Communication system, communication method, and vehicle

Abstract

To provide a technique for securing validity in data while reducing traffic from a server.SOLUTION: The server 200 stores data including first data and second data, first information for verifying the validity of the first data, and second information for verifying the validity of the second data. The server 200 transmits management information including the first information and the second information to the first vehicle 100a, and transmits the management information and the second information to the second vehicle 100b. The first car 100a receives the management information and the first date from the server 200, and the second car 100b receives the management information and the second date from the server 200. The first transportation vehicle 100a sends the first information to the second transportation vehicle 100b, and the second transportation vehicle 100b verifies the validity of the first information according to the first information in the management information after receiving the first information from the first transportation vehicle 100a.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to communication technology, and more particularly to a communication system, a communication method, and a vehicle that use vehicle-to-vehicle communication. [Background technology]

[0002] When a management server and multiple vehicles communicate, one of the multiple vehicles is designated as the representative node, and the rest are designated as non-representative nodes. The management server transmits job data to the representative node, and the representative node transmits the job data to non-representative nodes that exist within the communication range of the representative node. The non-representative nodes process the job data without communicating with the management server (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Publication No. 2023-48844 Summary of the Invention [Problem to be solved by the invention]

[0004] By transferring data between multiple vehicles via vehicle-to-vehicle communication, the amount of data transmitted from the management server is reduced. However, although non-representative nodes receive data from the representative node, it is unclear whether this data is data from the management server that was transferred by the representative node, or data that has been tampered with by the representative node. In other words, non-representative nodes cannot guarantee the validity of the data.

[0005] The present disclosure has been made in light of these circumstances, and its purpose is to provide a technology that ensures the validity of data while reducing the amount of communication from a server. [Means for solving the problem]

[0006] In order to solve the above problem, a communication system according to one aspect of the present disclosure includes a server that stores data including first data and second data, first information for verifying the legitimacy of the first data, and second information for verifying the legitimacy of the second data, and a first vehicle and a second vehicle that can communicate with the server. The server transmits management information including the first information and the second information and the first data to the first vehicle, and transmits the management information and the second data to the second vehicle. The first vehicle receives the management information and the first data from the server, and the second vehicle receives the management information and the second data from the server. The first vehicle transmits the first data to the second vehicle, and the second vehicle receives the first data from the first vehicle and then verifies the legitimacy of the first data using the first information included in the management information.

[0007] Another aspect of the present disclosure is also a communication system. The communication system includes: a first vehicle that stores data including first data and second data; a server that stores first information for verifying the legitimacy of the first data and second information for verifying the legitimacy of the second data; and a second vehicle that can communicate with the first vehicle and the server. The server transmits management information including the first information and the second information to the second vehicle, the second vehicle receives the management information from the server, the first vehicle transmits the first data to the second vehicle, and the second vehicle receives the first data from the first vehicle and then verifies the legitimacy of the first data using the first information included in the management information.

[0008] Yet another aspect of the present disclosure is a communication method between a server that stores data including first data and second data, first information for verifying the legitimacy of the first data, and second information for verifying the legitimacy of the second data, and a first vehicle and a second vehicle that can communicate with the server, the method including the steps of the server transmitting management information including the first information and the second information and the first data to the first vehicle and transmitting the management information and the second data to the second vehicle, the first vehicle receiving the management information and the first data from the server, the second vehicle receiving the management information and the second data from the server, the first vehicle transmitting the first data to the second vehicle, and the second vehicle receiving the first data from the first vehicle and then verifying the legitimacy of the first data using the first information included in the management information.

[0009] Yet another aspect of the present disclosure is also a communication method between a first vehicle that holds data including first data and second data, a server that stores first information for verifying the validity of the first data and second information for verifying the validity of the second data, and a second vehicle that can communicate with the server, the method including the steps of: the server transmitting management information including the first information and the second information to the second vehicle; the second vehicle receiving the management information from the server; the first vehicle transmitting the first data to the second vehicle; and the second vehicle receiving the first data from the first vehicle and then verifying the validity of the first data using the first information included in the management information.

[0010] Yet another aspect of the present disclosure is a vehicle including: a first communication unit that receives management information including first information and second information and the second data from a server that stores data including first data and second data, first information for verifying the legitimacy of the first data, and second information for verifying the legitimacy of the second data, a second communication unit that receives the first data from another vehicle that has received the management information and the first data from the server, and a processing unit that verifies the legitimacy of the first data received by the second communication unit using the first information included in the management information received by the first communication unit.

[0011] Yet another aspect of the present disclosure is also a vehicle including: a first communication unit that receives management information including first information for verifying the validity of the first data and second information for verifying the validity of the second data from a server that stores the first information and second information, a second communication unit that receives the first data from another vehicle that stores data including the first data and the second data, and a processing unit that verifies the validity of the first data received by the second communication unit using the first information included in the management information received by the first communication unit.

[0012] Any combination of the above components, and conversion of the present disclosure into a method, device, system, recording medium, computer program, etc., are also valid aspects of the present disclosure. [Effects of the Invention]

[0013] According to the present disclosure, it is possible to ensure the validity of data while reducing the amount of communication from the server. [Brief explanation of the drawings]

[0014] [Figure 1] 1 is a diagram illustrating a configuration of a communication system according to a first embodiment. [Figure 2] 2(a) to 2(c) are diagrams showing data formats of signals transmitted from the server of FIG. [Figure 3] FIG. 2 is a diagram showing the configuration of the vehicle shown in FIG. [Figure 4] FIG. 3 is a sequence diagram illustrating a communication procedure performed by the communication system according to the first embodiment. [Figure 5] FIG. 4 is a sequence diagram illustrating a first processing procedure performed by the communication system according to the first embodiment. [Figure 6] FIG. 10 is a diagram illustrating a data format of management information used in a second process in the communication system according to the first embodiment. [Figure 7] FIG. 10 is a sequence diagram illustrating a second processing procedure performed by the communication system according to the first embodiment. [Figure 8]FIG. 10 is a sequence diagram illustrating a third processing procedure performed by the communication system according to the first embodiment. [Figure 9] FIG. 10 is a sequence diagram illustrating a fourth processing procedure performed by the communication system according to the first embodiment. [Figure 10] FIG. 10 is a sequence diagram illustrating a fifth processing procedure performed by the communication system according to the first embodiment. [Figure 11] FIG. 10 is a sequence diagram illustrating a sixth process performed by the communication system according to the first embodiment. [Figure 12] FIG. 13 is a sequence diagram illustrating a seventh process performed by the communication system according to the first embodiment. [Figure 13] FIG. 13 is a sequence diagram illustrating an eighth process performed by the communication system according to the first embodiment. [Figure 14] FIG. 13 is a sequence diagram illustrating a ninth process performed by the communication system according to the first embodiment. [Figure 15] FIG. 19 is a sequence diagram illustrating a tenth process performed by the communication system according to the first embodiment. [Figure 16] FIG. 10 is a diagram illustrating a data format of a signal transmitted from a server according to the second embodiment. [Figure 17] FIG. 10 is a sequence diagram illustrating a communication procedure performed by a communication system according to a second embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0015] Example 1 Before describing the present disclosure in detail, an overview will be provided. A first embodiment of the present disclosure relates to a communication system that performs wireless communication between a plurality of vehicles and a server. The communication system is used, for example, for OTA (Over The Air). OTA is a technology for transmitting and receiving data between a server and vehicles via wireless communication in order to update software or firmware of the vehicles. Since the vehicles are located in various locations, a public network such as a mobile phone network is used to transmit data from the server to the vehicles. Since communication charges for the public network depend on the communication volume, it is desired to reduce the communication volume from the server to the vehicles.

[0016] In this embodiment, in order to reduce the amount of communication from the server to the vehicles, the update data is divided into multiple pieces, and the number of groups into which the update data is divided is defined, with each of the multiple vehicles being included in one of the groups. For example, if the number of divisions is "3," the update data is divided into first to third data, and each vehicle is included in one of the first to third groups. The first to third data are collectively referred to as divided data.

[0017] The server transmits the first data to each vehicle included in the first group, but does not transmit the second data or the third data. The server transmits the second data to each vehicle included in the second group, but does not transmit the first data or the third data. The server transmits the third data to each vehicle included in the third group, but does not transmit the first data or the second data. As a result, the amount of data transmitted from the server to the vehicles is reduced to approximately one-third.

[0018] Each vehicle is capable of performing inter-vehicle communication and is mobile. Therefore, over time, each vehicle becomes able to communicate with vehicles in other groups. By performing inter-vehicle communication between each vehicle and vehicles in other groups, the first data to the third data are exchanged. Finally, each vehicle obtains the first data to the third data to obtain updated data.

[0019] Here, because the vehicle does not receive all of the update data directly from the server, it cannot guarantee the validity of the divided data received from other vehicles. To guarantee the validity of the divided data, the server compiles first information for verifying the validity of the first data, second information for verifying the validity of the second data, and third information for verifying the validity of the third data into management information, and then transmits the management information to all vehicles. The vehicle uses the management information received from the server to verify the validity of the divided data received from other vehicles. After collecting all of the divided data whose validity has been verified, the vehicle performs a software update using the update data.

[0020] FIG. 1 shows the configuration of a communication system 1000. The communication system 1000 includes a first vehicle 100a, a second vehicle 100b, and a third vehicle 100c, collectively referred to as vehicles 100, and a server 200. A first group 10, a second group 12, and a third group 14 are defined. The number of groups is not limited to three. The first group 10 includes multiple first vehicles 100a, the second group 12 includes multiple second vehicles 100b, and the third group 14 includes multiple third vehicles 100c. The vehicles 100 are classified into the first group 10, the second group 12, and the third group 14 based on the region in which the vehicles 100 are registered. In this case, the first group 10 includes the first vehicle 100a registered in Tokyo, the second group 12 includes the second vehicle 100b registered in Kanagawa Prefecture, and the third group 14 includes the third vehicle 100c registered in Saitama Prefecture. The classification of the vehicles 100 into the first group 10 to the third group 14 may be done by vehicle number.

[0021] Each vehicle 100 can communicate with the server 200 via wireless communication on a public network. The public network is, for example, a mobile phone communication network such as a 4G communication network or a 5G communication network. The vehicle 100 may communicate with a communication device (not shown) via a wireless LAN (Local Area Network) or Bluetooth (registered trademark), and the communication device may communicate with the server 200 via wireless communication on the public network.

[0022] The server 200 stores first data, second data, and third data as divided data obtained by dividing the data (update data) into three parts. The number of divided data parts is not limited to "3." The server 200 also stores information for verifying the validity of each piece of data, that is, information ensuring the tamper-resistance of each piece of data. For example, the server 200 stores first information for verifying the validity of the first data, second information for verifying the validity of the second data, and third information for verifying the validity of the third data. The first information is a hash value of the first data (hereinafter referred to as the "first hash value"), the second information is a hash value of the second data (hereinafter referred to as the "second hash value"), and the third information is a hash value of the third data (hereinafter referred to as the "third hash value"). The first hash value, the second hash value, and the third hash value are included in the management information.

[0023] The server 200 is capable of wireless communication over a public network. The server 200 transmits management information and first data to each of the plurality of first vehicles 100a included in the first group 10. The server 200 also transmits management information and second data to each of the plurality of second vehicles 100b included in the second group 12. The server 200 also transmits management information and third data to each of the plurality of third vehicles 100c included in the third group 14. In other words, the server 200 transmits management information to all vehicles 100 and transmits a portion of the update data to all vehicles 100. Here, the server 200 pre-stores the addresses of each first vehicle 100a, each second vehicle 100b, and each third vehicle 100c.

[0024] 2(a)-(c) show the data format of a signal transmitted from the server 200. FIG. 2(a) shows a signal transmitted to each of the multiple first vehicles 100a included in the first group 10. The first data-related information includes a "file of first data" which is the first data, and information related to the first data, such as a "location of first data" and a "number of divisions." The location of first data indicates the address where the first data is stored, and the number of divisions indicates the number of divisions into which the update data is divided. In this embodiment, the number of divisions is "3." The management information includes a "first hash value," a "second hash value," and a "third hash value." The overall hash value is a hash value for the first data-related information and the management information.

[0025] FIG. 2(b) shows a signal transmitted to each of the plurality of second vehicles 100b included in the second group 12. The second data-related information includes the "file of second data," which is the second data, and the "location of second data" and "number of divisions," which are information related to the second data. The location of second data indicates the location when the second data is stored. In this embodiment, the number of divisions is "3." The management information includes the "first hash value," "second hash value," and "third hash value." The total hash value is a hash value for the second data-related information and the management information.

[0026] FIG. 2(c) shows signals transmitted to each of the multiple third vehicles 100c included in the third group 14. The third data-related information includes the "third data file," which is the third data, and the "location of the third data" and "number of divisions," which are information related to the third data. The location of the third data indicates the location when the third data is stored. In this embodiment, the number of divisions is "3." The management information includes the "first hash value," "second hash value," and "third hash value." The total hash value is a hash value for the third data-related information and the management information. Return to FIG. 1.

[0027] Each first vehicle 100a receives the first data-related information, management information, and overall hash value shown in FIG. 2(a) from the server 200. Each first vehicle 100a verifies the authenticity of the first data using the first hash value included in the management information. If the first data is authentic, the first vehicle 100a retains the first data.

[0028] Each second vehicle 100b receives the second data-related information, management information, and overall hash value shown in FIG. 2(b) from the server 200. Each second vehicle 100b verifies the authenticity of the second data using the second hash value included in the management information. If the second data is authentic, the second vehicle 100b stores the second data.

[0029] Each third vehicle 100c receives the third data-related information, management information, and overall hash value shown in FIG. 2(c) from the server 200. Each third vehicle 100c verifies the authenticity of the third data using the third hash value included in the management information. If the third data is authentic, the third vehicle 100c stores the third data.

[0030] That is, immediately after transmission from server 200, first vehicle 100a holds only the first data and does not hold the second or third data. Second vehicle 100b holds only the second data and does not hold the first or third data. Third vehicle 100c holds only the third data and does not hold the first or second data.

[0031] Because the vehicles 100 are mobile, over time they move and pass each other as vehicles 100 of other groups. For example, the first vehicle 100a passes the second vehicle 100b, the second vehicle 100b passes the third vehicle 100c, and the third vehicle 100c passes the first vehicle 100a. At this time, each vehicle 100 exchanges divided data with the other vehicles 100 by performing vehicle-to-vehicle communication.

[0032] For example, when a first vehicle 100a and a second vehicle 100b pass each other, inter-vehicle communication is performed, and the first vehicle 100a transmits first data-related information to the second vehicle 100b, and the second vehicle 100b receives the first data-related information from the first vehicle 100a. This first data-related information does not need to include the division number. The second vehicle 100b verifies the validity of the first data using a first hash value included in the related information it already holds. If the first data is valid, the second vehicle 100b holds the first data.

[0033] Furthermore, when the second vehicle 100b and the third vehicle 100c pass each other, vehicle-to-vehicle communication is performed, and the third vehicle 100c transmits third data-related information to the second vehicle 100b, and the second vehicle 100b receives the third data-related information from the third vehicle 100c. This third data-related information does not need to include the division number. The third vehicle 100c verifies the validity of the third data using the third hash value included in the related information it already holds. If the third data is valid, the second vehicle 100b holds the third data.

[0034] As a result of these processes, the second vehicle 100b stores the first to third data. This corresponds to storing update data, and the second vehicle 100b performs a software update using the update data. Similar processes are also performed in the first vehicle 100a and the second vehicle 100b.

[0035] 3 shows the configuration of vehicle 100. Vehicle 100 includes a server communication unit 110, a first control device 112, a first storage unit 114, an ad hoc communication unit 116, a second control device 120, and a second storage unit 122. First control device 112 includes a processing unit 130, which includes a verification unit 132 and a management unit 134. Here, vehicle 100 is assumed to be second vehicle 100b in FIG. 1, but first vehicle 100a and third vehicle 100c also have a similar configuration.

[0036] The server communication unit 110 (first communication unit) is capable of performing wireless communication over a public network and communicates with the server 200 (FIG. 1). As described above, the server communication unit 110 is capable of performing wireless communication over a wireless LAN and may communicate with the server 200 via a communication device (not shown). The server communication unit 110 receives the second data-related information, the management information, and the total hash value from the server 200. The server communication unit 110 outputs the second data-related information, the management information, and the total hash value to the first control device 112.

[0037] The first control device 112 is, for example, a multimedia control device that plays video or audio. The first control device 112 operates using software stored in a first storage unit 114 (described later). The software stored in the first storage unit 114 is software that is to be updated with update data. In other words, the software is subject to OTA.

[0038] The verification unit 132 receives the second data-related information, management information, and the overall hash value from the server communication unit 110. The verification unit 132 verifies the legitimacy of the second data-related information and management information using the overall hash value. Since a known technique may be used for verifying the legitimacy, a description thereof will be omitted here. If the second data-related information and management information are legitimate, the verification unit 132 verifies the legitimacy of the second data using the second hash value included in the management information. If the second data is legitimate, the verification unit 132 stores the second data-related information and management information in the first storage unit 114. On the other hand, if the second data-related information and management information are invalid, or if the second data is invalid, the verification unit 132 terminates the process.

[0039] The first storage unit 114 is a semiconductor memory, a nonvolatile memory, or a storage medium, and is capable of storing digital data. Examples of the semiconductor memory include a random access memory (RAM), a read only memory (ROM), a flash memory, and a synchronous dynamic RAM (SDRAM). Examples of the nonvolatile memory include an erasable programmable read only memory (EPROM) and an electrically erasable programmable read only memory (EEPROM). Examples of the storage medium include a solid state drive (SSD) and a hard disk drive (HDD). The first storage unit 114 stores second data-related information and management information.

[0040] The ad hoc communication unit 116 (second communication unit) is capable of performing ad hoc vehicle-to-vehicle communication. The ad hoc communication unit 116 communicates with other vehicles 100, for example, the first vehicle 100a and the third vehicle 100c, through vehicle-to-vehicle communication. The ad hoc communication unit 116 receives first data-related information from the first vehicle 100a. As described above, this first data-related information does not need to include the division number. Information to be transmitted and received through vehicle-to-vehicle communication in the ad hoc communication unit 116 is managed by the management unit 134, and the processing of the management unit 134 will be described later. The ad hoc communication unit 116 outputs the first data-related information to the first control device 112.

[0041] The verification unit 132 receives the first data-related information from the ad hoc communication unit 116. The verification unit 132 verifies the validity of the first data using the first hash value stored in the first storage unit 114. If the first data is valid, the verification unit 132 stores the first data-related information in the first storage unit 114. On the other hand, if the first data is not valid, the verification unit 132 ends the process.

[0042] The ad hoc communication unit 116 receives the third data-related information from the third vehicle 100c. The ad hoc communication unit 116 outputs the third data-related information to the first control device 112. The verification unit 132 receives the third data-related information from the ad hoc communication unit 116. The verification unit 132 verifies the validity of the third data using the third hash value stored in the first storage unit 114. If the third data is valid, the verification unit 132 stores the third data-related information in the first storage unit 114. On the other hand, if the third data is not valid, the verification unit 132 terminates the processing.

[0043] Processing unit 130 confirms that the update data includes the first data to the third data based on the number of divisions stored in first storage unit 114. Furthermore, when the first data to the third data are stored in first storage unit 114, processing unit 130 extracts the first data to the third data from first storage unit 114 and combines the first data to the third data to obtain the update data. Processing unit 130 updates the software stored in first storage unit 114 with the update data.

[0044] The ad hoc communication unit 116 may transmit the second data-related information stored in the first storage unit 114 to another vehicle 100 under the control of the management unit 134. Furthermore, when the first data-related information or the third related information is stored in the first storage unit 114, the ad hoc communication unit 116 may transmit the first data-related information or the third related information to another vehicle 100 under the control of the management unit 134.

[0045] The second control device 120 is a device for controlling parts of the vehicle 100 that are different from the parts controlled by the first control device 112. The second control device 120 operates using software stored in a second storage unit 122. The software stored in the second storage unit 122 is not updated with update data. In other words, the software is not subject to OTA. The first control device 112 and the second control device 120 are connected via wired communication such as a dedicated line or a CAN (Controller Area Network). The vehicle 100 may further include a control device and a storage unit that are subject to OTA, or may further include a control device and a storage unit that are not subject to OTA.

[0046] This configuration can be realized in hardware terms by any computer's CPU (Central Processing Unit), memory, and other LSIs (Large Scale Integration), and in software terms by programs loaded into memory, but here we depict functional blocks realized by the cooperation of these. Therefore, those skilled in the art will understand that these functional blocks can be realized in various forms by hardware alone or a combination of hardware and software.

[0047] The operation of the communication system 1000 configured as described above will now be described. FIG. 4 is a sequence diagram showing the communication procedure performed by the communication system 1000. In the following, the overall hash value will be omitted. The server 200 transmits the first data-related information and management information to the first vehicle 100a (S10). The first vehicle 100a verifies and stores the received first data-related information and management information (S12). The server 200 transmits the second data-related information and management information to the second vehicle 100b (S14). The second vehicle 100b verifies and stores the received second data-related information and management information (S16). The server 200 transmits the third data-related information and management information to the third vehicle 100c (S18). The third vehicle 100c verifies and stores the received third data-related information and management information (S20).

[0048] When the first vehicle 100a and the third vehicle 100c approach each other, the third vehicle 100c transmits the third data-related information to the first vehicle 100a (S22). The first vehicle 100a verifies and stores the received third data-related information (S24). When the first vehicle 100a and the second vehicle 100b approach each other, the first vehicle 100a transmits the first data-related information to the second vehicle 100b (S26). The second vehicle 100b verifies and stores the received first data-related information (S28).

[0049] When the second vehicle 100b and the third vehicle 100c approach each other, the third vehicle 100c transmits third data-related information to the second vehicle 100b (S30). The second vehicle 100b verifies and stores the received third data-related information (S32). The second vehicle 100b compiles the first data to the third data into update data and updates its software with the update data (S34).

[0050] In the following, the procedures for inter-vehicle communication in this process, particularly inter-vehicle communication between the first vehicle 100a and the second vehicle 100b, will be described as steps 1 to 9. In this case, the first vehicle 100a will be the transmitting side, and the second vehicle 100b will be the receiving side. In addition, the procedure for communication between the second vehicle 100b and the server 200 will be described as step 10.

[0051] (First process) When the second vehicle 100b approaches the first vehicle 100a, the ad hoc communication unit 116 of the second vehicle 100b receives a signal from the first vehicle 100a and recognizes that vehicle-to-vehicle communication with the first vehicle 100a is possible. The management unit 134 recognizes that the first data and the third data are missing based on the division number "3" in the management information stored in the first storage unit 114 and the second data stored in the first storage unit 114. The management unit 134 selects one of the first data and the third data, for example, the first data. The management unit 134 generates a signal (hereinafter referred to as a "missing data transmission request") to request transmission of the missing first data. The ad hoc communication unit 116 transmits the missing data transmission request to the first vehicle 100a, thereby requesting the first vehicle 100a to transmit the first data.

[0052] The ad hoc communication unit 116 of the first vehicle 100a receives a request to transmit the missing data from the second vehicle 100b. The management unit 134 recognizes the transmission of the first data based on the request to transmit the missing data, and extracts the first data-related information from the first storage unit 114. The ad hoc communication unit 116 transmits the first data-related information to the second vehicle 100b as missing data-related information.

[0053] The ad hoc communication unit 116 of the second vehicle 100b receives the missing data-related information from the first vehicle 100a. The ad hoc communication unit 116 outputs first data-related information, which is the missing data-related information, to the first control device 112. The verification unit 132 receives the first data-related information from the ad hoc communication unit 116. The verification unit 132 verifies the validity of the first data using the first hash value stored in the first storage unit 114. If the first data is valid, the verification unit 132 stores the first data-related information in the first storage unit 114.

[0054] The operation of the communication system 1000 configured as described above will now be described. Figure 5 is a sequence diagram showing a first processing procedure by the communication system 1000. The second vehicle 100b transmits a request to transmit missing data to the first vehicle 100a (S50). The first vehicle 100a transmits missing data related information to the second vehicle 100b in response to the received request to transmit missing data (S52). The second vehicle 100b verifies the validity of the received missing data related information (S54) and stores the missing data related information (S56).

[0055] (Second process) The management information may include the size of the first data, the size of the second data, and the size of the third data. Fig. 6 shows the data format of the management information used in the second process in the communication system 1000. As shown in the figure, the management information includes a "first size" that is the size of the first data, a "second size" that is the size of the second data, and a "third size" that is the size of the third data.

[0056] When the second vehicle 100b approaches the first vehicle 100a, the ad hoc communication unit 116 of the second vehicle 100b receives a signal from the first vehicle 100a and recognizes that vehicle-to-vehicle communication with the first vehicle 100a is possible. The management unit 134 recognizes that the first data and the third data are insufficient based on the division number "3" in the management information stored in the first storage unit 114 and the second data stored in the first storage unit 114.

[0057] The management unit 134 acquires the speed of the second vehicle 100b from a speed sensor provided on the second vehicle 100b. The management unit 134 stores in advance a correspondence relationship between speed and size such that the size decreases as the speed increases. The management unit 134 identifies the size (hereinafter referred to as the "target value") from the acquired speed and correspondence relationship. The management unit 134 also acquires the first size corresponding to the first data and the third size of the third data from the management information. The management unit 134 selects, as the missing data, the divided data whose first size or third size is smaller than the target value and closer to the target value. The management unit 134 selects, for example, the first data.

[0058] The management unit 134 generates a signal (hereinafter referred to as a "missing data transmission request") for requesting transmission of the missing first data. The ad hoc communication unit 116 transmits the missing data transmission request to the first vehicle 100a, thereby requesting the first vehicle 100a to transmit the first data. The subsequent processing is the same as the first processing, and therefore will not be described here.

[0059] The operation of the communication system 1000 configured as described above will be described. FIG. 7 is a sequence diagram showing a second processing procedure by the communication system 1000. The second vehicle 100b acquires the speed of the second vehicle 100b (S100). The second vehicle 100b determines the missing data based on the speed (S102). The second vehicle 100b transmits a request to transmit the missing data to the first vehicle 100a (S104). The first vehicle 100a transmits missing data related information to the second vehicle 100b in response to the received request to transmit the missing data (S106). The second vehicle 100b verifies the validity of the received missing data related information (S108) and stores the missing data related information (S110).

[0060] (Third process) When the second vehicle 100b approaches the first vehicle 100a, the ad hoc communication unit 116 of the second vehicle 100b receives a signal from the first vehicle 100a and recognizes that vehicle-to-vehicle communication with the first vehicle 100a is possible. The management unit 134 recognizes that the first data and the third data are missing based on the division number "3" in the management information stored in the first storage unit 114 and the second data stored in the first storage unit 114. The management unit 134 generates a signal (hereinafter referred to as a "missing list transmission request") to request transmission of either the missing first data or the missing third data. The ad hoc communication unit 116 transmits the missing list transmission request to the first vehicle 100a, thereby requesting transmission of the first data and the third data from the first vehicle 100a.

[0061] The ad hoc communication unit 116 of the first vehicle 100a receives a request to transmit a missing data list from the second vehicle 100b. Based on the request to transmit a missing data list, the management unit 134 determines to transmit the first data out of the first data and the third data, and extracts the first data-related information from the first storage unit 114. The ad hoc communication unit 116 transmits the first data-related information to the second vehicle 100b as missing data-related information. The subsequent processing is the same as the first processing, and therefore will not be described here.

[0062] The operation of the communication system 1000 configured as described above will now be described. Figure 8 is a sequence diagram showing a third processing procedure by the communication system 1000. The second vehicle 100b transmits a request to transmit a missing data list to the first vehicle 100a (S150). The first vehicle 100a transmits missing data related information to the second vehicle 100b in response to the received request to transmit a missing data list (S152). The second vehicle 100b verifies the validity of the received missing data related information (S154) and stores the missing data related information (S156).

[0063] (Fourth Process) The management information in the fourth process is shown in FIG. 6. When the second vehicle 100b approaches the first vehicle 100a, the ad hoc communication unit 116 of the second vehicle 100b receives a signal from the first vehicle 100a and recognizes that vehicle-to-vehicle communication with the first vehicle 100a is possible. The management unit 134 recognizes that the first data and the third data are missing based on the division number "3" in the management information stored in the first storage unit 114 and the second data stored in the first storage unit 114. The management unit 134 generates a signal (hereinafter referred to as a "missing list transmission request") to request transmission of either the missing first data or the missing third data. The ad hoc communication unit 116 transmits the missing list transmission request to the first vehicle 100a, thereby requesting the first vehicle 100a to transmit the first data and the third data.

[0064] The ad hoc communication unit 116 of the first vehicle 100a receives a missing data list transmission request from the second vehicle 100b. The management unit 134 acquires the speed of the first vehicle 100a from a speed sensor provided on the first vehicle 100a. The management unit 134 pre-stores a correspondence relationship between speed and size such that the size decreases as the speed increases. The management unit 134 identifies a target value from the acquired speed and correspondence relationship. The management unit 134 also acquires a first size corresponding to the first data and a third size of the third data from the management information. The management unit 134 selects, as missing data, one of the first and third sizes, which is smaller than the target value and closer to the target value. The management unit 134 selects, for example, the first data. The management unit 134 extracts first data-related information from the first storage unit 114. The ad hoc communication unit 116 transmits the first data-related information to the second vehicle 100b as missing data-related information. The subsequent processing is the same as the third processing, and therefore will not be described here.

[0065] The operation of the communication system 1000 configured as described above will be described. FIG. 9 is a sequence diagram showing a fourth processing procedure by the communication system 1000. The second vehicle 100b transmits a missing data list transmission request to the first vehicle 100a (S200). The first vehicle 100a acquires the speed of the first vehicle 100a (S202). The first vehicle 100a determines the missing data based on the speed (S204). The first vehicle 100a transmits missing data related information to the second vehicle 100b (S206). The second vehicle 100b verifies the validity of the received missing data related information (S208) and stores the missing data related information (S210).

[0066] (5th process) The management information in the fifth process is shown in Figure 6. When the second vehicle 100b approaches the first vehicle 100a, the ad hoc communication unit 116 of the second vehicle 100b receives a signal from the first vehicle 100a and recognizes that vehicle-to-vehicle communication with the first vehicle 100a is possible. The management unit 134 recognizes that the first data and the third data are insufficient based on the division number "3" in the management information stored in the first storage unit 114 and the second data stored in the first storage unit 114.

[0067] The management unit 134 acquires the speed of the second vehicle 100b from a speed sensor provided on the second vehicle 100b. The management unit 134 stores in advance a correspondence relationship between speed and size such that the size decreases as the speed increases. The management unit 134 identifies a target value from the acquired speed and correspondence relationship. The management unit 134 also acquires a first size corresponding to the first data and a third size of the third data from the management information. The management unit 134 selects divided data of the first size and the third size that is smaller than the target value. Multiple divided data may be selected. The management unit 134 selects, for example, the first data and the third data.

[0068] The management unit 134 generates a signal (hereinafter referred to as a "missing data list transmission request") to request transmission of either the missing first data or the missing third data. The ad hoc communication unit 116 transmits the missing data list transmission request to the first vehicle 100a, thereby requesting transmission of the first data and the third data from the first vehicle 100a. The subsequent processing is the same as the third processing, and therefore will not be described here.

[0069] The operation of the communication system 1000 configured as described above will be described. FIG. 10 is a sequence diagram showing a fifth processing procedure by the communication system 1000. The second vehicle 100b acquires the speed of the second vehicle 100b (S250). The second vehicle 100b determines the missing data based on the speed (S252). The second vehicle 100b transmits a request to transmit a missing list to the first vehicle 100a (S254). The first vehicle 100a transmits missing data related information to the second vehicle 100b in response to the received request to transmit a missing list (S256). The second vehicle 100b verifies the validity of the received missing data related information (S258) and stores the missing data related information (S260).

[0070] (Sixth Process) When the second vehicle 100b approaches the first vehicle 100a, the ad hoc communication unit 116 of the second vehicle 100b receives a signal from the first vehicle 100a and recognizes that vehicle-to-vehicle communication with the first vehicle 100a is possible. The management unit 134 recognizes that the first data and the third data are insufficient based on the division number "3" in the management information stored in the first storage unit 114 and the second data stored in the first storage unit 114. The management unit 134 generates a signal (hereinafter referred to as a "retained data transmission request") for requesting the transmission of data held by the first vehicle 100a. The ad hoc communication unit 116 transmits the retained data transmission request to the first vehicle 100a, thereby requesting the first vehicle 100a to transmit the first data and the third data.

[0071] The ad hoc communication unit 116 of the first vehicle 100a receives a request to transmit retained data from the second vehicle 100b. Based on the request to transmit retained data, the management unit 134 extracts the first data-related information and the third data-related information from the first storage unit 114. The first data-related information and the third data-related information correspond to data retained by the first vehicle 100a. The ad hoc communication unit 116 transmits the first data-related information and the third data-related information to the second vehicle 100b as retained data-related information.

[0072] The ad hoc communication unit 116 of the second vehicle 100b receives the retained data-related information from the first vehicle 100a. The ad hoc communication unit 116 outputs the retained data-related information, namely, the first data-related information and the third data-related information, to the first control device 112. The management unit 134 checks whether the first data-related information and the third data-related information are already retained. If the first data-related information is not retained, the verification unit 132 verifies the legitimacy of the first data using the first hash value stored in the first storage unit 114. If the first data is legitimate, the verification unit 132 stores the first data-related information in the first storage unit 114. If the third data-related information is not retained, the verification unit 132 verifies the legitimacy of the third data using the third hash value stored in the first storage unit 114. If the third data is legitimate, the verification unit 132 stores the third data-related information in the first storage unit 114.

[0073] The operation of communication system 1000 configured as described above will now be described. Fig. 11 is a sequence diagram showing a sixth processing procedure performed by communication system 1000. The second vehicle 100b transmits a request to transmit retained data to the first vehicle 100a (S300). In response to the received request to transmit retained data, the first vehicle 100a transmits retained data-related information to the second vehicle 100b (S302). The second vehicle 100b checks whether it holds the received retained data-related information (S304), verifies the validity of the retained data-related information that it does not hold (S306), and holds the retained data-related information (S308).

[0074] (7th process) The management information in the seventh process is shown in FIG. 6. When the second vehicle 100b approaches the first vehicle 100a, the ad hoc communication unit 116 of the second vehicle 100b receives a signal from the first vehicle 100a and recognizes that vehicle-to-vehicle communication with the first vehicle 100a is possible. The management unit 134 recognizes that the first data and the third data are insufficient based on the division number "3" in the management information stored in the first storage unit 114 and the second data stored in the first storage unit 114. The management unit 134 generates a signal (hereinafter referred to as a "retained data transmission request") to request transmission of data held by the first vehicle 100a. The ad hoc communication unit 116 transmits the retained data transmission request to the first vehicle 100a, thereby requesting transmission of the first data and the third data from the first vehicle 100a.

[0075] The ad hoc communication unit 116 of the first vehicle 100a receives a request to transmit retained data from the second vehicle 100b. The management unit 134 acquires the speed of the first vehicle 100a from a speed sensor provided in the first vehicle 100a. The management unit 134 pre-stores a correspondence relationship between speed and size such that the size decreases as the speed increases. The management unit 134 identifies a target value from the acquired speed and correspondence relationship. The management unit 134 also acquires a first size corresponding to the first data and a third size of the third data from the management information. The management unit 134 selects the divided data of the first size or the third size that is smaller than the target value and closer to the target value. The management unit 134 selects, for example, the first data. The management unit 134 extracts first data-related information from the first storage unit 114. The ad hoc communication unit 116 transmits the first data-related information to the second vehicle 100b as retained data-related information. The subsequent processing is the same as the sixth processing, and therefore will be omitted here.

[0076] The operation of the communication system 1000 configured as described above will be described. FIG. 12 is a sequence diagram showing a seventh processing procedure performed by the communication system 1000. The second vehicle 100b transmits a request to transmit retained data to the first vehicle 100a (S350). The first vehicle 100a acquires the speed of the first vehicle 100a (S352). The first vehicle 100a determines retained data based on the speed (S354). The first vehicle 100a transmits retained data related information to the second vehicle 100b (S356). The second vehicle 100b checks whether it holds the received retained data related information (S358), verifies the validity of the retained data related information that it does not hold (S360), and holds the retained data related information (S362).

[0077] (8th process) When the second vehicle 100b approaches the first vehicle 100a, the ad hoc communication unit 116 of the second vehicle 100b receives a signal from the first vehicle 100a and recognizes that vehicle-to-vehicle communication with the first vehicle 100a is possible. The management unit 134 recognizes that the first data and the third data are insufficient based on the division number "3" in the management information stored in the first storage unit 114 and the second data stored in the first storage unit 114.

[0078] The ad hoc communication unit 116 of the first vehicle 100a extracts the first data-related information and the third data-related information from the first storage unit 114. The first data-related information and the third data-related information correspond to data held by the first vehicle 100a. The ad hoc communication unit 116 transmits the first data-related information and the third data-related information to the second vehicle 100b as held data-related information. The subsequent processing is the same as the sixth processing, and therefore will not be described here.

[0079] The operation of communication system 1000 configured as described above will now be described. Figure 13 is a sequence diagram showing an eighth processing procedure performed by communication system 1000. First vehicle 100a transmits retained data related information to second vehicle 100b (S400). Second vehicle 100b checks whether it retains the received retained data related information (S402), verifies the validity of the retained data related information that it does not retain (S404), and retains the retained data related information (S406).

[0080] (9th process) The management information in the ninth process is shown in Figure 6. When the second vehicle 100b approaches the first vehicle 100a, the ad hoc communication unit 116 of the second vehicle 100b receives a signal from the first vehicle 100a and recognizes that vehicle-to-vehicle communication with the first vehicle 100a is possible. The management unit 134 recognizes that the first data and the third data are insufficient based on the division number "3" in the management information stored in the first storage unit 114 and the second data stored in the first storage unit 114.

[0081] The management unit 134 of the first vehicle 100a acquires the speed of the first vehicle 100a from a speed sensor provided on the first vehicle 100a. The management unit 134 pre-stores a correspondence relationship between speed and size such that the size decreases as the speed increases. The management unit 134 identifies a target value from the acquired speed and correspondence relationship. The management unit 134 also acquires a first size corresponding to the first data and a third size of the third data from the management information. The management unit 134 selects the divided data of the first size or the third size that is smaller than the target value and closer to the target value. The management unit 134 selects, for example, the first data. The management unit 134 extracts first data-related information from the first storage unit 114. The ad hoc communication unit 116 transmits the first data-related information to the second vehicle 100b as retained data-related information. The subsequent processing is the same as the eighth processing, and therefore will not be described here.

[0082] The operation of the communication system 1000 configured as described above will be described. Figure 14 is a sequence diagram showing a ninth processing procedure by the communication system 1000. The first vehicle 100a acquires the speed of the first vehicle 100a (S450). The first vehicle 100a determines the retained data based on the speed (S452). The first vehicle 100a transmits the retained data related information to the second vehicle 100b (S454). The second vehicle 100b checks whether it retains the received retained data related information (S456), verifies the validity of the retained data related information that it does not retain (S458), and retains the retained data related information (S460).

[0083] (10th process) The management information includes an acquisition deadline. If the management unit 134 of the second vehicle 100b is unable to acquire the divided data, for example, the first data, by the acquisition deadline, the management unit 134 generates a missing data transmission request. The server communication unit 110 transmits the missing data transmission request to the server 200.

[0084] The server 200 receives the missing data transmission request from the second vehicle 100b. In response to the missing data transmission request, the server 200 transmits the first data-related information to the second vehicle 100b as missing data-related information.

[0085] The server communication unit 110 of the second vehicle 100b receives the missing data-related information from the server 200. The server communication unit 110 outputs the first data-related information, which is the missing data-related information, to the first control device 112. The verification unit 132 receives the first data-related information from the ad hoc communication unit 116. The verification unit 132 verifies the validity of the first data using the first hash value stored in the first storage unit 114. If the first data is valid, the verification unit 132 stores the first data-related information in the first storage unit 114.

[0086] The operation of communication system 1000 configured as described above will be described. Figure 15 is a sequence diagram showing a tenth processing procedure by communication system 1000. Second vehicle 100b transmits a request to send missing data to server 200 (S500). Server 200 transmits missing data related information to second vehicle 100b in response to the received request to send missing data (S502). Second vehicle 100b verifies the validity of the received missing data related information (S504) and stores the missing data related information (S506).

[0087] According to this embodiment, one piece of divided data is transmitted, and a hash value for verifying the validity of all the divided data is also transmitted, thereby ensuring the validity of the data while reducing the amount of communication from the server 200. Furthermore, the remaining divided data is obtained through vehicle-to-vehicle communication, thereby reducing the amount of communication from the server 200. Furthermore, since the first vehicle 100a transmits data in response to a request from the second vehicle 100b, the second vehicle 100b can obtain the data in response to the request. Furthermore, in a situation where the first vehicle 100a transmits data in response to a request from the second vehicle 100b, the second vehicle 100b requests data according to the speed of the second vehicle 100b, thereby increasing the size of the data while improving the success rate of communication.

[0088] Furthermore, in a situation where the first vehicle 100a transmits data in response to a request from the second vehicle 100b, multiple pieces of data are requested, thereby preventing the first vehicle 100a from being unable to transmit the data. Furthermore, in a situation where the first vehicle 100a transmits data in response to a request from the second vehicle 100b, multiple pieces of data are requested and the data is transmitted according to the speed of the first vehicle 100a, thereby increasing the size of the data while improving the success rate of communication. Furthermore, in a situation where the first vehicle 100a transmits data in response to a request from the second vehicle 100b, the first vehicle 100a requests the transmission of data held by the first vehicle 100a, thereby simplifying the request. Furthermore, in a situation where the first vehicle 100a transmits data in response to a request from the second vehicle 100b, the first vehicle 100a requests the transmission of data held by the first vehicle 100a and transmits data according to the speed of the first vehicle 100a, thereby increasing the size of the data while improving the success rate of communication.

[0089] Furthermore, since the first vehicle 100a transmits data even without a request from the second vehicle 100b, the communication procedure can be simplified. Furthermore, in a situation where the first vehicle 100a transmits data even without a request from the second vehicle 100b, the data is transmitted according to the speed of the first vehicle 100a, so the data size can be increased while improving the success rate of communication. Furthermore, if the data cannot be obtained by the acquisition deadline, the data is received from the server 200, so the data can be obtained.

[0090] Example 2 Next, a second embodiment will be described. Similar to the first embodiment, the second embodiment of the present disclosure relates to a communication system that performs wireless communication between a plurality of vehicles and a server. In the first embodiment, the communication system is used for OTA, but in the second embodiment, the communication system is used for purposes other than OTA. For example, the communication system updates vehicle software or firmware that is not updated by OTA. Specifically, the size of update data for updating static information installed in the vehicle 100 at the time of shipment is generally large, and therefore, is not subject to OTA in order to reduce communication costs. The communication system according to the second embodiment distributes such update data. The communication system 1000 and the vehicle 100 according to the second embodiment are of the same type as those shown in FIGS. 1 and 3 , and therefore, the following description will focus on the differences from the first embodiment.

[0091] As described above, the second control device 120 in Fig. 2 operates using software stored in the second storage unit 122, but the software stored in the second storage unit 122 is not subject to OTA. This software is static information that is installed in the vehicle 100 at the time of shipment. On the other hand, the software stored in the second storage unit 122 is updated depending on the year of shipment of the vehicle 100, etc. Therefore, it is desirable to also update the software stored in the second storage unit 122 of vehicles 100 that were shipped in the past.

[0092] Here, it is assumed that the software stored in the second storage unit 122 of the first vehicle 100a in FIG. 1 is a newer version, and the software stored in the second storage unit 122 of the second vehicle 100b is an older version. In addition, the updated portion (update data) of the newer version of the software is divided into, for example, first data, second data, and third data. In other words, the second storage unit 122 of the first vehicle 100a holds update data including the first data, second data, and third data. The number of divisions of the update data is not limited to "3."

[0093] The server 200 stores information for verifying the legitimacy of each of the first data to the third data, that is, information ensuring the tamper-resistance of each data. For example, the server 200 stores first information for verifying the legitimacy of the first data, second information for verifying the legitimacy of the second data, and third information for verifying the legitimacy of the third data. The first information is a first hash value, the second information is a second hash value, and the third information is a third hash value. The first hash value, the second hash value, and the third hash value are included in the management information.

[0094] Server 200 transmits the management information to second vehicle 100b. In other words, server 200 transmits the management information but does not transmit update data. Figure 16 shows the data format of the signal transmitted from server 200. The management information includes a "first hash value," a "second hash value," and a "third hash value." The total hash value is a hash value for the management information. Return to Figure 1.

[0095] The server communication unit 110 of the second vehicle 100b receives the management information from the server 200. The server communication unit 110 outputs the management information and the total hash value to the first control device 112. The verification unit 132 of the first control device 112 receives the management information and the total hash value from the server communication unit 110. The verification unit 132 verifies the validity of the management information using the total hash value. If the management information is valid, the first control device 112 outputs the management information to the second control device 120. The first control device 112 also stores the management information in the first storage unit 114.

[0096] The second control device 120 receives the management information from the first control device 112. The second control device 120 recognizes the presence of update data based on the management information, and requests the first control device 112 to acquire the third data from the first data.

[0097] The ad hoc communication unit 116 communicates with other vehicles 100, for example, the first vehicle 100a and the third vehicle 100c, via vehicle-to-vehicle communication as before. The ad hoc communication unit 116 receives first data-related information from the first vehicle 100a. The first data-related information has the same data structure as in the first embodiment, but includes the number of divisions. The ad hoc communication unit 116 outputs the first data-related information to the first control device 112. The verification unit 132 receives the first data-related information from the ad hoc communication unit 116. The verification unit 132 verifies the validity of the first data using the first hash value stored in the first memory unit 114. If the first data is valid, the first control device 112 outputs the first data-related information to the second control device 120.

[0098] When the second control device 120 receives the first data-related information from the first control device 112, it stores the first data-related information in the second storage unit 122. The same processing is performed on the second data-related information and the third data-related information. As a result, the first data-related information to the third data-related information are stored in the second storage unit 122.

[0099] The second control device 120 extracts the first data to the third data from the second storage unit 122 and combines the first data to the third data to obtain update data. The second control device 120 updates the software stored in the second storage unit 122 with the update data.

[0100] The operation of communication system 1000 configured as described above will now be described. Figure 17 is a sequence diagram showing the communication procedure by communication system 1000. In the following, the overall hash value will be omitted. Server 200 transmits management information to second vehicle 100b (S550). Second vehicle 100b verifies and stores the received management information (S552).

[0101] When the first vehicle 100a and the second vehicle 100b approach each other, the first vehicle 100a transmits the first data-related information to the second vehicle 100b (S554). The second vehicle 100b verifies and stores the received first data-related information (S556). When the first vehicle 100a and the second vehicle 100b approach each other, the first vehicle 100a transmits the second data-related information to the second vehicle 100b (S558). The second vehicle 100b verifies and stores the received second data-related information (S560).

[0102] When the first vehicle 100a and the second vehicle 100b approach each other, the first vehicle 100a transmits the third data-related information to the second vehicle 100b (S562). The second vehicle 100b verifies and stores the received third data-related information (S564). The second vehicle 100b compiles the first data to the third data into update data and updates its software with the update data (S566).

[0103] In such processing, any of the above-mentioned processes 1 to 10 may be used for the vehicle-to-vehicle communication, particularly the procedure for vehicle-to-vehicle communication between the first vehicle 100a and the second vehicle 100b, and the procedure for communication between the second vehicle 100b and the server 200.

[0104] According to this embodiment, information for verifying the validity of all divided data is transmitted, but the divided data is not transmitted, so the validity of the data can be guaranteed while reducing the amount of communication from the server. Furthermore, since the divided data is obtained through vehicle-to-vehicle communication, data that is not subject to OTA can also be obtained.

[0105] An outline of one aspect of the present disclosure is as follows. (Item 1) a server that stores data including first data and second data, first information for verifying the validity of the first data, and second information for verifying the validity of the second data; a first vehicle and a second vehicle capable of communicating with the server; the server transmits management information including the first information and the second information and the first data to the first vehicle, and transmits the management information and the second data to the second vehicle; the first vehicle receives the management information and the first data from the server; the second vehicle receives the management information and the second data from the server; the first vehicle transmits the first data to the second vehicle; a communication system in which the second vehicle receives the first data from the first vehicle and then verifies the validity of the first data based on the first information included in the management information;

[0106] According to this embodiment, one piece of divided data is sent, and information for verifying the legitimacy of all the divided data is also sent, thereby reducing the amount of communication from the server while ensuring the legitimacy of the data.

[0107] (Item 2) a first vehicle that holds data including first data and second data; a server that stores first information for verifying the validity of the first data and second information for verifying the validity of the second data; a second vehicle capable of communicating with the first vehicle and the server; the server transmits management information including the first information and the second information to the second vehicle; the second vehicle receives the management information from the server; the first vehicle transmits the first data to the second vehicle; a communication system in which the second vehicle receives the first data from the first vehicle and then verifies the validity of the first data based on the first information included in the management information;

[0108] According to this embodiment, information for verifying the legitimacy of all divided data is sent, but the divided data is not sent, so the legitimacy of the data can be guaranteed while reducing the amount of communication from the server.

[0109] (Item 3) the second vehicle requests the first vehicle to transmit the first data; 3. The communication system according to item 1 or 2, wherein the first vehicle transmits the first data to the second vehicle in response to a request from the second vehicle. In this case, the first vehicle transmits data in response to a request from the second vehicle, so the second vehicle can obtain the data in response to the request.

[0110] (Item 4) The data also includes third data; the second vehicle selects the first data from the first data and the third data based on a speed of the second vehicle, and requests the first vehicle to transmit the selected first data; 3. The communication system according to item 1 or 2, wherein the first vehicle transmits the first data to the second vehicle in response to a request from the second vehicle. In this case, in a situation where the first vehicle transmits data in response to a request from the second vehicle, the data is requested according to the speed of the second vehicle, so the data size can be increased while improving the success rate of communication.

[0111] (Item 5) The data also includes third data; the second vehicle requests the first vehicle to transmit the first data and the third data; 3. The communication system according to item 1 or 2, wherein the first vehicle transmits the first data to the second vehicle in response to a request from the second vehicle. In this case, in a situation where the first vehicle transmits data in response to a request from the second vehicle, multiple pieces of data are requested, so that it is possible to prevent the first vehicle from being unable to transmit data.

[0112] (Item 6) The data also includes third data; The first vehicle also holds the third data; the second vehicle requests the first vehicle to transmit the first data and the third data; 3. The communication system according to item 1 or 2, wherein the first vehicle selects the first data from the first data and the third data based on a speed of the first vehicle in response to a request from the second vehicle, and transmits the selected first data to the second vehicle. In this case, when the first vehicle transmits data in response to a request from the second vehicle, multiple pieces of data are requested and data is transmitted according to the speed of the first vehicle, thereby increasing the success rate of communication while increasing the size of the data.

[0113] (Item 7) The data also includes third data; the management information includes third information for verifying the validity of the third data; The first vehicle also holds the third data; the second vehicle requests the first vehicle to transmit data held by the first vehicle; the first vehicle transmits the first data and the third data to the second vehicle in response to a request from the second vehicle; the second vehicle confirms whether it holds the first data and the third data received from the first vehicle; 3. The communication system according to item 1 or 2, wherein, if the second vehicle does not hold the third data, it verifies the validity of the third data using the third information included in the management information. In this case, in a situation where the first vehicle transmits data in response to a request from the second vehicle, the first vehicle requests transmission of the data it holds, so the request can be simplified.

[0114] (Item 8) The data also includes third data; The first vehicle also holds the third data; the second vehicle requests the first vehicle to transmit data held by the first vehicle; the first vehicle, in response to a request from the second vehicle, selects the first data from the first data and the third data based on a speed of the first vehicle, and transmits the selected first data to the second vehicle; 3. The communication system according to item 1 or 2, wherein the second vehicle checks whether it holds the first data received from the first vehicle. In this case, when the first vehicle transmits data in response to a request from the second vehicle, the first vehicle requests the transmission of the data it holds and transmits data according to the speed of the first vehicle, thereby increasing the success rate of communication while increasing the size of the data.

[0115] (Item 9) The data also includes third data; the management information includes third information for verifying the validity of the third data; The first vehicle also holds the third data; the first vehicle transmits the first data and the third data to the second vehicle; the second vehicle confirms whether it holds the first data and the third data received from the first vehicle; 3. The communication system according to item 1 or 2, wherein, if the second vehicle does not hold the third data, it verifies the validity of the third data using the third information included in the management information. In this case, the first vehicle transmits data even without a request from the second vehicle, which simplifies the communication procedure.

[0116] (Item 10) The data also includes third data; The first vehicle also holds the third data; the first vehicle selects the first data from the first data and the third data based on a speed of the first vehicle, and transmits the selected first data to the second vehicle; 3. The communication system according to item 1 or 2, wherein the second vehicle checks whether it holds the first data received from the first vehicle. In this case, in a situation where the first vehicle transmits data even without a request from the second vehicle, the data transmitted is in accordance with the speed of the first vehicle, so the data size can be increased while improving the success rate of communication.

[0117] (Item 11) 3. The communication system according to item 1 or 2, wherein the second vehicle receives the first data from the server if the second vehicle is unable to acquire the first data by the acquisition deadline. In this case, if the data cannot be acquired by the acquisition deadline, the data is received from the server, so that the data can be acquired.

[0118] (Item 12) A communication method for a server that stores data including first data and second data, first information for verifying the validity of the first data, and second information for verifying the validity of the second data, and a first vehicle and a second vehicle that can communicate with the server, a step in which the server transmits management information including the first information and the second information and the first data to the first vehicle, and transmits the management information and the second data to the second vehicle; the first vehicle receiving the management information and the first data from the server; the second vehicle receiving the management information and the second data from the server; the first vehicle transmitting the first data to the second vehicle; a step of the second vehicle receiving the first data from the first vehicle and then verifying the validity of the first data based on the first information included in the management information; A communication method comprising:

[0119] (Item 13) A communication method among a first vehicle that holds data including first data and second data, a server that stores first information for verifying the validity of the first data and second information for verifying the validity of the second data, and a second vehicle that can communicate with the first vehicle and the server, comprising: the server transmitting management information including the first information and the second information to the second vehicle; the second vehicle receiving the management information from the server; the first vehicle transmitting the first data to the second vehicle; a step of the second vehicle receiving the first data from the first vehicle and then verifying the validity of the first data based on the first information included in the management information; A communication method comprising:

[0120] (Item 14) a first communication unit that receives management information including first data and second data, first information for verifying the validity of the first data, and second information for verifying the validity of the second data from a server that stores data including the first data and the second data, the first information, and the second data; a second communication unit that receives the first data from another vehicle that has received the management information and the first data from the server; a processing unit that verifies the validity of the first data received by the second communication unit based on the first information included in the management information received by the first communication unit; A vehicle equipped with:

[0121] (Item 15) a first communication unit that receives management information including first information for verifying the validity of first data and second information for verifying the validity of second data from a server that stores the first information and the second information; a second communication unit that receives the first data from another vehicle that holds data including the first data and the second data; a processing unit that verifies the validity of the first data received by the second communication unit based on the first information included in the management information received by the first communication unit; A vehicle equipped with:

[0122] The present disclosure has been described above based on examples. These examples are merely illustrative, and it will be understood by those skilled in the art that various modifications are possible in the combination of each component or each treatment process, and that such modifications are also within the scope of the present disclosure.

[0123] The data (divided data) in the first and second embodiments is not limited to OTA data and may be a container. A concatenation of containers (a semi-processed intermediate product) may be transferred. The data may be a binary division of a post-learning AI model. The management information may be a variable-length array (a set of parameters and corresponding values, such as JSON) or a non-variable-length array (with a predetermined size). This modification improves the flexibility of the configuration. [Explanation of symbols]

[0124] 10 first group, 12 second group, 14 third group, 100 vehicle, 110 server communication unit, 112 first control device, 114 first memory unit, 116 ad hoc communication unit, 120 second control device, 122 second memory unit, 130 processing unit, 132 verification unit, 134 management unit, 200 server, 1000 communication system.

Claims

1. a server that stores data including first data and second data, first information for verifying the validity of the first data, and second information for verifying the validity of the second data; a first vehicle and a second vehicle capable of communicating with the server; the server transmits management information including the first information and the second information and the first data to the first vehicle, and transmits the management information and the second data to the second vehicle; the first vehicle receives the management information and the first data from the server; the second vehicle receives the management information and the second data from the server; The first vehicle transmits the first data to the second vehicle; The second vehicle receives the first data from the first vehicle and then verifies the validity of the first data based on the first information included in the management information.

2. a first vehicle that stores data including first data and second data; a server that stores first information for verifying the validity of the first data and second information for verifying the validity of the second data; a second vehicle capable of communicating with the first vehicle and the server; the server transmits management information including the first information and the second information to the second vehicle; the second vehicle receives the management information from the server; The first vehicle transmits the first data to the second vehicle; The second vehicle receives the first data from the first vehicle and then verifies the validity of the first data based on the first information included in the management information.

3. the second vehicle requests the first vehicle to transmit the first data; The communication system according to claim 1 or 2, wherein the first vehicle transmits the first data to the second vehicle in response to a request from the second vehicle.

4. The data also includes third data; the second vehicle selects the first data from the first data and the third data based on a speed of the second vehicle, and requests the first vehicle to transmit the selected first data; The communication system according to claim 1 or 2, wherein the first vehicle transmits the first data to the second vehicle in response to a request from the second vehicle.

5. The data also includes third data; the second vehicle requests the first vehicle to transmit the first data and the third data; The communication system according to claim 1 or 2, wherein the first vehicle transmits the first data to the second vehicle in response to a request from the second vehicle.

6. The data also includes third data; The first vehicle also holds the third data; the second vehicle requests the first vehicle to transmit the first data and the third data; 3. The communication system according to claim 1, wherein the first vehicle selects the first data from the first data and the third data based on the speed of the first vehicle in response to a request from the second vehicle, and transmits the selected first data to the second vehicle.

7. The data also includes third data; the management information includes third information for verifying the validity of the third data; The first vehicle also holds the third data; the second vehicle requests the first vehicle to transmit data held by the first vehicle; the first vehicle transmits the first data and the third data to the second vehicle in response to a request from the second vehicle; the second vehicle confirms whether it holds the first data and the third data received from the first vehicle; 3. The communication system according to claim 1, wherein, when the second vehicle does not hold the third data, the second vehicle verifies the validity of the third data based on the third information included in the management information.

8. The data also includes third data; The first vehicle also holds the third data; the second vehicle requests the first vehicle to transmit data held by the first vehicle; the first vehicle, in response to a request from the second vehicle, selects the first data from the first data and the third data based on a speed of the first vehicle, and transmits the selected first data to the second vehicle; The communication system according to claim 1 or 2, wherein the second vehicle confirms whether it holds the first data received from the first vehicle.

9. The data also includes third data; the management information includes third information for verifying the validity of the third data; The first vehicle also holds the third data; the first vehicle transmits the first data and the third data to the second vehicle; the second vehicle confirms whether it holds the first data and the third data received from the first vehicle; 3. The communication system according to claim 1, wherein, when the second vehicle does not hold the third data, the second vehicle verifies the validity of the third data based on the third information included in the management information.

10. The data also includes third data; The first vehicle also holds the third data; the first vehicle selects the first data from the first data and the third data based on a speed of the first vehicle, and transmits the selected first data to the second vehicle; The communication system according to claim 1 or 2, wherein the second vehicle confirms whether it holds the first data received from the first vehicle.

11. The communication system according to claim 1 or 2, wherein the second vehicle receives the first data from the server if the second vehicle is unable to acquire the first data by the acquisition deadline.

12. A communication method among a server that stores data including first data and second data, first information for verifying the validity of the first data, and second information for verifying the validity of the second data, and a first vehicle and a second vehicle that are capable of communicating with the server, a step in which the server transmits management information including the first information and the second information and the first data to the first vehicle, and transmits the management information and the second data to the second vehicle; the first vehicle receiving the management information and the first data from the server; the second vehicle receiving the management information and the second data from the server; the first vehicle transmitting the first data to the second vehicle; a step of the second vehicle receiving the first data from the first vehicle and then verifying the authenticity of the first data based on the first information included in the management information; A communication method comprising:

13. A communication method among a first vehicle that holds data including first data and second data, a server that stores first information for verifying the validity of the first data and second information for verifying the validity of the second data, and the first vehicle and a second vehicle that can communicate with the server, the server transmitting management information including the first information and the second information to the second vehicle; the second vehicle receiving the management information from the server; the first vehicle transmitting the first data to the second vehicle; a step of the second vehicle receiving the first data from the first vehicle and then verifying the authenticity of the first data based on the first information included in the management information; A communication method comprising:

14. a first communication unit that receives management information including first data and second data, first information for verifying the validity of the first data, and second information for verifying the validity of the second data from a server that stores the data including the first data and the second data, and the second data; a second communication unit that receives the first data from another vehicle that has received the management information and the first data from the server; a processing unit that verifies the validity of the first data received by the second communication unit based on the first information included in the management information received by the first communication unit; A vehicle equipped with:

15. a first communication unit that receives management information including first information for verifying the validity of first data and second information for verifying the validity of second data from a server that stores the first information and the second information; a second communication unit that receives the first data from another vehicle that holds data including the first data and the second data; a processing unit that verifies the validity of the first data received by the second communication unit based on the first information included in the management information received by the first communication unit; A vehicle equipped with:

Images