hydraulic pressure of the hydraulic oil supplied to the brake devices 3a (e.g., disc brake devices) provided on each of the four wheels based on the hydraulic pressure transmitted from the brake master cylinder BM.

[0017] The controller 1 can control the braking of the vehicle V by controlling the driving of the solenoid valves and the like provided in the hydraulic device 3. The controller 1 can also configure an electric servo brake system by controlling the distribution of braking force by the brake device 3a and braking force by regenerative braking of the motor provided in the power unit 2. The controller 1 may also turn on the brake lamps 3b during braking.

[0018] The controller 1 controls the steering of the vehicle V by controlling the electric power steering device 4. The electric power steering device 4 includes a mechanism for steering the front wheels in response to the driver's driving operation (steering operation) with respect to the steering wheel ST. The electric power steering device 4 includes a drive unit 4a that generates a driving force (sometimes referred to as steering assist torque) for assisting the steering operation or for automatically steering the front wheels of the vehicle V. The drive unit 4a includes a motor as a drive source. The electric power steering device 4 also includes a steering angle sensor 4b that detects the steering angle, a torque sensor 4c that detects the steering torque borne by the driver (called steering burden torque, to be distinguished from steering assist torque), and the like.

[0019] The controller 1 controls an electric parking brake device 3c provided on the rear wheels of the vehicle V. The electric parking brake device 3c has a mechanism for locking the rear wheels. The controller 1 can control the electric parking brake device 3c to lock and unlock the rear wheels.

[0020] The controller 1 controls an information output device 5 that notifies the driver of information inside the vehicle. The information output device 5 includes, for example, a display device 5a that notifies the driver of information by image and / or an audio output device 5b that notifies the driver of information by audio. The display device 5a includes, for example, a display device provided on the instrument panel or a display device provided on the steering wheel ST. The display device 5a may also include a head-up display. The information output device 5 may notify the occupants of information by vibration or light.

[0021] The controller 1 receives instruction inputs from a passenger (e.g., the driver) via the input device 6. The input device 6 is arranged in a position operable by the driver, and includes, for example, a group of switches 6a through which the driver issues instructions to the vehicle V, and / or a turn signal lever 6b that activates a turn signal (blinker).

[0022] The controller 1 recognizes and determines the current position and course (attitude) of the vehicle V. In this embodiment, the vehicle V is provided with a gyro sensor 7a, a GNSS (Global Navigation Satellite System) sensor 7b, and a communication device 7c. The gyro sensor 7a detects the rotational motion (yaw rate) of the vehicle V. The GNSS sensor 7b detects the current position of the vehicle V. The communication device 7c wirelessly communicates with a server that provides map information and traffic information to acquire this information. In this embodiment, the controller 1 determines the course of the vehicle V based on the detection results of the gyro sensor 7a and the GNSS sensor 7b, and sequentially acquires map information related to the course from the server via the communication device 7c and stores it in a database 7d (storage device). The vehicle V may be provided with other sensors for detecting the state of the vehicle V, such as an acceleration sensor that detects the acceleration of the vehicle V.

[0023] The controller 1 performs driving assistance for the vehicle V based on the detection results of various detection units provided in the vehicle V. The vehicle V is provided with surrounding detection units 8a to 8b, which are external sensors that detect the outside of the vehicle V (surrounding conditions), and interior detection units 9a to 9b, which are interior sensors that detect the conditions inside the vehicle (the conditions of the occupants (particularly the driver)). The controller 1 is able to grasp the surrounding conditions of the vehicle V based on the detection results of the surrounding detection units 8a to 8b, and perform driving assistance in accordance with the surrounding conditions. Furthermore, the controller 1 is able to determine, based on the detection results of the interior detection units 9a to 9b, whether the driver is performing the predetermined operational obligations imposed on the driver when driving assistance is performed.

[0024] The surroundings detection unit 8a is an imaging device that captures images in front of the vehicle V (hereinafter, sometimes referred to as the front camera 8a), and is attached, for example, to the inside of the passenger compartment of the windshield at the front of the roof of the vehicle V. The controller 1 can extract the contours of targets and lane markings (white lines, etc.) on the road by analyzing the images captured by the front camera 8a.

[0025] The surroundings detection unit 8b is a millimeter wave radar (hereinafter, may be referred to as radar 8b), and uses radio waves to detect targets around the vehicle V, and detect (measure) the distance to the target and the direction (azimuth) of the target relative to the vehicle V. In the example shown in FIG. 1, five radars 8b are provided: one in the center of the front of the vehicle V, one at each of the left and right corners of the front, and one at each of the left and right corners of the rear.

[0026] The surrounding detection unit installed in the vehicle V is not limited to the above configuration, and the number of cameras and the number of radars may be changed, or a lidar (Light Detection and Ranging: LIDAR) may be installed to detect targets around the vehicle V.

[0027] The in-vehicle detection unit 9a is an imaging device that captures images of the interior of the vehicle (hereinafter, sometimes referred to as in-vehicle camera 9a), and is attached, for example, to the inside of the vehicle cabin at the front of the roof of the vehicle interior V. In this embodiment, the in-vehicle camera 9a is a driver monitor camera that captures images of the driver (for example, the driver's eyes and face). The controller 1 can determine the driver's line of sight and facial direction by analyzing the image (image of the driver's face) captured by the in-vehicle camera 9a.

[0028] The in-vehicle detection unit 9b is a grip sensor that detects the driver's grip of the steering wheel ST (hereinafter, may be referred to as grip sensor 9b), and is provided, for example, on at least a part of the steering wheel ST. Note that the torque sensor 4c that detects the driver's steering torque may be used as the in-vehicle detection unit.

[0029] <Configuration of information processing system> FIG. 2 is a diagram showing an example configuration of an information processing system according to one embodiment. The information processing system 10 includes an information processing device 20 and a vehicle V, and detects tampering of vehicle data. The information processing device 20 and the vehicle V are connected via a network 30. The information processing device 20 is a server device external to the vehicle V, and is configured, for example, by a PC. The information processing device 20 can perform various processes based on information acquired from the vehicle V. The network 30 is a network such as a WAN / LAN. The information processing device 20 and the vehicle V can communicate with each other via the network 30 via a wired and / or wireless connection.

[0030] <Hardware configuration of information processing device> Next, an example of the hardware configuration of the information processing device 20 according to an embodiment will be described with reference to Fig. 3. As shown in Fig. 3, the information processing device 20 includes a CPU 201, a storage device 202, a communication unit 203, a display unit 204, and an operation input unit 205. The control operation of the information processing device 20 is realized by the CPU 201 reading and executing a computer program stored in the storage device 202.

[0031] The CPU 201 may be one or more CPUs. The storage device 202 is one or more memories that store various types of information. For example, it stores information received from other devices, computer programs that are read and executed by the CPU 201, etc. The communication unit 203 has a function of communicating with other devices via the network 30 in a wired and / or wireless manner. The communication unit 203 may also be capable of communicating with nearby devices via near field communication. The display unit 204 is a liquid crystal display or the like, and displays various types of information. The operation input unit 205 is, for example, a mouse, keyboard, touch panel, switch, etc., and can accept input of various types of information from the user.

[0032] <Functional configuration of the control device CNT equipped in the vehicle> An example of the functional configuration of a control device CNT provided in a vehicle V according to one embodiment will be described with reference to Fig. 4. The control device CNT includes a vehicle data acquisition unit 401, a first tampering detection unit 402, and a transmission unit 403. Each function of the control device CNT is executed by an ECU.

[0033] The vehicle data acquisition unit 401 acquires various vehicle data measured and / or calculated by various sensors of the vehicle V. Examples of the vehicle data include, but are not limited to, a transmission vehicle speed VT, a wheel speed VW, a YAW angular velocity, a motor regenerative torque allocation value, and a motor regenerative torque allocation upper limit value. Details of each vehicle data will be described later.

[0034] The first tamper detection unit 402 detects the possibility that the vehicle data has been tampered with, using the vehicle data acquired by the vehicle data acquisition unit 401. The first tamper detection unit 402 detects the possibility of tampering using a method that is relatively simple compared to the second tamper detection unit 502 described later. In this embodiment, the possibility of tampering of the vehicle data is detected based on two pieces of vehicle data. The physical quantities of the two pieces of vehicle data may be the same type. For example, they may be the transmission vehicle speed VT and the wheel speed VW. Alternatively, they may be the yaw angular velocity and a comparison value (the same physical quantity as the yaw angular velocity) derived from vehicle data different from the yaw angular velocity. Alternatively, they may be the motor regenerative torque allocation value and the motor regenerative torque allocation upper limit value.

[0035] When the first tampering detection unit 402 detects that there is a possibility of tampering, the transmission unit 403 transmits the logging data of the vehicle V, which includes the vehicle data and evaluation data for evaluating the vehicle data, to the information processing device 20.

[0036] <First tampering detection process (simple detection process)> Here, the transmission vehicle speed VT is speed data of the vehicle V derived from measurement data related to the transmission, and is the vehicle speed calculated from the rotational speed of the motor shaft, the dynamic radius of the tires, etc. The transmission vehicle speed VT can be calculated, for example, by the following equation (1).

[0037] VT = (2π × tire dynamic radius × 60 / 1000) × (FIN Dr / FIN Dn) × (MOT Dr / MOT Dn) × rotational speed … (1) Here, VT is the transmission vehicle speed [km / h], tire dynamic radius [m], FIN Dr is the final drive gear [teeth], and FIN Dn is the final driven gear [teeth]. Also, MOT Dr is the motor drive gear [teeth], MOT Dn is the motor driven gear [teeth], and rotational speed (communication value) [rpm]. The "final" gear is the gear that is ultimately connected to the wheels among multiple gears. According to equation (1), the transmission vehicle speed VT can be calculated using the rotational speed of the motor shaft as an input.

[0038] The wheel speed is a vehicle speed calculated from the rotational speed of the wheel, the circumference of the wheel, etc. The wheel speed may be, for example, an average value of the left and right front wheels. This reduces the influence of the speed difference between the left and right wheels. The wheel rotational speed may be obtained from a sensor value provided on each wheel.

[0039] When the vehicle data is transmission vehicle speed and wheel speed, the first tampering detection unit 402 determines whether the absolute value of the difference between the transmission vehicle speed and the wheel speed is equal to or greater than a threshold value (e.g., 20 km / h). If the absolute value of the difference is equal to or greater than the threshold value, it determines that there is a possibility that either the transmission vehicle speed or the wheel speed has been tampered with. This makes it possible to detect the possibility of tampering even when a large change in value occurs within the design value that cannot be detected by normal fault detection.

[0040] Next, the yaw angular velocity ω indicates the amount of change in the yaw angle per unit time. Since sin(θ)=L / R as shown in FIG. 7, the yaw angular velocity ω is calculated, for example, by the following equation (2).

[0041] ω=V / R=V×{sin(θ) / L} …(2) Here, YAW angular velocity: ω [rad], vehicle speed: V [m / s], lateral G: a [m / s 2 ], vehicle turning radius: R (rad), wheelbase: L [m], tire steering angle: θ [rad]. 2 is calculated using the following formula (3).

[0042] ω 2 =a / R=a×{sin(θ) / L} …(3) When the vehicle data is the yaw angular velocity ω and its comparison value, the first tampering detection unit 402 detects whether the difference between the yaw angular velocity and comparison value 1 is equal to or greater than a threshold value (for example, 5.5 deg / s), and whether the difference between the square of the yaw angular velocity and comparison value 2 is equal to or greater than a threshold value (for example, 5.5 2 degree 2 / s 2 ) are satisfied.

[0043] If both conditions are satisfied, it is determined that the YAW angular velocity ω may have been tampered with.

[0044] Here, the comparison value 1 and the comparison value 2 are calculated from the following formulas (4) and (5), respectively.

[0045] Comparison value 1 [deg / s] = Drive motor rotation direction × {Wheel speed [m / s] / Rotation radius [m]} × (180 / π) ... (4) Comparison value 2 [deg / s] 2 ={Left-right acceleration [m / s 2 ] / Rotation radius [m]}×(180 / π) 2 …(5) The radius of rotation in equations (4) and (5) is calculated by the following equation (6).

[0046] Turning radius [m] = wheelbase [m] × sin {ratio of steering angle to tire angle × (π / 180) × steering angle [deg]) … (6) In equations (4) to (6), values ​​acquired as vehicle data are used for the wheel speed, lateral acceleration, and steering angle.

[0047] Next, the motor regenerative torque allocation value is a torque for subtracting the braking torque of the motor regenerative portion from the brake. The motor regenerative torque allocable upper limit value is a torque that allows the braking torque to be subtracted from the brake, and typically satisfies the relationship "motor regenerative torque allocable upper limit value>motor regenerative torque allocation value." As shown in Figure 8, the motor regenerative torque allocable upper limit value is calculated from the vehicle required braking torque. Then, the motor torque and the motor regenerative torque allocation value are calculated from the motor regenerative torque practicable upper limit value and the motor regenerative torque allocable upper limit value. The brake torque is generated by subtracting the motor regenerative torque allocation value from the vehicle required braking torque.

[0048] As shown in FIG. 9, if the motor regenerative torque allocation value is tampered with as in pattern 1, the torque indicated by "1" is excessively subtracted, resulting in poor braking effectiveness. If the motor regenerative torque allocation value is tampered with as in pattern 2, the torque indicated by "2" is excessively subtracted, resulting in slightly poor braking effectiveness. If the motor regenerative torque allocation value is tampered with as in pattern 3, the torque indicated by "3" is excessively added, resulting in slightly excessive braking effectiveness. Here, if "motor regenerative torque allocation upper limit value < motor regenerative torque allocation value," it is possible to detect that pattern 1 tampering has occurred. On the other hand, although tampering with patterns 2 and 3 cannot be detected, the impact on the vehicle is relatively small.

[0049] When the vehicle data is a motor regenerative torque allocation value and a motor regenerative torque allocable upper limit value, the first falsification detection unit 402 determines whether or not "motor regenerative torque allocable upper limit value<motor regenerative torque allocation value." If "motor regenerative torque allocable upper limit value<motor regenerative torque allocation value," it determines that the motor regenerative torque allocation value may have been falsified.

[0050] FIG. 13 is an explanatory diagram of an example of the first tampering detection process according to this embodiment. The first tampering detection unit 402 of the control device CNT of the vehicle V acquires two vehicle data (vehicle data A, vehicle data B) and detects the possibility of tampering with the vehicle data from changes in the vehicle data. Here, vehicle data A is a motor regenerative torque allocation value, and vehicle data B is a motor regenerative torque allocation upper limit value. As described above, if the data has not been tampered with, the relationship "motor regenerative torque allocation upper limit value (vehicle data B)>motor regenerative torque allocation value (vehicle data A)" holds.

[0051] Before time T1, the relationship "motor regenerative torque allocable upper limit value (vehicle data B) > motor regenerative torque allocation value (vehicle data A)" is maintained, and no tampering has occurred. However, at time T1, "motor regenerative torque allocable upper limit value (vehicle data B) < motor regenerative torque allocation value (vehicle data A)" is established, and the possibility of tampering is detected (simple tampering detection).

[0052] <Example of evaluation data> Next, an example of evaluation data will be described. The evaluation data is data for evaluating vehicle data, and the physical quantities of the vehicle data may be different types of physical quantities from the physical quantities of the evaluation data. By inputting one or more pieces of evaluation data into a pre-trained prediction model, predicted and calculated vehicle data (predicted values) is obtained.

[0053] When the vehicle data is a transmission vehicle speed and a wheel speed, the evaluation data for evaluating the transmission vehicle speed may include engine torque, engine water temperature, and axle torque, as shown in Fig. 10. Also, the evaluation data for evaluating the wheel speed may include engine torque, engine water temperature, and accelerator pedal position.

[0054] When the vehicle data is a yaw angular velocity and its comparison value, the evaluation data for evaluating the yaw angular velocity may include steering torque, steering angular velocity, and accelerator pedal position, as shown in Fig. 11. The yaw angular velocity is compared with comparison value 1 and comparison value 2 as described above, and the wheel speed and steering angle are used to calculate comparison value 1, while the lateral acceleration and steering angle are used to calculate comparison value 2.

[0055] The evaluation data for evaluating the wheel speed may include engine torque, engine water temperature, and accelerator pedal position. The evaluation data for evaluating the lateral acceleration may include steering torque, steering angular velocity, and axle torque. The evaluation data for evaluating the steering angle may include engine rotation speed, steering torque, and engine water temperature.

[0056] When the vehicle data is a motor regenerative torque allocation value and a motor regenerative torque allocable upper limit value, the evaluation data for evaluating the motor regenerative torque allocation value may include longitudinal acceleration, braking force, and engine speed, as shown in Fig. 12. Furthermore, the evaluation data for evaluating the motor regenerative torque allocable upper limit value may include longitudinal acceleration, braking force, and engine water temperature.

[0057] 13, because the possibility of tampering was detected at time T1, data logging is performed for a fixed period of time from time T1 to time T2. The logging data acquired here is the motor regenerative torque allocation value and the motor regenerative torque allocation upper limit value, which are vehicle data. The logging data also includes longitudinal acceleration, braking force, and engine speed, which are evaluation data for evaluating the motor regenerative torque allocation value, and longitudinal acceleration, braking force, and engine water temperature, which are evaluation data for evaluating the motor regenerative torque allocation upper limit value.

[0058] <Configuration of information processing device> Next, an example of the functional configuration of an information processing device according to an embodiment will be described with reference to Fig. 5. The information processing device 20 includes a receiving unit 501, a second tampering detection unit 502, and a notification unit 503. Each function of the information processing device 20 is executed by a CPU 201.

[0059] The receiving unit 501 receives logging data transmitted from the transmitting unit 403 of the control device CNT of the vehicle V. The logging data includes vehicle data and evaluation data for evaluating the vehicle data. When the receiving unit 501 receives logging data, the second tampering detection unit 502 performs detailed tampering detection processing to detect tampering of the vehicle data based on the evaluation data, since there is a possibility that the vehicle data has been tampered with. Specifically, as shown in FIG. 14, one or more evaluation data are input to a prediction model (e.g., a machine-learned model), which outputs a predicted value of the corresponding vehicle data. Then, the predicted value is compared with the vehicle data, which is an actual measurement value, to determine whether the vehicle data has been tampered with. For example, if the actual measurement value differs from the predicted value by a threshold or more, it may be determined that the vehicle data has been tampered with. Various prediction models are prepared by learning them in advance for each set of input evaluation data.

[0060] When tampering is detected by the second tampering detection unit 502, the notification unit 503 notifies the fact. If the information processing device 20 is a PC, the notification may be made by displaying on the display unit 204, or by outputting a warning sound from a speaker. Alternatively, the notification unit 503 may send a warning to the vehicle V, and the vehicle V may notify the occurrence of tampering (by displaying and / or outputting a warning sound).

[0061] <Second tampering detection process (detailed detection process)> A case where the vehicle data is transmission vehicle speed and wheel speed will be described. The second tampering detection unit 502 first inputs the engine torque, engine water temperature, and axle torque values, which are evaluation data for evaluating the transmission vehicle speed, into a prediction model in advance to obtain a predicted value of the transmission vehicle speed. The second tampering detection unit 502 compares the obtained predicted value of the transmission vehicle speed with the transmission vehicle speed (measured value) included in the logging data received by the receiving unit 501. The second tampering detection unit 502 then determines whether the difference between the two is within a threshold range (for example, within an arbitrary numerical value % between 5% and 10%). If the difference exceeds the threshold range, it determines that the transmission vehicle speed (measured value) has been tampered with. At this time, it may be determined that tampering has occurred if the difference exceeds the threshold range continuously for a predetermined time or more. If the difference exceeds the threshold range as an instantaneous value, there is a possibility of erroneous detection. By determining whether the difference exceeds the threshold range continuously for a predetermined time or more, erroneous detection can be suppressed.

[0062] Furthermore, the second tampering detection unit 502 inputs the engine torque, engine water temperature, and accelerator pedal position, which are evaluation data for evaluating the wheel speed, into a prediction model in advance to obtain a predicted value of the wheel speed. The second tampering detection unit 502 compares the obtained predicted value of the wheel speed with the wheel speed (measured value) included in the logging data received by the receiving unit 501, and determines whether the difference between them is within a threshold range (for example, within an arbitrary numerical value % between 5% and 10%). If the difference exceeds the threshold range, it is determined that the wheel speed (measured value) has been tampered with. At this time, it may be determined that tampering has occurred if the difference exceeds the threshold range continuously for a predetermined time or more. If the difference exceeds the threshold range as an instantaneous value, there is a possibility of erroneous detection. By determining whether the difference exceeds the threshold range continuously for a predetermined time or more, erroneous detection can be suppressed.

[0063] In the first tampering detection process (simple detection process), because it only focused on the difference between the transmission vehicle speed and the wheel speed, even if it could detect the possibility of tampering, it could not identify which vehicle data had been tampered with. In contrast, by performing the second tampering detection process (detailed detection process), it becomes possible to specifically identify which of the transmission vehicle speed and the wheel speed has been tampered with.

[0064] Next, a case where the vehicle data is a yaw angular velocity and its comparison value will be described. The second tampering detection unit 502 inputs the steering torque, steering angular velocity, and accelerator pedal position, which are evaluation data for evaluating the yaw angular velocity, into a prediction model in advance to obtain a predicted value of the yaw angular velocity. The second tampering detection unit 502 compares the obtained predicted value of the yaw angular velocity with the yaw angular velocity (measured value) included in the logging data received by the receiving unit 501. Then, it determines whether the difference between the two is within a threshold range (for example, within an arbitrary numerical value % between 5% and 10%). If the difference exceeds the threshold range, it determines that the yaw angular velocity (measured value) has been tampered with. At this time, it may be determined that tampering has occurred if the difference exceeds the threshold range continuously for a predetermined time or more. If the difference exceeds the threshold range as an instantaneous value, there is a possibility of erroneous detection. By determining whether the difference exceeds the threshold range continuously for a predetermined time or more, erroneous detection can be suppressed.

[0065] According to the above-described equations (4) and (6), the vehicle data for calculating the comparison value 1 includes the wheel speed and the steering angle. That is, the vehicle data for evaluating the comparison value 1 includes the vehicle data for evaluating the wheel speed and the vehicle data for evaluating the steering angle. As shown in FIG. 11, the vehicle data for evaluating the wheel speed includes the engine torque, the engine water temperature, and the accelerator pedal position. The vehicle data for evaluating the steering angle includes the engine speed, the steering torque, and the engine water temperature.

[0066] The second tampering detection unit 502 inputs the vehicle data for evaluating the wheel speed, such as engine torque, engine water temperature, and accelerator pedal position, into a prediction model in advance to obtain a predicted value of the wheel speed. The second tampering detection unit 502 compares the obtained predicted value of the wheel speed with the wheel speed (actual measured value) included in the logging data received by the receiving unit 501, and determines whether the difference between the two is within a threshold range (for example, within an arbitrary numerical value between 5% and 10%).

[0067] Similarly, the second tampering detection unit 502 inputs the vehicle data for evaluating the steering angle, such as the engine speed, steering torque, and engine water temperature, into a prediction model in advance to obtain a predicted value of the steering angle. The second tampering detection unit 502 compares the obtained predicted value of the steering angle with the steering angle (actual measured value) included in the logging data received by the receiving unit 501. Then, it determines whether the difference between the two is within a threshold range (for example, within an arbitrary numerical value % between 5% and 10%).

[0068] The second tamper detection unit 502 may determine that the comparison value 1 has been tampered with when at least one of the wheel speed and the steering angle exceeds a threshold range. According to the above-described formulas (5) and (6), the vehicle data for calculating the comparison value 2 includes the lateral acceleration and the steering angle. That is, the vehicle data for evaluating the comparison value 2 includes vehicle data for evaluating the lateral acceleration (lateral acceleration) of the vehicle V and vehicle data for evaluating the steering angle. As shown in FIG. 11, the vehicle data for evaluating the lateral acceleration of the vehicle includes the steering torque, the steering angular velocity, and the axle torque. The vehicle data for evaluating the steering angle includes the engine speed, the steering torque, and the engine water temperature.

[0069] The second tampering detection unit 502 inputs the vehicle data for evaluating the lateral acceleration, such as the steering torque, steering angular velocity, and axle torque, into a prediction model in advance to obtain a predicted value of the lateral acceleration. The second tampering detection unit 502 compares the obtained predicted value of the lateral acceleration with the lateral acceleration (actual measured value) included in the logging data received by the receiving unit 501, and determines whether the difference between the two is within a threshold range (for example, within an arbitrary numerical value between 5% and 10%).

[0070] Similarly, the second tampering detection unit 502 inputs the vehicle data for evaluating the steering angle, such as the engine speed, steering torque, and engine water temperature, into a prediction model in advance to obtain a predicted value of the steering angle. The second tampering detection unit 502 compares the obtained predicted value of the steering angle with the steering angle (actual measured value) included in the logging data received by the receiving unit 501. Then, it determines whether the difference between the two is within a threshold range (for example, within an arbitrary numerical value % between 5% and 10%).

[0071] Then, the second tampering detection unit 502 may determine that comparison value 2 has been tampered with when at least one of the lateral acceleration and the steering angle exceeds a threshold range. For example, when it is determined that comparison value 1 and comparison value 2 have not been tampered with and the yaw angular velocity has been tampered with, the second tampering detection unit 502 may determine that the yaw angular velocity has been tampered with. Alternatively, regardless of the possibility of tampering of comparison value 1 and comparison value 2, the second tampering detection unit 502 may determine that the yaw angular velocity has been tampered with when it is determined that the yaw angular velocity has been tampered with.

[0072] Next, a case where the vehicle data is a motor regenerative torque allocation value and a motor regenerative torque allocable upper limit value will be described. The second tampering detection unit 502 inputs the values ​​of longitudinal acceleration, braking force, and engine speed, which are evaluation data for evaluating the motor regenerative torque allocation value, into a prediction model in advance to obtain a predicted value of the motor regenerative torque allocation value. The second tampering detection unit 502 compares the obtained predicted value of the motor regenerative torque allocation value with the motor regenerative torque allocation value (actual value) included in the logging data received by the receiving unit 501. The second tampering detection unit 502 then determines whether the difference between the two is within a threshold range (for example, within an arbitrary numerical value % between 5% and 10%). If the difference exceeds the threshold range, the second tampering detection unit 502 determines that the motor regenerative torque allocation value (actual value) has been tampered with. At this time, it may be determined that tampering has occurred if the difference exceeds the threshold range continuously for a predetermined time or more. If the difference exceeds the threshold range as an instantaneous value, there is a possibility of erroneous detection. By determining whether the difference exceeds the threshold range for a predetermined period of time or more, false detection can be suppressed.

[0073] Similarly, the second tampering detection unit 502 inputs the values ​​of longitudinal acceleration, braking force, and engine water temperature, which are evaluation data for evaluating the motor regenerative torque allocable upper limit, into a prediction model in advance to obtain a predicted value of the motor regenerative torque allocable upper limit. The second tampering detection unit 502 compares the obtained predicted value of the motor regenerative torque allocable upper limit with the motor regenerative torque allocable upper limit (measured value) included in the logging data received by the receiving unit 501. The second tampering detection unit 502 then determines whether the difference between the two is within a threshold range (for example, within an arbitrary numerical value between 5% and 10%). If the difference exceeds the threshold range, the second tampering detection unit 502 determines that the motor regenerative torque allocable upper limit (measured value) has been tampered with. At this time, it may be determined that tampering has occurred if the difference exceeds the threshold range continuously for a predetermined time or more. If the difference exceeds the threshold range as an instantaneous value, there is a possibility of erroneous detection. By determining whether the difference exceeds the threshold range continuously for a predetermined time or more, erroneous detection can be suppressed.

[0074] Each prediction model in the above description is a model prepared in advance for each combination of evaluation data that serves as input data. For example, a machine-learned model is used as the prediction model.

[0075] <Processing sequence of information processing system> Next, processing of the information processing system according to one embodiment will be described with reference to the processing sequence of Fig. 6. In F601, the vehicle data acquisition unit 401 of the control device CNT of the vehicle V acquires various vehicle data measured and / or calculated by the vehicle V. The vehicle data is acquired over time (for example, at predetermined time intervals). In F602, the first tampering detection unit 402 of the control device CNT of the vehicle V uses the vehicle data acquired by the vehicle data acquisition unit 401 in F601 to detect the possibility of tampering with the vehicle data based on the two vehicle data (simple detection).

[0076] In F603, when the first tampering detection unit 402 detects in F602 that there is a possibility of tampering, the transmission unit 403 of the control device CNT of the vehicle V transmits the logging data of the vehicle V to the information processing device 20. The logging data includes vehicle data and evaluation data for evaluating the vehicle data. The logging data may be data acquired over a certain time range from the time when there is a detection that there is a possibility of tampering.

[0077] In F604, the second tampering detection unit 502 detects tampering of the vehicle data (detailed detection) based on the evaluation data and the prediction model included in the logging data received by the receiving unit 501. Also, it identifies which vehicle data has been tampered with.

[0078] In F605, if tampering is detected, the notification unit 503 notifies the detection result of the second tampering detection unit 502. For example, the notification unit 503 may notify the user of the occurrence of tampering or information related to the tampered vehicle data. The notification unit 503 may notify the user via the display unit 204 of the information processing device 20, or may notify the user in the form of an audio warning, or a combination of these. The notification unit 503 may also send a warning to the vehicle V, which may notify the user of the occurrence of tampering (by displaying and / or outputting an audio warning). Furthermore, the notification unit 503 may urge the user to contact a dealer or the like of the vehicle V. This completes the processing sequence of FIG. 6.

[0079] As described above, in this embodiment, a simple detection process is performed to detect the possibility of tampering with vehicle data based on a comparison of two sets of vehicle data. Then, if it is determined that there is a possibility of tampering, a detailed detection process is performed to detect tampering with the vehicle data based on evaluation data for evaluating the vehicle data.

[0080] In this way, by detecting the possibility of tampering with simple, low-load processing and performing detailed, high-load processing only when there is a possibility of tampering, it is possible to reduce the processing load during normal times when the possibility of tampering is low.

[0081] Furthermore, if a simple tampering detection process is performed in the vehicle V and the possibility of tampering is detected, the logging data is acquired and transmitted to an external information processing device, which then performs detailed tampering detection processing. This reduces the processing load on the vehicle V, allowing the resources of the vehicle V to be effectively used for other processes.

[0082] Furthermore, it is possible to detect tampering even when a large change in value occurs within the design value, which cannot be detected by normal fault detection.

[0083] [Variations] In the above embodiment, an example has been described in which the control device CNT of the vehicle V performs simple tampering detection processing and the information processing device 20 performs detailed tampering detection processing, but the present invention is not limited to this example. The control device CNT of the vehicle V may be configured to perform both processes. Alternatively, data may be transmitted from the vehicle V to the information processing device 20 over time, and the information processing device 20 may be configured to perform both processes. In other words, the information processing system 10 may operate solely as the vehicle V (control device CNT) or the information processing device 20 alone.

[0084] In the above embodiment, several examples of vehicle data and evaluation data for evaluating the vehicle data are given, but the present invention is not limited to these examples. Any vehicle data may be applied as long as the physical quantities of the two vehicle data are the same type. Furthermore, any evaluation data may be applied as long as the vehicle data can be evaluated.

[0085] In the above embodiment, an example has been described in which the notification unit 503 issues a notification when tampering is detected by the second tampering detection unit 502. The vehicle V may issue a notification when the first tampering detection unit 402 detects the possibility of tampering. Information indicating that tampering is suspected may be displayed and / or notified by voice. Furthermore, the logging data may be transmitted to the information processing device 20 or notified. This allows the user of the vehicle V to easily recognize the possibility of tampering while in the vehicle.

[0086] Furthermore, in the above embodiment, a four-wheeled vehicle has been mainly used as an example of a vehicle, but the present invention can be applied to other moving bodies such as a two-wheeled vehicle, a bipedal robot, a quadrupedal robot, a drone, etc. Furthermore, in the above embodiment, a vehicle has been mainly used as an example of a vehicle, but the vehicle may include all moving bodies such as a drone, a robot, etc.

[0087] <Summary of the embodiment> 1. The information processing system according to the above embodiment is An information processing system (10) for detecting tampering of vehicle data, a vehicle data acquisition means (401) for acquiring first vehicle data and second vehicle data; a first tampering detection means (402) for detecting the possibility of tampering with the vehicle data based on the first vehicle data and the second vehicle data; a second tampering detection means (502) for detecting tampering of the first vehicle data based on first evaluation data for evaluating the first vehicle data when the first tampering detection means detects the possibility of tampering, and for detecting tampering of the second vehicle data based on second evaluation data for evaluating the second vehicle data; An information processing system comprising:

[0088] In this way, a simple tampering detection process based on simple data comparison is performed, and if there is a possibility of tampering, a more detailed tampering detection process is performed, thereby reducing the processing load and accurately detecting tampering with vehicle data.

[0089] 2. In the information processing system according to the above embodiment, The physical quantity of the first vehicle data is of the same type as the physical quantity of the second vehicle data.

[0090] This makes it easy to compare data from two vehicles.

[0091] 3. In the information processing system according to the above embodiment, The physical quantity of the first vehicle data is of a different type from the physical quantity of the first evaluation data.

[0092] In this way, by using a type of physical quantity different from the vehicle data as evaluation data, it becomes possible to indirectly determine whether the vehicle data has been tampered with.

[0093] 4. In the information processing system according to the above embodiment, The physical quantity of the second vehicle data is of a different type from the physical quantity of the second evaluation data.

[0094] In this way, by using a type of physical quantity different from the vehicle data as evaluation data, it becomes possible to indirectly determine whether the vehicle data has been tampered with.

[0095] 5. In the information processing system according to the above embodiment, The second tamper detection means Detecting tampering of the first vehicle data based on the first evaluation data and a first prediction model; Falsification of the second vehicle data is detected based on the second evaluation data and a second prediction model.

[0096] This makes it possible to determine whether the vehicle data has been tampered with by, for example, inputting evaluation data into a prediction model to obtain a predicted value of the vehicle data and comparing it with the actual measured value of the vehicle data.

[0097] 6. In the information processing system according to the above embodiment, the first vehicle data includes a transmission vehicle speed; The second vehicle data includes a wheel speed.

[0098] This allows two different types of vehicle speed data to be acquired and compared, thereby making it possible to detect the possibility of tampering with the vehicle speed data.

[0099] 7. In the information processing system according to the above embodiment, The first evaluation data is vehicle data for evaluating the transmission vehicle speed.

[0100] This makes it possible to determine whether the transmission vehicle speed has been tampered with.

[0101] 8. In the information processing system according to the above embodiment, The vehicle data for estimating the transmission vehicle speed includes engine torque, engine water temperature, and axle torque.

[0102] This makes it possible to determine whether the transmission vehicle speed has been tampered with.

[0103] 9. In the information processing system according to the above embodiment, The second evaluation data is vehicle data for evaluating the wheel speed.

[0104] This makes it possible to determine whether the wheel speeds have been tampered with.

[0105] 10. In the information processing system according to the above embodiment, The vehicle data for estimating the wheel speed includes engine torque, engine water temperature, and accelerator pedal position.

[0106] This makes it possible to determine whether the wheel speeds have been tampered with.

[0107] 11. In the information processing system according to the above embodiment, the first vehicle data includes a YAW angular velocity; The second vehicle data includes a first comparison value of the yaw angular velocity based on a wheel speed and a steering angle, and a second comparison value of the yaw angular velocity based on a left-right acceleration of the vehicle and the steering angle.

[0108] This makes it possible to detect the possibility of tampering with the yaw angular velocity or each comparison value using the pair of the yaw angular velocity and the first comparison value and the pair of the yaw angular velocity and the second comparison value.

[0109] 12. In the information processing system according to the above embodiment, The first evaluation data is vehicle data for evaluating the yaw angular velocity.

[0110] This makes it possible to determine whether the YAW angular velocity has been tampered with.

[0111] 13. In the information processing system according to the above embodiment, The vehicle data for estimating the yaw angular velocity includes steering torque, steering angular velocity, and accelerator pedal position.

[0112] This makes it possible to determine whether the YAW angular velocity has been tampered with.

[0113] 14. In the information processing system according to the above embodiment, The second evaluation data is vehicle data for evaluating the first comparison value and the second comparison value.

[0114] This makes it possible to determine whether the comparison value has been tampered with.

[0115] 15. In the information processing system according to the above embodiment, The vehicle data for evaluating the first comparison value includes vehicle data for evaluating the wheel speed and vehicle data for evaluating the steering angle.

[0116] This makes it possible to determine whether or not the comparison value of the yaw angular velocity based on the wheel speed and the steering angle has been tampered with.

[0117] 16. In the information processing system according to the above embodiment, The vehicle data for estimating the wheel speed includes engine torque, engine water temperature, and accelerator pedal position.

[0118] This makes it possible to determine whether the wheel speeds have been tampered with.

[0119] 17. In the information processing system according to the above embodiment, The vehicle data for evaluating the steering angle includes engine speed, steering torque, and engine water temperature.

[0120] This makes it possible to determine whether the steering angle has been tampered with.

[0121] 18. In the information processing system according to the above embodiment, The vehicle data for evaluating the second comparison value includes vehicle data for evaluating the acceleration in the left-right direction of the vehicle, and vehicle data for evaluating the steering angle.

[0122] This makes it possible to determine whether or not other comparison values ​​of the yaw angular velocity based on the lateral acceleration and the steering angle have been tampered with.

[0123] 19. In the information processing system according to the above embodiment, The vehicle data for estimating the lateral acceleration of the vehicle includes a steering torque, a steering angular velocity, and an axle torque.

[0124] This makes it possible to determine whether or not the lateral acceleration has been tampered with.

[0125] 20. In the information processing system according to the above embodiment, The vehicle data for evaluating the steering angle includes engine speed, steering torque, and engine water temperature.

[0126] This makes it possible to determine whether the steering angle has been tampered with.

[0127] 21. In the information processing system according to the above embodiment, the first vehicle data includes a motor regenerative torque allocation value; the second vehicle data includes a motor regenerative torque allocable upper limit value; the motor regenerative torque allocation value is a torque for subtracting a regenerative torque of the motor from a brake; The motor regenerative torque allocable upper limit value is a torque that can be subtracted from the braking torque.

[0128] Thus, by comparing the motor regenerative torque allocation value with the motor regenerative torque allocation upper limit value, it is possible to detect the possibility of tampering with the motor regenerative torque allocation value.

[0129] 22. In the information processing system according to the above embodiment, The vehicle data for evaluating the motor regenerative torque allocation value includes the vehicle's longitudinal acceleration, braking force, and engine speed.

[0130] This makes it possible to determine whether the motor regenerative torque allocation value has been tampered with.

[0131] 23. In the information processing system according to the above embodiment, The vehicle data for evaluating the motor regenerative torque allocable upper limit value includes the acceleration in the longitudinal direction of the vehicle, the braking force, and the engine water temperature.

[0132] This makes it possible to determine whether or not the motor regenerative torque allocable upper limit value has been tampered with.

[0133] 24. The information processing system according to the above embodiment is The device further includes a notification means for making a notification based on the detection result of the second tampering detection means.

[0134] This allows the user (the user of the vehicle and / or the user of the information processing device) to recognize that the vehicle data has been tampered with.

[0135] 25. The control method for the information processing system according to the above embodiment is A control method for an information processing system (10) for detecting tampering of vehicle data, comprising: A step (F601) of acquiring first vehicle data and second vehicle data; a step (F602) of detecting the possibility of tampering with the vehicle data based on the first vehicle data and the second vehicle data; a step (F604) of detecting tampering of the first vehicle data based on first evaluation data for evaluating the first vehicle data, and detecting tampering of the second vehicle data based on second evaluation data for evaluating the second vehicle data, when the possibility of tampering is detected; It has.

[0136] In this way, a simple tampering detection process based on simple data comparison is performed, and if there is a possibility of tampering, a more detailed tampering detection process is performed, thereby reducing the processing load and accurately detecting tampering with vehicle data.

[0137] 26. The information processing system according to the above embodiment is An information processing system (10) comprising a vehicle (V) and an information processing device (20), and configured to detect tampering with vehicle data, The vehicle is a vehicle data acquisition means (401) for acquiring first vehicle data and second vehicle data; a first tampering detection means (402) for detecting the possibility of tampering with the vehicle data based on the first vehicle data and the second vehicle data; a transmitting means (403) for transmitting, when the possibility of tampering is detected, logging data of the vehicle including the first vehicle data, the second vehicle data, first evaluation data for evaluating the first vehicle data, and second evaluation data for evaluating the second vehicle data to the information processing device; Equipped with The information processing device includes: receiving means (501) for receiving the logging data from the vehicle; a second tampering detection means (502) for detecting tampering of the first vehicle data based on the first evaluation data when the logging data is received, and for detecting tampering of the second vehicle data based on the second evaluation data; Equipped with.

[0138] In this way, a simple tampering detection process based on simple data comparison is performed in the vehicle, and if there is a possibility of tampering, a more detailed tampering detection process is performed in an information processing device separate from the vehicle, thereby reducing the processing load on the vehicle and accurately detecting tampering with vehicle data.

[0139] 27. The control method for the information processing system according to the above embodiment is A control method for an information processing system (10) that includes a vehicle (V) and an information processing device (20) and detects tampering with vehicle data, comprising: A step (F601) in which the vehicle acquires first vehicle data and second vehicle data; a step (F602) of detecting, by the vehicle, the possibility of tampering with vehicle data based on the first vehicle data and the second vehicle data; a step (F603) of transmitting logging data of the vehicle, including the first vehicle data, the second vehicle data, first evaluation data for evaluating the first vehicle data, and second evaluation data for evaluating the second vehicle data, to the information processing device when the possibility of tampering is detected; a step (F603) in which the information processing device receives the logging data from the vehicle; a step (F604) by the information processing device, when the logging data is received, of detecting tampering of the first vehicle data based on the first evaluation data and detecting tampering of the second vehicle data based on the second evaluation data; It has.

[0140] In this way, a simple tampering detection process based on simple data comparison is performed in the vehicle, and if there is a possibility of tampering, a more detailed tampering detection process is performed in an information processing device separate from the vehicle, thereby reducing the processing load on the vehicle and accurately detecting tampering with vehicle data.

[0141] 28. The program according to the above embodiment is This is a program for causing a computer to function as the information processing system according to the above embodiment.

[0142] This makes it possible to realize the processing according to the above embodiment by a program.

[0143] 29. The storage medium according to the above embodiment is A storage medium storing a program for causing a computer to function as the information processing system according to the above embodiment.

[0144] This makes it possible to realize the processing according to the above embodiment on a storage medium.

[0145] <Other embodiments> Furthermore, a program for realizing one or more functions described in each embodiment can be supplied to a system or device via a network or a storage medium, and one or more processors in the computer of the system or device can read and execute the program. The present invention can also be realized in such an embodiment.

[0146] The invention is not limited to the above-described embodiment, and various modifications and variations are possible within the scope of the gist of the invention. [Explanation of symbols]

[0147] CNT: control device, V: vehicle, 1: controller, CNT: control device, 10: information processing system, 20: information processing device, 401: vehicle data acquisition unit, 402: first tampering detection unit, 403: transmission unit, 501: reception unit, 502: second tampering detection unit, 503: notification unit

Claims

1. An information processing system for detecting tampering with vehicle data, a vehicle data acquisition means for acquiring first vehicle data and second vehicle data; a first tampering detection means for detecting a possibility of tampering with the vehicle data based on the first vehicle data and the second vehicle data; a second tampering detection means for detecting tampering of the first vehicle data based on first evaluation data for evaluating the first vehicle data when the first tampering detection means detects the possibility of tampering, and for detecting tampering of the second vehicle data based on second evaluation data for evaluating the second vehicle data; An information processing system comprising:

2. 2. The information processing system according to claim 1, wherein the physical quantity of the first vehicle data is of the same type as the physical quantity of the second vehicle data.

3. 2. The information processing system according to claim 1, wherein the physical quantity of the first vehicle data is of a different type from the physical quantity of the first evaluation data.

4. 2. The information processing system according to claim 1, wherein the physical quantity of the second vehicle data is of a different type from the physical quantity of the second evaluation data.

5. The second tamper detection means Detecting tampering of the first vehicle data based on the first evaluation data and a first prediction model; Detecting falsification of the second vehicle data based on the second evaluation data and a second prediction model.

2. The information processing system according to claim 1, wherein:

6. the first vehicle data includes a transmission vehicle speed; The second vehicle data includes a wheel speed.

2. The information processing system according to claim 1, wherein:

7. 7. The information processing system according to claim 6, wherein the first evaluation data is vehicle data for evaluating the transmission vehicle speed.

8. 8. The information processing system according to claim 7, wherein the vehicle data for evaluating the transmission vehicle speed includes engine torque, engine water temperature, and axle torque.

9. 7. The information processing system according to claim 6, wherein the second evaluation data is vehicle data for evaluating the wheel speed.

10. 10. The information processing system according to claim 9, wherein the vehicle data for evaluating the wheel speed includes engine torque, engine water temperature, and accelerator pedal position.

11. the first vehicle data includes a YAW angular velocity; The second vehicle data includes a first comparison value of the yaw angular velocity based on a wheel speed and a steering angle, and a second comparison value of the yaw angular velocity based on a left-right acceleration of the vehicle and the steering angle.

2. The information processing system according to claim 1, wherein:

12. 12. The information processing system according to claim 11, wherein the first evaluation data is vehicle data for evaluating the yaw angular velocity.

13. 13. The information processing system according to claim 12, wherein the vehicle data for estimating the yaw angular velocity includes a steering torque, a steering angular velocity, and an accelerator pedal position.

14. 12. The information processing system according to claim 11, wherein the second evaluation data is vehicle data for evaluating the first comparison value and the second comparison value.

15. 15. The information processing system according to claim 14, wherein the vehicle data for evaluating the first comparison value includes vehicle data for evaluating the wheel speed and vehicle data for evaluating the steering angle.

16. 16. The information processing system according to claim 15, wherein the vehicle data for estimating the wheel speed includes engine torque, engine water temperature, and accelerator pedal position.

17. 16. The information processing system according to claim 15, wherein the vehicle data for evaluating the steering angle includes engine speed, steering torque, and engine water temperature.

18. 15. The information processing system according to claim 14, wherein the vehicle data for evaluating the second comparison value includes vehicle data for evaluating the acceleration in the left-right direction of the vehicle and vehicle data for evaluating the steering angle.

19. 19. The information processing system according to claim 18, wherein the vehicle data for evaluating the lateral acceleration of the vehicle includes a steering torque, a steering angular velocity, and an axle torque.

20. 19. The information processing system according to claim 18, wherein the vehicle data for evaluating the steering angle includes engine speed, steering torque, and engine water temperature.

21. the first vehicle data includes a motor regenerative torque allocation value; the second vehicle data includes a motor regenerative torque allocable upper limit value; the motor regenerative torque allocation value is a torque for subtracting a regenerative torque of the motor from a brake; 2. The information processing system according to claim 1, wherein the upper limit of the motor regenerative torque that can be allocated is a torque that can be subtracted from a braking torque.

22. 22. The information processing system according to claim 21, wherein the vehicle data for evaluating the motor regenerative torque allocation value includes longitudinal acceleration of the vehicle, braking force, and engine speed.

23. 22. The information processing system according to claim 21, wherein the vehicle data for evaluating the motor regenerative torque allocable upper limit value includes longitudinal acceleration of the vehicle, braking force, and engine water temperature.

24. 2. The information processing system according to claim 1, further comprising a notification unit that issues a notification based on the detection result of said second tampering detection unit.

25. A control method for an information processing system that detects tampering with vehicle data, comprising: acquiring first vehicle data and second vehicle data; detecting a possibility of tampering with the vehicle data based on the first vehicle data and the second vehicle data; when the possibility of tampering is detected, detecting tampering of the first vehicle data based on first evaluation data for evaluating the first vehicle data, and detecting tampering of the second vehicle data based on second evaluation data for evaluating the second vehicle data; 1. A method for controlling an information processing system, comprising:

26. An information processing system including a vehicle and an information processing device, and detecting tampering with vehicle data, The vehicle is a vehicle data acquisition means for acquiring first vehicle data and second vehicle data; a first tampering detection means for detecting a possibility of tampering with the vehicle data based on the first vehicle data and the second vehicle data; a transmitting means for transmitting, when the possibility of tampering is detected, logging data of the vehicle, including the first vehicle data, the second vehicle data, first evaluation data for evaluating the first vehicle data, and second evaluation data for evaluating the second vehicle data, to the information processing device; Equipped with The information processing device includes: receiving means for receiving the logging data from the vehicle; a second tampering detection means for detecting tampering of the first vehicle data based on the first evaluation data when the logging data is received, and for detecting tampering of the second vehicle data based on the second evaluation data; An information processing system comprising:

27. A control method for an information processing system including a vehicle and an information processing device, and detecting tampering with vehicle data, comprising: acquiring first vehicle data and second vehicle data by the vehicle; a step of detecting, by the vehicle, the possibility of tampering with vehicle data based on the first vehicle data and the second vehicle data; When the possibility of tampering is detected, the vehicle transmits logging data of the vehicle, including the first vehicle data, the second vehicle data, first evaluation data for evaluating the first vehicle data, and second evaluation data for evaluating the second vehicle data, to the information processing device; a step of receiving the logging data from the vehicle by the information processing device; a step in which, when the logging data is received, the information processing device detects tampering of the first vehicle data based on the first evaluation data and detects tampering of the second vehicle data based on the second evaluation data; 1. A method for controlling an information processing system, comprising:

28. A program for causing a computer to function as the information processing system according to any one of claims 1 to 24.

29. A storage medium storing a program for causing a computer to function as the information processing system according to any one of claims 1 to 24.

Images