Movable body management device, movable body management method, and computer program

Abstract

To reduce a concern caused by a positioning signal of impersonation related to a moving body and a concern caused by takeover and file replacement.SOLUTION: A signal authentication unit of a movable body management device determines authenticity of a positioning signal received by a movable body to be managed by using a reception state of the positioning signal in the movable body to be managed obtained from positioning signal state information received from the movable body to be managed and a signal authenticity determination reference given in advance. The vehicle authentication unit determines the authenticity of the vehicle that has transmitted the vehicle identification information by using the vehicle identification information received from the moving object to be managed and a predetermined vehicle authenticity determination reference. The moving body abnormality detection unit detects an abnormality of the moving body to be managed, using the determination result of the authenticity of the positioning signal and the determination result of the authenticity of the airframe. The output unit outputs abnormality detection information when an abnormality of the moving body to be managed is detected.SELECTED DRAWING: Figure 12

Description

[Technical Field]

[0001] The present disclosure relates to a mobile object management device, a mobile object management method, and a computer program for managing the movement of a mobile object. [Background technology]

[0002] Technological development is progressing for autonomous driving of mobile objects such as unmanned aerial vehicles (also known as drones or UAVs (Unmanned Aerial Vehicles)) and cars without human operation. To detect their own location, such autonomous mobile objects use positioning signals transmitted from positioning satellites of a satellite positioning system, for example.

[0003] There are concerns about malicious spoofing of positioning signals. In other words, it is thought that a situation could arise in which a false signal (a spoofed positioning signal) with the same specifications as the positioning signal transmitted from a positioning satellite is transmitted to a mobile object. Spoofed positioning signals could cause problems, such as the mobile object being unable to correctly detect its location. This could lead to abnormal situations, such as the mobile object moving off its planned route.

[0004] Patent Document 1 (International Publication No. 2021 / 166222) discloses a configuration for determining the normality of a positioning signal transmitted by a positioning satellite. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] International Publication No. 2021 / 166222 Summary of the Invention [Problem to be solved by the invention]

[0006] Self-driving mobile vehicles are being put into practical use for the delivery of goods and the monitoring of important facilities. However, the following concerns remain as they move toward practical use. One of these concerns is the risk of spoofed positioning signals, as described above. Another concern is the risk of malicious actors hijacking a mobile vehicle or substituting a fake mobile vehicle. That is, hijacking a mobile vehicle could result in the theft of goods during delivery, or the substituted mobile vehicle could be used to endanger important facilities, for example. The technology disclosed in Patent Document 1 can mitigate concerns about spoofed positioning signals by determining the normality of the positioning signal. However, the technology disclosed in Patent Document 1 cannot address the risk of hijacking a mobile vehicle or substituting a fake mobile vehicle.

[0007] The present disclosure has been devised to solve the above-mentioned problems, that is, a main objective of the present disclosure is to provide a technology for mitigating concerns arising from spoofed positioning signals related to mobile objects, as well as concerns arising from hijacking and substitution. [Means for solving the problem]

[0008] In order to achieve the above-mentioned object, one aspect of the mobile object management device of the present disclosure is a receiving unit that receives, from a mobile object to be managed that receives the positioning signal with the security measures implemented, positioning signal status information indicating a reception status of the positioning signal and device identification information with the security measures implemented; a signal authentication unit that determines the authenticity of the positioning signal received by the mobile object to be managed, using a reception status of the positioning signal at the mobile object to be managed obtained from the received positioning signal status information and a predetermined signal authenticity determination criterion; an apparatus authentication unit that determines the authenticity of the apparatus that has transmitted the apparatus identification information by using the received apparatus identification information and a predetermined apparatus authenticity determination standard; a mobile object abnormality detection unit that detects abnormalities in the mobile object to be managed using a result of determining the authenticity of the positioning signal and a result of determining the authenticity of the device; an output unit that outputs abnormality detection information when an abnormality is detected in the mobile object to be managed; Equipped with.

[0009] In one aspect, the mobile object management method according to the present disclosure includes: By computer, receiving, from a mobile object to be managed that receives the positioning signal with the security measures implemented, positioning signal status information indicating the reception status of the positioning signal and device identification information with the security measures implemented; determining the authenticity of the positioning signal received by the mobile object to be managed using a reception status of the positioning signal at the mobile object to be managed obtained from the received positioning signal status information and a predetermined signal authenticity determination criterion; Using the received machine identification information and a predetermined machine authenticity determination standard, the authenticity of the machine that transmitted the machine identification information is determined; Detecting abnormalities in the mobile object to be managed using the results of determining the authenticity of the positioning signal and the results of determining the authenticity of the device; When an abnormality is detected in a mobile object to be managed, abnormality detection information is output.

[0010] In one aspect, the computer program according to the present disclosure includes: receiving, from a mobile object to be managed that receives the positioning signal with the security measures implemented, positioning signal status information indicating the reception status of the positioning signal and device identification information with the security measures implemented; a process of determining the authenticity of the positioning signal received by the mobile object to be managed, using the reception status of the positioning signal at the mobile object to be managed, obtained from the received positioning signal status information, and a predetermined signal authenticity determination criterion; a process of determining the authenticity of the aircraft that transmitted the aircraft identification information using the received aircraft identification information and a predetermined aircraft authenticity determination criterion; A process of detecting an abnormality in the mobile object to be managed using the result of determining the authenticity of the positioning signal and the result of determining the authenticity of the mobile object; A process for outputting abnormality detection information when an abnormality is detected in a mobile object under management. to be executed by the computer. [Effects of the Invention]

[0011] According to the present disclosure, concerns about spoofed positioning signals related to mobile objects and concerns about hijacking or substitution can be reduced. [Brief explanation of the drawings]

[0012] [Figure 1] 1 is a diagram illustrating a mobile object to be managed by a mobile object management device according to the present disclosure. FIG. [Figure 2] 1 is a block diagram illustrating a configuration of an embodiment of a mobile object management device according to the present disclosure. [Figure 3] FIG. 2 is a diagram illustrating an example of the configuration of a mobile object to be managed (object to be managed). [Figure 4] FIG. 10 is a diagram illustrating an example of a display screen showing abnormality detection information. [Figure 5] FIG. 10 is a diagram illustrating another example of a display screen showing abnormality detection information. [Figure 6] 10 is a flowchart illustrating an example of the operation of an embodiment of a mobile object management device. [Figure 7] FIG. 10 is a block diagram illustrating the configuration of another embodiment of a mobile object management device according to the present disclosure. [Figure 8] FIG. 10 is a diagram illustrating an example of a display screen showing area abnormality information. [Figure 9] FIG. 10 is a diagram illustrating yet another embodiment of a mobile object management device according to the present disclosure. [Figure 10] FIG. 10 is a block diagram illustrating yet another embodiment of a mobile object management device according to the present disclosure. [Figure 11] FIG. 10 is a block diagram illustrating yet another embodiment of a mobile object management device according to the present disclosure. [Figure 12] FIG. 10 is a block diagram illustrating another embodiment of a mobile object management device according to the present disclosure. [Figure 13] 10 is a flowchart illustrating an example of the operation of another embodiment of a mobile object management device according to the present disclosure. DETAILED DESCRIPTION OF THE INVENTION

[0013] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings.

[0014] First Embodiment A mobile object management device (hereinafter also referred to as a management device for short) according to a first embodiment of the present disclosure is a device that manages the movement of mobile objects. The mobile object managed by the management device of the first embodiment is a mobile object capable of autonomous driving, and has a function of detecting its own location using a positioning signal transmitted from a positioning satellite 2 of a satellite positioning system as shown in FIG. 1 . Hereinafter, the mobile object to be managed will be described using an unmanned aerial vehicle (also referred to as a drone or UAV) or a flying vehicle such as a so-called flying car as an example. However, the configuration of the management device of the first embodiment can also be applied to mobile objects other than flying vehicles (for example, a ground-based mobile object such as an autonomous bus). Note that flying cars are also referred to as eVTOL (Electric Vertical Take-Off and Landing), AAM (Advanced Air Mobility), UAM (Urban Air Mobility), etc.

[0015] FIG. 3 shows components related to the management device 5 in a mobile object to be managed (hereinafter also referred to as a managed object) 3. As shown in FIG. 3, the managed object 3 is equipped with a control device 30. The control device 30 includes an arithmetic device 31 and a storage device 33 that stores a computer program (hereinafter also referred to as a program) 32. The arithmetic device 31 is configured with a processor such as a CPU (Central Processing Unit). The arithmetic device 31 can have various functions according to the program 32 by reading and executing the program 32 stored in the storage device 33. Here, the arithmetic device 31 includes a receiving unit 35, a position calculation unit 36, and a communication unit 37 as functional units related to the management device 5. The arithmetic device 31 also includes a functional unit related to flight control (a flight control unit), but a description thereof will be omitted here.

[0016] The receiving unit 35 receives positioning signals from the positioning satellites 2 via a positioning signal antenna (not shown) provided in the managed object 3. Here, the receiving unit 35 constantly receives positioning signals transmitted from a plurality of (for example, four) positioning satellites 2. The information contained in the positioning signals received in this way is stored in the storage device 33 in association with information on the time of reception.

[0017] In this case, the managed object 3 receives a positioning signal from a positioning satellite 2 that transmits a positioning signal to which security measures have been applied. In other words, the positioning signal received by the managed object 3 has been subjected to security measures. Examples of security measures applied to the positioning signal include encrypting the positioning signal and using a digital certificate. The security measures used here are not limited to a specific type of security measure as long as they are based on technology that can verify the authenticity of the positioning signal and the source of the positioning signal, and therefore a description thereof will be omitted.

[0018] The receiving unit 35 further verifies the authenticity of the received positioning signal. The method for verifying the authenticity of the positioning signal is determined according to the type of security measures implemented on the positioning signal. For example, if the positioning signal is encrypted, which is one of the security measures, the receiving unit 35 performs a predetermined decryption process on the received positioning signal and verifies the authenticity of the positioning signal if the decryption is successful. Furthermore, if the receiving unit 35 fails to decrypt the positioning signal, it recognizes that it was unable to verify the authenticity of the positioning signal. In other words, if the authenticity of the positioning signal can be verified, the information on the positioning signal can be acquired, which means that the reception of the positioning signal has been successful. However, if the authenticity of the positioning signal cannot be verified, the information on the positioning signal cannot be acquired, which means that the reception of the positioning signal has failed.

[0019] The receiving unit 35 stores information indicating whether or not the authenticity of the received positioning signal has been confirmed (in other words, the reception status) in the storage device 33 as positioning signal status information.

[0020] The position calculation unit 36 ​​calculates the location of its own device (the managed object itself) using the received positioning signals. That is, information for calculating position information is stored in advance in the storage device 33. The information for calculating position information is information such as a calculation formula for calculating the location of the managed object 3 using the positioning signals received from the multiple positioning satellites 2. The position calculation unit 36 ​​calculates its own location every moment using such information for calculating position information and the information of the received positioning signals. The location of the managed object 3 is expressed, for example, using coordinates of latitude, longitude, and height (altitude) in a geographic coordinate system.

[0021] The position calculation unit 36 ​​associates the calculated position information with the time information when the mobile phone was at the position, and stores the information in the storage device 33 as position information.

[0022] The communication unit 37 communicates information with the management device 5. That is, the communication unit 37 has a function of transmitting information to the management device 5 and a function of receiving information transmitted from the management device 5. In the first embodiment, the communication unit 37 transmits aircraft identification information to the management device 5. The aircraft identification information is information that identifies the aircraft of the managed object 3, and is individually assigned to each managed object 3 and stored in the storage device 33. The aircraft identification information may be any information that identifies the aircraft of the managed object 3, and may be, for example, a number determined by the operator of the managed object 3, or a registration code assigned by aircraft registration under the unmanned aerial vehicle registration system.

[0023] In the first embodiment, security measures are implemented for the machine identification information transmitted from the communication unit 37 to the management device 5. The security measures implemented for the machine identification information are not limited to a specific type of security measures as long as they are based on technology that can verify the authenticity of the machine identification information, and therefore a description thereof will be omitted. Note that the security measures implemented for the machine identification information may be of the same type as the security measures for the positioning signal, or may be different.

[0024] The communication unit 37 transmits the aircraft identification information, for which such security measures have been implemented, to the management device 5 at a preset transmission timing. The transmission timing may be set appropriately depending on the convenience of the operator of the managed object 3, and is not limited to, but examples include at preset time intervals (e.g., every second) or when the managed object 3 passes a predetermined passing point. Note that the managed object 3 has a remote ID (Identification) function in addition to the function of transmitting the aircraft identification information by the communication unit 37. The remote ID function is a function that transmits aircraft information including a registration code assigned when the aircraft is registered under the unmanned aerial vehicle registration system. The remote ID function is a system-specific function, and therefore a description of the remote ID function will be omitted here.

[0025] The communication unit 37 also transmits position information including information on the location calculated by the position calculation unit 36 ​​to the management device 5 every moment. Furthermore, the communication unit 37 transmits the above-mentioned positioning signal status information (information indicating the reception status of the positioning signal) to the management device 5. The timing of transmitting the positioning signal status information may be a timing corresponding to the reception timing of the positioning signal, or may be a timing at which the reception statuses of multiple positioning signals received at different times at time intervals longer than the reception interval of the positioning signal can be transmitted together to the management device 5. The position information, positioning signal status information, etc. transmitted from the communication unit 37 to the management device 5 are associated with machine identification information that identifies the managed object 3 that transmitted the information.

[0026] The managed object 3 has the above-mentioned configuration.

[0027] The management device 5 of the first embodiment is communicably connected to the managed object 3. Here, the method of connecting the management device 5 and the managed object 3 is not limited, and therefore a description thereof will be omitted.

[0028] The management device 5 of the first embodiment is, for example, a computer device used by an operator of the managed object 3, and has a configuration as shown in FIG. 2 . That is, the management device 5 includes an arithmetic unit 50 and a storage device 60. The storage device 60 includes a storage medium for storing data and a program 61. There are multiple types of storage devices, such as magnetic disk drives and semiconductor memory devices. Furthermore, there are multiple types of semiconductor memory devices, such as RAM (Random Access Memory) and ROM (Read Only Memory). A computer device may be equipped with multiple types of storage devices depending on the application, but these storage devices will be collectively referred to as storage devices 60 without distinguishing between them. Furthermore, the types and number of storage devices 60 equipped in the management device 5 are not limited, and a description thereof will be omitted. Furthermore, the management device 5 may be connected to a storage device (database) 6 separate from the management device 5, and data may be read and written to the storage device 6. However, a description of such a case will be omitted here.

[0029] In the first embodiment, the storage device 60 has registered in advance the aircraft identification information of the managed object 3. The storage device 60 also has registered in advance the flight plan (movement plan) of the managed object 3.

[0030] The arithmetic device 50 is configured with a processor such as a CPU (Central Processing Unit) or a GPU (Graphics Processing Unit). The arithmetic device 50 can have various functions based on a program 61 by reading and executing the program 61 stored in a storage device 60. Here, the arithmetic device 50 includes a receiving unit 51, a signal authenticating unit 52, an apparatus authenticating unit 53, a mobile object abnormality detecting unit 54, and an output unit 55, which are represented by solid lines in FIG. 2 as functional units related to the management of the managed object 3.

[0031] The receiver 51 receives location information, positioning signal status information, and device identification information from the managed object 3. As described above, the positioning signal status information is information that indicates the reception status of the positioning signal in the managed object 3, and includes information on whether the authenticity of the positioning signal received by the managed object 3 has been confirmed (in other words, whether reception of the positioning signal has been successful or unsuccessful). Furthermore, security measures are implemented for the device identification information.

[0032] The receiving unit 51 associates the received position information, positioning signal status information, and aircraft identification information, for example, with each other, and further associates the information with the reception time information, and stores them in the storage device 60.

[0033] The signal authentication unit 52 determines the authenticity of the positioning signal received by the managed object 3, using the reception status of the positioning signal at the managed object 3 obtained from the received positioning signal status information and a predetermined signal authenticity determination criterion. As described above, the managed object 3 also determines the authenticity of the positioning signal. The managed object 3 determines the authenticity of the positioning signal for each received positioning signal. In response to this, the signal authentication unit 52 determines whether the managed object 3 is continuously receiving an authentic positioning signal.

[0034] The signal authenticity determination criteria used by the signal authentication unit 52 are criteria for determining the authenticity of the positioning signal received by the managed object 3, and are set appropriately taking into consideration the time interval at which the managed object 3 receives the positioning signal, the environment in which the managed object 3 flies (moves), and the like. For example, if the managed object 3 is able to confirm the authenticity of the positioning signal in more than 70% of the cases in which the positioning signal is received during a predetermined time period (e.g., one minute) prior to the time of reception of the most recent positioning signal, the positioning signal received by the managed object 3 is determined to be authentic. In other words, if the managed object 3 is unable to confirm the authenticity of the positioning signal in more than 30% of the cases in which the positioning signal is received during a predetermined time period prior to the time of reception of the most recent positioning signal, the positioning signal received by the managed object 3 is determined to be inauthentic. Such a determination result is stored in the storage device 60, for example, in association with the aircraft identification information of the managed object 3 that transmitted the positioning signal status information on which the determination result was based and the time information of the determination.

[0035] The machine authentication unit 53 uses the received machine identification information and a predetermined machine authenticity determination standard to determine the authenticity of the machine that transmitted the machine identification information.

[0036] For example, since the machine identification information has undergone security measures as described above, the machine authentication unit 53 determines the authenticity of the received machine identification information using a method according to the type of security measures. For example, if the security measures applied to the machine identification information are encryption, the machine authentication unit 53 determines the authenticity of the received machine identification information based on whether the machine identification information can be correctly decrypted. Furthermore, the machine identification information of the managed object 3 is registered in the storage device 60 of the management device 5, and the machine authentication unit 53 determines, for example, whether the machine identification information determined to be authentic is registered in the storage device 60.

[0037] The machine authenticity determination criteria used by machine authentication unit 53 are criteria for determining whether the machine that transmitted the machine identification information is authentic. For example, the machine authenticity determination criteria are defined as criteria such that if the authenticity of the machine identification information can be confirmed in 80% or more of the number of times the machine identification information is received during a predetermined period going back from the time the latest machine identification information was received, and the machine identification information is registered in storage device 60, the machine that transmitted the machine identification information is determined to be authentic. In other words, one example of the machine authenticity determination criteria is a criterion for determining the authenticity of a machine using the determination result of the authenticity of the machine identification information and the determination result of whether or not it is registered.

[0038] The aircraft authentication unit 53 further has the following function. That is, if it is determined that the aircraft is not genuine, it is considered that the genuine aircraft has been replaced with the non-genuine aircraft (in other words, a fake aircraft). Since the replaced genuine aircraft (managed object 3) cannot be identified based on the information transmitted from the fake aircraft alone, the aircraft authentication unit 53 further has a function to identify the replaced managed object 3. The method for identifying the replaced managed object 3 is not limited here, but examples of information used to identify the replaced managed object 3 include the flight plan of the managed object 3 stored in the storage device 60, aircraft identification information, and flight trajectory information of the managed object 3 during flight (movement).

[0039] The result of the determination of the authenticity of the machine as described above is stored in the storage device 60 in association with the machine identification information of the managed object 3 that was the subject of the determination.

[0040] Note that because positioning signals and aircraft identification information are communicated wirelessly, communication conditions can deteriorate due to bad weather and other factors. Therefore, even if the positioning signals and aircraft identification information are genuine, there are cases where the authenticity of the positioning signals and aircraft identification information cannot be confirmed due to poor reception. Taking this into consideration, signal authenticity determination criteria and aircraft authenticity determination criteria may be set, including criteria that take into account the surrounding conditions of the managed object 3 during flight (movement). In this case, determining the authenticity of the positioning signals and aircraft may require dynamic data (information) that represent the surrounding conditions of the managed object 3, such as the weather in the airspace in which the managed object 3 is flying. In such cases, the management device 5 is provided with an acquisition unit 59, as indicated by the dotted line in FIG. 2 . The acquisition unit 59 acquires information representing the surrounding conditions of the managed object 3 from a predetermined information source 8. The authenticity of the positioning signals and aircraft is determined by the signal authentication unit 52 and the aircraft authentication unit 53 using the information acquired by the acquisition unit 59.

[0041] The mobile object abnormality detection unit 54 detects an abnormality in the managed object 3 by using the result of the determination of the authenticity of the positioning signal by the signal authentication unit 52, the result of the determination of the authenticity of the object by the object authentication unit 53, and the position information of the managed object 3 received by the receiving unit 51. The mobile object abnormality detection unit 54 also estimates the content of the abnormality in the managed object 3 in which the abnormality has been detected (hereinafter also referred to as the managed object 3 in which the abnormality has occurred).

[0042] The mobile object anomaly detection unit 54 uses, for example, anomaly detection criteria to detect an anomaly and estimate the nature of the anomaly. The anomaly detection criteria are criteria for detecting an anomaly in the managed object 3 using the determination result of the authenticity of the positioning signal, the determination result of the authenticity of the aircraft, and the position information of the managed object 3. The anomaly detection criteria are determined in advance and stored in the storage device 60.

[0043] An example of the anomaly detection criterion is an anomaly detection criterion that includes a plurality of detection criteria, as follows: For example, one of the detection criteria included in the anomaly detection criterion is that the received positioning signal is determined to be inauthentic by the signal authentication unit 52, and this criterion detects that there is a possibility that an abnormality has occurred in the managed object 3 that is receiving the inauthentic positioning signal. The abnormality of the managed object 3 according to this criterion is estimated to be an abnormality caused by the positioning signal, such as receiving a spoofed positioning signal.

[0044] Another detection criterion is that the machine authentication unit 53 has determined that the machine is not authentic, and this criterion detects that there is a possibility that an abnormality has occurred in the managed machine 3 that has been determined to be not authentic. The abnormality of the managed machine 3 based on this criterion is estimated to be that there is a high possibility that machine switching has occurred.

[0045] Another detection criterion is that both the positioning signal and the aircraft are authentic, but the movement trajectory (flight trajectory) obtained from the position information deviates from the flight plan, and this criterion detects that there is a possibility that an abnormality has occurred in a managed object 3 that deviates from the flight plan. The abnormality content of the managed object 3 according to this criterion is estimated to be highly likely to be an abnormality related to flight control.

[0046] Yet another detection criterion is that the duration of the state in which information such as location information cannot be obtained from a managed object 3 that is supposed to be moving is longer than a predetermined abnormality determination time (e.g., 3 minutes), and the radio communication conditions in the movement area (flight airspace) of the managed object 3 are not poor. Based on this criterion, an abnormality is detected in a managed object 3 from which information cannot be obtained. The abnormality of the managed object 3 based on this criterion is estimated to be an abnormality in which information cannot be transmitted, such as a crash, a theft of the aircraft, or a malfunction of the communication function. The radio communication conditions in the movement area are estimated using, for example, weather information for the movement area and information on the communication conditions with multiple other managed objects 3 that are moving in the movement area.

[0047] The anomaly detection criteria as described above are associated with anomaly estimation information that indicates the content of the anomaly when an anomaly is detected according to the criteria. When an anomaly in the managed object 3 is detected using the anomaly detection criteria, the mobile object anomaly detection unit 54 estimates the content of the anomaly using the anomaly estimation information. Furthermore, when the mobile object anomaly detection unit 54 detects an anomaly in the managed object 3 as described above, it associates the time information when the anomaly was detected, the device identification information of the managed object 3 in which the anomaly occurred, and anomaly content information that indicates the content of the estimated anomaly, and stores them in the storage device 60 as anomaly detection history information.

[0048] The output unit 55 outputs abnormality detection information when an abnormality is detected in the managed object 3. The abnormality detection information is information indicating that an abnormality in the managed object 3 has been detected by the mobile object abnormality detection unit 54. One example of a destination to which the abnormality detection information is output is a display device 7 connected to the management device 5. The display device 7 is a device used, for example, by a monitoring person at the operator of the managed object 3 to monitor the operational status (movement status) of the managed object 3.

[0049] The abnormality detection information includes, for example, the aircraft identification information of the managed object 3 in which the abnormality has occurred and information indicating the details of the abnormality. Furthermore, the abnormality detection information may include information acquired from the flight plan of the managed object 3 in which the abnormality has occurred. For example, information on the planned flight path of the managed object 3 in which the abnormality has occurred may be extracted from the flight plan and included in the abnormality detection information. Furthermore, the abnormality detection information may include the following information. For example, the abnormality detection information may include information indicating an estimated movement area in which the managed object 3 in which the abnormality has occurred is estimated to be flying (located) (i.e., an area in which the managed object 3 in which the abnormality has occurred is estimated to be highly likely to be located). When information on such an estimated movement area is included in the abnormality detection information, the calculation device 50 may be provided with an estimation unit 56, as indicated by the dotted line in FIG. 2 . The estimation unit 56, as one functional unit of the calculation device 50, estimates the location of the managed object 3 in which the abnormality has occurred. There are cases where location information cannot be acquired from the managed object 3 in which the abnormality has occurred, or where even if location information is acquired, the location information is unreliable. In such cases, it is difficult to calculate the accurate location of the managed object 3. Taking such a case into consideration, here, the estimation unit 56 estimates an estimated movement area that is considered to be highly likely to be located. The method for estimating the estimated movement area is not limited here, but examples of information used for the estimation include location information from the most recent normal positioning signal before the abnormality was detected, location information transmitted from the most recent normal aircraft before the abnormality was detected, the movement speed of the managed object 3, information appropriately selected from information such as the flight plan, etc.

[0050] The display device 7, which has received the abnormality detection information as described above, uses the information contained in the abnormality detection information to notify that an abnormality has been detected in the managed object 3. Fig. 4 shows an example of a display screen of the display device 7 that notifies that an abnormality has been detected in the managed object 3. In the example of Fig. 4, the occurrence of an abnormality is displayed (notified) using text, and the machine identification information of the managed object 3 in which the abnormality has occurred and the details of the detected abnormality are also displayed in text.

[0051] FIG. 5 shows another example of the display screen of the display device 7 that notifies the detection of an abnormality in a managed object 3. In the example of FIG. 5, the display screen displays a map of an area (hereinafter also referred to as a management area) in which the movement of the managed object 3 is managed, and a mark 3M representing the managed object 3 is superimposed on this map. The position of the mark 3M on the map is a position corresponding to the location information transmitted from the corresponding managed object 3, and indicates the location of the corresponding managed object 3. On such a display screen, information notifying the detection of an abnormality in the managed object 3 is superimposed. In the example of FIG. 5, a mark (arrow mark) pointing to the mark 3M of the managed object 3 in which an abnormality has occurred is displayed, and information such as machine identification information for identifying the managed object 3 in which an abnormality has occurred and the content of the abnormality are displayed in text. In other words, in the example of FIG. 5, the mark 3M of the managed object 3 in which an abnormality has occurred and the arrow mark pointing to the mark 3M function as information indicating the location of the managed object 3 in which an abnormality has occurred. Furthermore, in the example of Figure 5, information representing the range of the estimated movement area of ​​the abnormality-occurring management object 3 estimated by the estimation unit 56 is represented by a dotted line, and information on the planned flight route according to the flight plan of the abnormality-occurring management object 3 is represented by a dotted line.

[0052] When a monitoring person sees the display of an abnormality detected by the display device 7, they deal with the abnormality of the managed object 3 using a predetermined response method. For example, if an abnormality is detected in the positioning signal, it is considered that normal operation is not possible, so the managed object 3 in which the abnormality was detected is landed and operation is halted or suspended. If an abnormality is detected in the aircraft, there is a suspicion that it has been replaced with a fake aircraft, so for example, the fake aircraft is recovered, a search is made for the genuine managed object 3 (real aircraft), and a report is made to the police, etc. Furthermore, if an abnormality is detected in which the flight path of the managed object 3 deviates from the flight plan, flight control is performed to correct the trajectory of the managed object 3 that is deviating from the flight plan. Furthermore, if an abnormality is detected in which position information cannot be acquired, a search is made for the managed object 3 from which position information cannot be acquired, and a report is made to the police, etc.

[0053] The output destination of the anomaly detection information by the output unit 55 is not limited to the display device 7 as described above, and may include, for example, the computer device 4 of a traffic management system as shown in FIG. 2. Examples of traffic management systems include UTM (Unmanned Aircraft System (UAS) Traffic Management) and UATM (Urban Air Traffic Management). The anomaly detection information output to such a traffic management system is used for traffic management of unmanned aerial vehicles and flying cars in the system.

[0054] The management device 5 has the configuration as described above. Next, an example of the operation of the management device 5 related to the management of the movement of the managed object 3 will be described with reference to Fig. 6. Fig. 6 is a flowchart showing an example of the operation of the management device 5 related to the management of the movement of the managed object 3. It can also be said that Fig. 6 shows an example of a mobile object management method for the managed object 3 by the management device 5.

[0055] For example, when the receiving unit 51 of the computing device 50 receives positioning signal status information, device identification information, and location information from the managed object 3 (step 101 in FIG. 5), the signal authenticating unit 52 and device authenticating unit 53 each perform the following processing using the received information. That is, the signal authenticating unit 52 determines the authenticity of the positioning signal received by the managed object 3 using information indicating the reception status of the positioning signal at the managed object 3, which is included in the positioning signal status information, and the signal authenticity determination criteria. Furthermore, the device authenticating unit 53 determines the authenticity of the device using the determination result of the authenticity of the device identification information according to the type of security measure applied to the device identification information, information on whether the device identification information is registered, and the device authenticity determination criteria (step 102). The processing by the signal authenticating unit 52 and the processing by the device authenticating unit 53 may be performed in parallel or sequentially. When processing is performed sequentially, the order of processing by the signal authentication unit 52 and processing by the device authentication unit 53 is not limited, and the device authentication unit 53 may perform processing after the signal authentication unit 52 performs processing, or vice versa.

[0056] Thereafter, the mobile object abnormality detection unit 54 determines whether or not an abnormality has been detected in the managed object 3, using the determination result by the signal authentication unit 52, the determination result by the device authentication unit 53, the location information, and the abnormality detection criteria (step 103). If the mobile object abnormality detection unit 54 determines that no abnormality has occurred, the management device 5 determines whether or not to terminate the management operation, for example, by determining whether or not an end instruction to terminate the management operation related to management of the movement of the managed object 3 has been input to the management device 5 (step 105). If the management operation is not to be terminated, the management device 5 waits for the next reception of positioning signal status information, device identification information, and location information, and then repeats the operations from step 101 onwards.

[0057] On the other hand, if the mobile object anomaly detection unit 54 detects an anomaly in the managed object 3 as a result of the determination operation in step 103, the output unit 55 outputs the anomaly detection information to a predetermined output destination (step 104). Thereafter, in step 105, the management device 5 determines whether or not to end the management operation, and if not, repeats the operations from step 101 onwards, as described above. Such management operation of the management device 5 is executed until it is determined in step 105 that the management operation should be ended.

[0058] The management device 5 of the first embodiment has the above-described configuration, and therefore can achieve the following effects. That is, the management device 5 includes a signal authentication unit 52, an aircraft authentication unit 53, and a mobile object anomaly detection unit 54, and is configured to detect an anomaly in the managed object 3 using the determination result on the authenticity of the positioning signal, the determination result on the authenticity of the aircraft, and location information from the managed object 3. As a result, the management device 5 can detect not only an anomaly in the managed object 3 caused by a spoofed positioning signal, but also an anomaly related to the aircraft of the managed object 3, but also both. This can increase the reliability of the management of the movement of the managed object 3 (operation management), and can alleviate concerns regarding the practical application of goods delivery, monitoring of important facilities, and the like, using the managed object 3 (i.e., an autonomously driving mobile object). That is, the management device 5 can contribute to the practical application of businesses using autonomously driving mobile objects.

[0059] Furthermore, by including the estimation unit 56, the management device 5 of the first embodiment can achieve the following effect. That is, it is assumed that the managed object 3 in which an abnormality has occurred will be unable to transmit accurate location information or will be unable to transmit location information itself, and a situation may arise in which the management device 5 will be unable to calculate the location of the managed object 3 in which an abnormality has occurred using the location information. In such a case, the estimation unit 56 estimates an estimated movement area representing the location of the managed object 3 in which an abnormality has occurred. Therefore, even if the location of the managed object 3 in which an abnormality has occurred cannot be calculated using the location information, the management device 5 can obtain information on the approximate area in which the managed object 3 in which an abnormality has occurred is located. Then, the management device 5 can output information representing the location of the managed object 3 in which an abnormality has occurred estimated by the estimation unit 56 to the display device 7 or the computer device 4 of the traffic management system via the output unit 55. This allows a person in charge of monitoring the managed object 3 to narrow the area in which to search for the managed object 3 in which an abnormality has occurred, leading to the rapid discovery of the managed object 3 in which an abnormality has occurred.

[0060] Furthermore, by including the acquisition unit 59, the management device 5 of the first embodiment can acquire information representing the surrounding conditions of the managed object 3 by the acquisition unit 59. Furthermore, by including one or both of the signal authenticity determination criteria and the aircraft authenticity determination criteria in the criteria content using information representing the surrounding conditions of the managed object 3, the signal authentication unit 52 and the aircraft authentication unit 53 can make a determination regarding the authenticity of the positioning signal or the aircraft, taking into account changes in the surrounding conditions of the managed object 3. This can increase the reliability of the determination results by the signal authentication unit 52 and the aircraft authentication unit 53.

[0061] In the first embodiment, the mobile object abnormality detection unit 54 detects an abnormality in the managed object 3 not only using the determination results of the signal authentication unit 52 and the aircraft authentication unit 53 but also using position information transmitted from the managed object 3. Alternatively, for example, when detection of an abnormality in the managed object 3 using position information is performed separately (for example, when it is incorporated into flight control), the mobile object abnormality detection unit 54 does not need to detect an abnormality in the managed object 3 using position information.

[0062] Second Embodiment A second embodiment according to the present disclosure will be described below. In the description of the second embodiment, components having the same names as those in the description of the first embodiment will be denoted by the same reference numerals, and a duplicate description of the common parts will be omitted.

[0063] The management device 5 of the second embodiment includes a monitoring unit 57 as shown in Fig. 7 in addition to the configuration of the first embodiment. The monitoring unit 57 is one of the functional units of the arithmetic device 50. Using the determination result of the signal authentication unit 52, the monitoring unit 57 monitors whether or not there is an area in the management area where there is a risk of receiving an inauthentic positioning signal (hereinafter also referred to as an unauthorized positioning signal). Then, the monitoring unit 57 detects, through monitoring, an area where there is a risk of receiving an unauthorized positioning signal as an area requiring attention.

[0064] That is, as described in the first embodiment, the signal authentication unit 52 judges the authenticity of the positioning signal received by the managed object 3. The monitoring unit 57 uses the judgment result of the signal authentication unit 52 to detect a managed object 3 receiving an unauthorized positioning signal. Furthermore, the monitoring unit 57 acquires information on an estimated movement area in which the managed object 3 receiving the unauthorized positioning signal is estimated to be flying from the estimation result of the estimation unit 56. Using this acquired information on the estimated movement area, the monitoring unit 57 calculates the distribution status of the managed objects 3 receiving the unauthorized positioning signal. Then, using this distribution status, if the monitoring unit 57 detects an area where a large number of managed objects 3 receiving the unauthorized positioning signal are densely located, the monitoring unit 57 detects that this area is a caution area where there is a risk of receiving an unauthorized positioning signal.

[0065] The method for identifying a caution area from the distribution of managed objects 3 receiving fraudulent positioning signals is not limited here, but one example is a method using cluster analysis. Another example is the following method. For example, assume that a route (hereinafter also referred to as a corridor) taken by managed objects 3 is divided into multiple areas (divided areas). In each of these divided areas, it is determined whether the density of managed objects 3 receiving fraudulent positioning signals is equal to or greater than a threshold, and a divided area where the density is equal to or greater than the threshold is detected as a caution area. A caution area may be detected by such a method.

[0066] Furthermore, an example of the timing at which the monitoring unit 57 executes the process of detecting an area requiring attention is when, each time a preset monitoring period (for example, 5 minutes) has elapsed, the process of detecting an area requiring attention is executed using the result of the judgment made by the signal authentication unit 52 during that monitoring period.

[0067] In the second embodiment, when the monitoring unit 57 detects a caution area, the output unit 55 outputs area abnormality information. The area abnormality information is information that notifies that a caution area in which an unauthorized positioning signal may be received has been detected, and includes information indicating the location of the caution area. Examples of destinations to which the area abnormality information is output include the same output destinations as the output destinations of the abnormality detection information shown in the first embodiment. In other words, examples of destinations to which the area abnormality information is output include the computer device 4 of the traffic management system and the display device 7.

[0068] On the display device 7 that has received the area abnormality information, for example, a display such as that shown in FIG. 8 is displayed. In the example of FIG. 8, a map of the management area in which the management device 5 manages the movements of the managed objects 3 is displayed on the display screen of the display device 7. An image representing a caution area (the area surrounded by a solid line R in FIG. 8) is superimposed on this map. Furthermore, in the example of FIG. 8, a circle mark and a black mark are superimposed on the map. The circle mark and the black mark are symbols representing the location of the managed object 3 that transmitted the information used to detect the caution area related to the positioning signal (i.e., the positioning signal status information processed by the signal authentication unit 52). The circle mark represents the location of the managed object 3 that is receiving a genuine positioning signal. The black mark represents the center position of the estimated movement area of ​​the managed object 3 that is believed to be receiving an unauthorized positioning signal.

[0069] The display mode of the display device 7 indicating the attention-required area is not limited to the example shown in FIG. 8 , and any appropriate display mode may be used, taking into consideration ease of viewing for the monitoring personnel at the operator of the managed object 3. When a monitoring personnel sees the display of the display device 7 indicating such an attention-required area and recognizes that an incident requiring action has occurred, the monitoring personnel may take the following measures regarding the attention-required area, for example: For example, using the flight plans registered in the storage device 60, managed objects 3 having flight plans passing through the attention-required area are extracted, for example, by the search function of the management device 5. Then, a flight plan revision is performed, such as changing the planned flight route of the flight plan for the extracted managed object 3 to a planned flight route that bypasses the attention-required area. As a result, the flight plan stored in the storage device 60 is updated to the revised flight plan. Note that the subject of the flight plan revision may not only be the planned flight route, but may also be, for example, the departure point, departure time, or destination of the managed object 3, depending on the size (area), location, and purpose of the flight of the attention-required area. Furthermore, a flight plan revision may also be performed to postpone the flight until the attention-required area is resolved.

[0070] The configuration of the management device 5 of the second embodiment other than the above-mentioned configuration is the same as that of the first embodiment.

[0071] As described above, the management device 5 of the second embodiment has the same configuration as the first embodiment, and can therefore achieve the same effects as the first embodiment. Furthermore, the management device 5 of the second embodiment has a monitoring unit 57, which can detect a caution area where there is a risk of receiving an unauthorized positioning signal. As a result, when a caution area is detected, the management device 5 can urge a monitoring person or the like to take measures to avoid movement of the caution area. By taking such measures, it is possible to prevent the managed object 3 from moving through the caution area, and to reduce abnormalities in the managed object 3 caused by receiving an unauthorized positioning signal. In this way, the management device 5 can further improve the safety of the operation (movement) of the managed object 3.

[0072] Third Embodiment A third embodiment according to the present disclosure will be described below. In the description of the third embodiment, components having the same names as those in the descriptions of the first and second embodiments will be denoted by the same reference numerals, and a duplicate description of the common parts will be omitted.

[0073] The management device 5 of the third embodiment has the following configuration in addition to the configuration of the second embodiment. That is, in the third embodiment, the management device 5 is communicably connected to a receiving device 9 shown in FIG. 9 and also uses information from the receiving device 9 to manage the movement of the managed object 3. The receiving device 9 is fixed to a building, a lighting pole, or the like, and is a device that receives a positioning signal transmitted from a positioning satellite 2. Here, the positioning satellite 2 is also the positioning satellite that transmits the positioning signal received by the managed object 3. That is, the receiving device 9 receives the same positioning signal as the positioning signal received by the managed object 3. This positioning signal has security measures implemented therefor, as described in the first embodiment and the like.

[0074] The location where the receiving device 9 is installed (fixed) may be any location where it can receive positioning signals arriving in the management area (e.g., a corridor) where the management device 5 manages the movement of the managed object 3, and is selected appropriately taking into consideration ease of installation, etc.

[0075] As described above, security measures are implemented for the positioning signal received by the receiving device 9. Therefore, the receiving device 9 has the following functions similar to the functions related to the security measures for the positioning signal that the receiving unit 35 of the managed object 3 has. That is, the receiving device 9 is provided with, for example, an arithmetic unit including a processor, and a confirmation unit 91 as shown in FIG. 10 is provided as one functional unit realized by the arithmetic unit. The confirmation unit 91 confirms the authenticity of the received positioning signal using a predetermined method according to the type of security measures. For example, if the positioning signal is encrypted, the confirmation unit 91 performs a decryption process on the received positioning signal according to the type of encryption, and confirms the authenticity of the positioning signal if the decryption is successful. In other words, the confirmation unit 91 determines that the received positioning signal is authentic. Conversely, if the confirmation unit 91 fails to decrypt the positioning signal, it recognizes that it was unable to confirm the authenticity of the positioning signal. In other words, it determines that the received positioning signal is not authentic (is a spoofed positioning signal). The result of the determination on the authenticity of the positioning signal is stored in a storage device (not shown) provided in the receiving device 9, for example, in association with time information when the determination process was performed. Furthermore, the receiving device 9 outputs information indicating the result of the determination on the authenticity of the positioning signal to the management device 5 as positioning signal status information. Note that in the third embodiment, the management device 5 receives positioning signal status information output from each of the multiple receiving devices 9. The multiple receiving devices 9 are installed in different locations. The number and installation intervals of these receiving devices 9 are appropriately set taking into consideration, for example, the size (area) of a unit area where abnormalities in the positioning signal are to be detected, the installation environment, the number of data to ensure the reliability of abnormality detection, and the like. Furthermore, the positioning signal status information output from the receiving device 9 is associated with device identification information that identifies the receiving device 9 that transmitted the information.

[0076] In the third embodiment, the receiving unit 51 of the management device 5 further receives positioning signal status information from the receiving device 9. The receiving unit 51 stores the received positioning signal status information in the storage device 60. Furthermore, the signal authenticating unit 52 determines the authenticity of the positioning signal received by the receiving device 9, in the same way as determining the authenticity of the positioning signal received by the managed object 3. That is, the signal authenticating unit 52 determines the authenticity of the positioning signal received by the receiving device 9, using the reception status of the positioning signal obtained from the positioning signal status information from the receiving device 9 and a signal authenticity determination criterion that is given in advance.

[0077] The monitoring unit 57 uses the judgment results of the signal authentication unit 52 to monitor the authenticity of the positioning signals received by each of the managed object 3 and the receiving device 9, thereby detecting areas requiring caution where there is a risk of receiving an inauthentic positioning signal (an unauthorized positioning signal).

[0078] Then, as in the second embodiment, when the monitoring unit 57 detects an area requiring attention, the output unit 55 outputs area abnormality information to a predetermined output destination such as the computer device 4 or display device 7 of the traffic management system.

[0079] The configuration of the management device 5 in the third embodiment other than the above-mentioned configuration is the same as that in the second embodiment.

[0080] The management device 5 in the third embodiment has the configuration of the second embodiment, and can therefore achieve the same effects as those obtained from the second embodiment. Furthermore, the management device 5 in the third embodiment detects an attention-required area by using the positioning signal status information output from the receiving device 9 in addition to the configuration of the second embodiment. In other words, by using the positioning signal status information output from the receiving device 9 in addition to the positioning signal status information output from the managed object 3 as in the second embodiment, it is possible to increase the amount of information used in the attention-required area detection process. This can increase the reliability of the management device 5's detection of an attention-required area.

[0081] In the above example, the receiving device 9 is provided with the confirmation unit 91. Alternatively, depending on the processing capacity of the management device 5, the receiving device 9 may not be provided with the confirmation unit 91, and the receiving unit 51 of the arithmetic device 50 of the management device 5 may be provided with a function similar to that of the confirmation unit 91. In this case, the receiving device 9 outputs the received positioning signal to the management device 5 while the security measures are still in place. In addition to the functions described above, the receiving unit 51 of the management device 5 determines the authenticity of each positioning signal received from the receiving device 9 in the same way as the confirmation unit 91. Using this determination result, the signal authentication unit 52 determines the authenticity of the positioning signal received by the receiving device 9. As described above, the monitoring unit 57 determines the reliability of the positioning signal in the management area that manages the movement of the managed object 3.

[0082] <Fourth embodiment> A fourth embodiment according to the present disclosure will be described below. In the description of the fourth embodiment, components having the same names as those used in the descriptions of the first to third embodiments will be denoted by the same reference numerals, and a duplicate description of the common parts will be omitted.

[0083] As shown in FIG. 11 , the management device 5 of the fourth embodiment includes a proposal unit 58 as a functional unit of the calculation device 50 in addition to the configuration of the second or third embodiment. When the monitoring unit 57 detects a caution area where there is a risk of receiving an unauthorized positioning signal, the proposal unit 58 proposes a change to the flight plan, which is a movement plan for moving through the caution area. That is, when the monitoring unit 57 detects a caution area, the proposal unit 58 extracts a flight plan including a planned flight path that moves through the caution area from the flight plans stored in the storage device 60 as a flight plan requiring review. Then, the proposal unit 58 calculates a change to the flight plan requiring review that avoids movement through the caution area (in other words, a change that addresses the caution area). Note that there are various methods for changing the flight plan to avoid movement through the caution area, including methods using AI (artificial intelligence) technology, and any method may be adopted here, and description thereof will be omitted. In addition, a change to the flight plan does not only mean changing the planned flight route to avoid the area requiring attention, but also includes, for example, changing the departure or destination of the managed object 3 depending on the extent of the area requiring attention, changing the aircraft to be operated due to a change in departure point, or suspending or canceling operations.

[0084] The proposed flight plan change calculated by the proposal unit 58 is proposed to the management personnel, for example, by being displayed on the display device 7 by the output unit 55. When the management personnel inputs approval information to adopt the proposed flight plan change displayed on the display device 7 into the management device 5, the proposal unit 58 updates the flight plan requiring review registered in the storage device 60 with the contents of the proposed change. When the management personnel inputs amendment information to amend the proposed change into the management device 5, the proposal unit 58 amends the proposed flight plan change in accordance with the amendment information. The amended proposed flight plan change is presented to the management personnel by being displayed on the display device 7 by the output unit 55, as described above. When the management personnel inputs approval information to adopt the amended proposed change into the management device 5, the proposal unit 58 updates the flight plan requiring review registered in the storage device 60 with the contents of the amended proposed change.

[0085] When the flight plan is updated in this way, for example, the output unit 55 notifies a predetermined destination of the flight plan update. The destination of the flight plan update can be, for example, the computer device 4 of the traffic management system. As a result, the flight plan registered in the traffic management system is also updated with the changed content.

[0086] The management device 5 of the fourth embodiment has the configuration of the second or third embodiment, and can therefore achieve the same effects as the second or third embodiment. Furthermore, the management device 5 of the fourth embodiment has a function of proposing a flight plan change plan to deal with an attention-requiring area when the monitoring unit 57 detects the area. This makes it possible for the management device 5 of the fourth embodiment to improve convenience and shorten the time required from the detection of an attention-requiring area to dealing with the area, thereby suppressing the occurrence of an abnormal situation in the managed object 3 caused by an unauthorized positioning signal.

[0087] <Other embodiments> The present disclosure is not limited to the first to fourth embodiments and may take various embodiments. For example, in the third embodiment, the monitoring unit 57 uses the determination result of the signal authentication unit 52 using the positioning signal status information output from both the managed object 3 and the receiving device 9 in the process of detecting the presence or absence of a caution area in the management area that manages the movement of the managed object 3. Instead of this, for example, if it is assumed that the number of installed receiving devices 9 can be increased and caution areas can be detected well without using information from the managed object 3, the monitoring unit 57 may use the determination result of the signal authentication unit 52 using only the positioning signal status information output from the receiving device 9 out of the managed object 3 and the receiving device 9.

[0088] In the second and third embodiments, when a caution area is detected, the area abnormality information that notifies the detection of the caution area (area where there is a risk of receiving an unauthorized positioning signal) is output to the computer device 4 and the display device 7 of the traffic management system, for example. In addition, the area abnormality information may also be output to, for example, a server of a navigation system that uses the positioning signal.

[0089] Furthermore, a mobile object management device (management device) according to the present disclosure may also have a configuration as shown in Fig. 12. A mobile object management device 80 shown in Fig. 12 is, for example, a computer device, and includes a receiving unit 81, a signal authentication unit 82, an object authentication unit 83, a mobile object abnormality detection unit 84, and an output unit 85 as functional units realized by executing a computer program.

[0090] The receiving unit 81 receives positioning signal status information and device identification information from a mobile object to be managed. A mobile object to be managed is a mobile object that receives a positioning signal for which security measures have been implemented. The positioning signal status information is information that indicates the reception status of the positioning signal. Security measures have been implemented for the device identification information.

[0091] The signal authentication unit 82 determines the authenticity of the positioning signal received by the managed mobile object using the reception status of the positioning signal at the managed mobile object obtained from the received positioning signal status information and predetermined signal authenticity determination criteria.

[0092] The machine authentication unit 83 uses the received machine identification information and a predetermined machine authenticity determination standard to determine the authenticity of the machine that transmitted the machine identification information.

[0093] The mobile object abnormality detection unit 84 detects abnormalities in the mobile object to be managed, using the determination result of the authenticity of the positioning signal and the determination result of the authenticity of the object.

[0094] The output unit 85 outputs abnormality detection information when an abnormality is detected in the mobile object to be managed.

[0095] The mobile object management device 80 shown in Fig. 12 has the configuration described above. Next, an example of the operation of the mobile object management device 80 will be described with reference to Fig. 13. Fig. 13 is a flowchart illustrating an example of the operation of the mobile object management device 80. Fig. 13 can also be said to be a diagram illustrating an example of a mobile object management method.

[0096] For example, when the receiving unit 81 receives positioning signal status information and device identification information from a mobile object to be managed (step 201), the signal authenticating unit 82 then determines the authenticity of the positioning signal received by the mobile object to be managed, using the reception status of the positioning signal at the mobile object to be managed and the signal authenticity determination criteria. Also, the device authenticating unit 83 determines the authenticity of the device that transmitted the device identification information, using the received device identification information and the device authenticity determination criteria (step 202).

[0097] Thereafter, the mobile object abnormality detection unit 84 determines whether or not there is an abnormality in the mobile object to be managed, using the determination result of the authenticity of the positioning signal and the determination result of the authenticity of the device. Then, when the mobile object abnormality detection unit 84 detects an abnormality in the mobile object to be managed (step 203), the output unit 85 outputs abnormality detection information (step 204).

[0098] The mobile object management device 80 has the above-described configuration, and determines not only the authenticity of the positioning signal received by the mobile object to be managed, but also the authenticity of the mobile object itself, and further detects abnormalities in the mobile object to be managed using the determination results of the authenticity of the positioning signal and the determination results of the authenticity of the mobile object. As a result, the mobile object management device 80 can effectively reduce concerns caused by spoofed positioning signals related to the mobile object, as well as concerns caused by hijacking or substitution.

[0099] A part or all of the above-described embodiments can be described as, but not limited to, the following supplementary notes. (Appendix 1) a receiving unit that receives, from a mobile object to be managed that receives the positioning signal with the security measures implemented, positioning signal status information indicating a reception status of the positioning signal and device identification information with the security measures implemented; a signal authentication unit that determines the authenticity of the positioning signal received by the mobile object to be managed, using a reception status of the positioning signal at the mobile object to be managed obtained from the received positioning signal status information and a predetermined signal authenticity determination criterion; an apparatus authentication unit that determines the authenticity of the apparatus that has transmitted the apparatus identification information by using the received apparatus identification information and a predetermined apparatus authenticity determination standard; a mobile object abnormality detection unit that detects abnormalities in the mobile object to be managed using a result of determining the authenticity of the positioning signal and a result of determining the authenticity of the device; an output unit that outputs abnormality detection information when an abnormality is detected in the mobile object to be managed; A mobile management device comprising: (Appendix 2) a monitoring unit that monitors whether or not there is an inauthentic positioning signal in a management area that manages the movement of the mobile object to be managed, using a result of the determination by the signal authentication unit of the authenticity of the positioning signal for the mobile object to be managed, The output unit outputs area abnormality information when the monitoring unit detects that there is a risk of receiving an inauthentic positioning signal in the management area. 2. A mobile management device according to claim 1. (Appendix 3) The monitoring unit monitors whether there is an area in the management area that manages the movement of the mobile object to be managed where there is a risk of receiving an inauthentic positioning signal, by also using the reception status of the positioning signal at a fixed receiving device that receives the same positioning signal as the positioning signal received by the mobile object to be managed. 3. A mobile management device according to claim 2. (Appendix 4) a monitoring unit that monitors whether or not there is an area in a management area that manages the movement of the mobile object to be managed, where there is a risk of receiving an inauthentic positioning signal, by using a reception status of the positioning signal at a fixed receiving device that receives the same positioning signal as the positioning signal received by the mobile object to be managed; The output unit outputs area abnormality information when the monitoring unit detects that there is an area in the management area where an inauthentic positioning signal may be received. 2. A mobile management device according to claim 1. (Appendix 5) The system further includes a proposal unit that, when the monitoring unit detects that there is an area in the management area where there is a risk of receiving an inauthentic positioning signal, proposes a change plan to deal with the inauthentic area in the movement plan for moving through the inauthentic area where there is a risk of receiving an inauthentic positioning signal. 5. A mobile object management device according to any one of Supplementary Note 2 to Supplementary Note 4. (Appendix 6) The output destination of the output unit to output the abnormality detection information is a display device, and the abnormality of the managed mobile object is notified by the display device in a display format in which information indicating the location of the managed mobile object in which the abnormality has been detected is superimposed on a map of a management area that manages the movement of the managed mobile object. 2. A mobile management device according to claim 1. (Appendix 7) The system further includes an estimation unit that estimates the location of a mobile object to be managed, in which an abnormality has been detected by the mobile object abnormality detection unit. 2. A mobile management device according to claim 1. (Appendix 8) An acquisition unit for acquiring information representing a surrounding situation of the mobile object to be managed, One or both of the signal authenticity determination criteria and the aircraft authenticity determination criteria include criteria content that uses information acquired by the acquisition unit. 2. A mobile management device according to claim 1. (Appendix 9) By computer, receiving, from a mobile object to be managed that receives the positioning signal with the security measures implemented, positioning signal status information indicating the reception status of the positioning signal and device identification information with the security measures implemented; determining the authenticity of the positioning signal received by the mobile object to be managed using a reception status of the positioning signal at the mobile object to be managed obtained from the received positioning signal status information and a predetermined signal authenticity determination criterion; Using the received machine identification information and a predetermined machine authenticity determination standard, the authenticity of the machine that transmitted the machine identification information is determined; Detecting abnormalities in the mobile object to be managed using the results of determining the authenticity of the positioning signal and the results of determining the authenticity of the device; Outputs abnormality detection information when an abnormality is detected in a managed mobile object. Mobile management method. (Appendix 10) receiving, from a mobile object to be managed that receives the positioning signal with the security measures implemented, positioning signal status information indicating the reception status of the positioning signal and device identification information with the security measures implemented; a process of determining the authenticity of the positioning signal received by the mobile object to be managed, using the reception status of the positioning signal at the mobile object to be managed, obtained from the received positioning signal status information, and a predetermined signal authenticity determination criterion; a process of determining the authenticity of the aircraft that transmitted the aircraft identification information using the received aircraft identification information and a predetermined aircraft authenticity determination criterion; A process of detecting an abnormality in the mobile object to be managed using the result of determining the authenticity of the positioning signal and the result of determining the authenticity of the mobile object; A process for outputting abnormality detection information when an abnormality is detected in a mobile object under management. A computer program that causes a computer to execute the following.

[0100] Note that some or all of the configurations described in Supplementary Notes 2 to 8, which are dependent on Supplementary Note 1, may also be dependent on Supplementary Notes 9 and 10 in the same dependent relationship as Supplementary Notes 2 to 8. Furthermore, not limited to Supplementary Notes 1, 9, and 10, but within the scope of each of the above-mentioned embodiments, some or all of the configurations described as Supplements may also be dependent on various hardware, software, various recording means for recording software, or systems.

[0101] Although the present disclosure has been described above with reference to the embodiments, the present disclosure is not limited to the above-described embodiments. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present disclosure within the scope of the present disclosure. Furthermore, each embodiment can be combined with other embodiments as appropriate. [Explanation of symbols]

[0102] 2. Positioning satellites 3. Managed entities 5,80 Mobile management device 7 Display device 51,81 Receiver 52,82 Signal Authentication Department 53,83 Aircraft Authentication Department 54,84 Mobile object abnormality detection unit 55,85 Output section 56 Estimation part 57 Monitoring Department 58 Proposal Department 59 Acquisition Department

Claims

1. a receiving unit that receives, from a mobile object to be managed that receives the positioning signal with the security measures implemented, positioning signal status information indicating a reception status of the positioning signal and device identification information with the security measures implemented; a signal authentication unit that determines the authenticity of the positioning signal received by the mobile object to be managed, using a reception status of the positioning signal at the mobile object to be managed obtained from the received positioning signal status information and a predetermined signal authenticity determination criterion; an apparatus authentication unit that determines the authenticity of the apparatus that has transmitted the apparatus identification information by using the received apparatus identification information and a predetermined apparatus authenticity determination standard; a mobile object abnormality detection unit that detects abnormalities in the mobile object to be managed using a result of determining the authenticity of the positioning signal and a result of determining the authenticity of the device; an output unit that outputs abnormality detection information when an abnormality is detected in the mobile object to be managed; A mobile management device comprising:

2. a monitoring unit that monitors whether or not there is an inauthentic positioning signal in a management area that manages the movement of the mobile object to be managed, using a result of the determination by the signal authentication unit of the authenticity of the positioning signal for the mobile object to be managed, The output unit outputs area abnormality information when the monitoring unit detects that there is a risk of receiving an inauthentic positioning signal in the management area. The mobile object management device according to claim 1 .

3. The monitoring unit monitors whether there is an area in the management area that manages the movement of the mobile object to be managed where there is a risk of receiving an inauthentic positioning signal, by also using the reception status of the positioning signal at a fixed receiving device that receives the same positioning signal as the positioning signal received by the mobile object to be managed. The mobile object management device according to claim 2 .

4. a monitoring unit that monitors whether or not there is an area in a management area that manages the movement of the mobile object to be managed, where there is a risk of receiving an inauthentic positioning signal, by using a reception status of the positioning signal at a fixed receiving device that receives the same positioning signal as the positioning signal received by the mobile object to be managed; The output unit outputs area abnormality information when the monitoring unit detects that there is an area in the management area where an inauthentic positioning signal may be received. The mobile object management device according to claim 1 .

5. The system further includes a proposal unit that, when the monitoring unit detects that there is an area in the management area where there is a risk of receiving an inauthentic positioning signal, proposes a change plan to deal with the inauthentic area in the movement plan for moving through the inauthentic area where there is a risk of receiving an inauthentic positioning signal.

5. A mobile object management device according to claim 2.

6. The output destination of the output unit to output the abnormality detection information is a display device, and the abnormality of the managed mobile object is notified by the display device in a display format in which information indicating the location of the managed mobile object in which the abnormality has been detected is superimposed on a map of a management area that manages the movement of the managed mobile object. The mobile object management device according to claim 1 .

7. The system further includes an estimation unit that estimates the location of a mobile object to be managed, in which an abnormality has been detected by the mobile object abnormality detection unit. The mobile object management device according to claim 1 .

8. An acquisition unit for acquiring information representing a surrounding situation of the mobile object to be managed, One or both of the signal authenticity determination criteria and the aircraft authenticity determination criteria include criteria content that uses information acquired by the acquisition unit. The mobile object management device according to claim 1 .

9. By computer, receiving, from a mobile object to be managed that receives the positioning signal with the security measures implemented, positioning signal status information indicating the reception status of the positioning signal and device identification information with the security measures implemented; determining the authenticity of the positioning signal received by the mobile object to be managed using a reception status of the positioning signal at the mobile object to be managed obtained from the received positioning signal status information and a predetermined signal authenticity determination criterion; Using the received machine identification information and a predetermined machine authenticity determination standard, the authenticity of the machine that transmitted the machine identification information is determined; Detecting abnormalities in the mobile object to be managed using the results of determining the authenticity of the positioning signal and the results of determining the authenticity of the device; Outputs abnormality detection information when an abnormality is detected in a managed mobile object. Mobile object management method.

10. receiving, from a mobile object to be managed that receives the positioning signal with the security measures implemented, positioning signal status information indicating the reception status of the positioning signal and device identification information with the security measures implemented; a process of determining the authenticity of the positioning signal received by the mobile object to be managed, using the reception status of the positioning signal at the mobile object to be managed, obtained from the received positioning signal status information, and a predetermined signal authenticity determination criterion; a process of determining the authenticity of the aircraft that transmitted the aircraft identification information using the received aircraft identification information and a predetermined aircraft authenticity determination criterion; A process of detecting an abnormality in the mobile object to be managed using the result of determining the authenticity of the positioning signal and the result of determining the authenticity of the mobile object; A process for outputting abnormality detection information when an abnormality is detected in a mobile object under management. A computer program that causes a computer to execute the following.

Images