Information processing device, information processing system, and information processing method

Abstract

We provide information processing devices and other equipment that can mitigate user disadvantages that may occur in vehicles. [Solution] The information processing device 10 is an information processing device mounted on a vehicle and comprises a processor 11 and a memory 12. The processor 11 uses the memory 12 to output first response instruction information to the vehicle, which indicates a first response instruction that causes the vehicle to execute a first response in response to a security event. When it receives second response instruction information that indicates a second response instruction that causes the vehicle to execute a second response in response to a security event, it determines whether the first response instruction and the second response instruction are the same response instruction. If it determines that the first response instruction and the second response instruction are not the same response instruction, it executes a first process based on the content of the first response instruction.

Description

Technical Field

[0001] The present disclosure relates to an information processing apparatus, an information processing system, and an information processing method.

Background Art

[0002] Conventionally, there is a system in which, in order to respond to a security event, wireless communication is used to transmit an instruction (instruction information) that causes a vehicle to execute an operation from a security center to the vehicle. Even in a situation where wireless communication cannot be performed between the vehicle and the security center, it is necessary to respond to the security event of the vehicle.

[0003] Patent Document 1 discloses an information processing apparatus that, when a security event occurs and wireless communication with a security center is unavailable, notifies a vehicle of a predetermined response instruction corresponding to the security event.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of Invention

Problems to be Solved by the Invention

[0005] However, when the response instruction notified to the vehicle is executed by the vehicle, depending on the content of the response instruction, the processing based on the response instruction may not be able to be canceled. In such a case, disadvantage may arise for the user of the vehicle.

[0006] The present disclosure provides an information processing apparatus and the like that can reduce user disadvantage occurring in a vehicle.

Means for Solving the Problems

[0007] An information processing device according to one aspect of the present disclosure is an information processing device mounted on a vehicle, comprising a processor and a memory, wherein the processor, using the memory, outputs first response instruction information to the vehicle indicating a first response instruction that causes the vehicle to execute a first response in response to a security event, and then receives second response instruction information indicating a second response instruction that causes the vehicle to execute a second response in response to the security event, determines whether the first response instruction and the second response instruction are the same response instruction, and if it determines that the first response instruction and the second response instruction are not the same response instruction, executes a first process based on the content of the first response instruction.

[0008] An information processing system according to one aspect of the present disclosure comprises the information processing device described above and a security device that communicates wirelessly with the information processing device, wherein when wireless communication with the security device is not possible and a security event occurs, the information processing device outputs the first response instruction information to the vehicle, and after outputting the first response instruction information to the vehicle, if it receives the second response instruction information from the security device, it determines whether the first response instruction and the second response instruction are the same response instruction, and if it determines that the first response instruction and the second response instruction are not the same response instruction, it executes the first process based on the content of the first response instruction.

[0009] An information processing method according to one aspect of the present disclosure is an information processing method executed by an information processing device mounted on a vehicle, wherein after outputting first response instruction information to the vehicle indicating a first response instruction to cause the vehicle to execute a first response in response to a security event, the device receives second response instruction information indicating a second response instruction to cause the vehicle to execute a second response in response to the security event, it determines whether the first response instruction and the second response instruction are the same response instruction, and if it is determined that the first response instruction and the second response instruction are not the same response instruction, it executes a first process based on the content of the first response instruction. [Effects of the Invention]

[0010] According to one aspect of this disclosure, information processing equipment, etc., can mitigate user disadvantages that may occur in a vehicle. [Brief explanation of the drawing]

[0011] [Figure 1] Figure 1 is a block diagram showing the configuration of a security system according to an embodiment. [Figure 2] Figure 2 is a block diagram showing the configuration of a vehicle according to an embodiment. [Figure 3] Figure 3 is a diagram showing table information according to the embodiment. [Figure 4] Figure 4 is a sequence diagram showing the processing procedures of the security monitoring device and security center according to the embodiment. [Figure 5] Figure 5 is a flowchart showing the processing procedure of the security monitoring device according to the embodiment. [Figure 6] Figure 6 is a block diagram showing the configuration of an information processing device according to an embodiment. [Figure 7] Figure 7 is a flowchart showing the information processing method according to the embodiment. [Modes for carrying out the invention]

[0012] (Knowledge that forms the basis of this disclosure) Conventionally, there are systems in place where, if a security event (an event that could compromise the vehicle's security) is detected in a vehicle, information indicating the content of that security event is sent to a security center (specifically, a computer or other device located at the security center). In such a system, the security center, based on the received information, for example, if it determines that the vehicle is in danger, sends information to the vehicle instructing it to perform a specific action. When the vehicle receives such information, it performs the specific action based on the information it received.

[0013] In Patent Document 1, when a security event occurs and wireless communication between the vehicle and the security center is not possible, information indicating a predetermined response instruction in response to the security event is output from an information processing device installed in the vehicle to, for example, an ECU (Electronic Control Unit) that controls the vehicle's operation. Furthermore, in Patent Document 1, for example, if information indicating a response instruction is received from the security center after wireless communication between the vehicle and the security center is restored, the information processing device cancels the response instruction indicated by the information output to the ECU if the response instruction indicated by the information received from the security center is different. In other words, the execution of processing based on the response instruction is stopped so that the ECU does not execute the response instruction indicated by the information output to the ECU.

[0014] However, depending on the content of the response instructions, it may not be possible to stop the execution of processing based on those instructions in the ECU, etc. In such cases, if new processing is not carried out in accordance with the content of the response instructions, the vehicle user, such as the vehicle driver, may suffer disadvantages. In addition, while communication between the vehicle and the security center is interrupted, the vehicle's state may change due to the execution of processing based on predetermined response instructions in the vehicle. In such cases, it is unclear whether it is appropriate for the processing based on predetermined response instructions in the vehicle to be canceled (i.e., stopped), because the vehicle does not make a determination as to whether additional action is required. Therefore, simply canceling the processing based on predetermined response instructions in the vehicle may be an insufficient response.

[0015] Therefore, the inventors of this application have found an information processing device that can mitigate the disadvantages to the user that occur in vehicles in such cases.

[0016] Specifically, in the present application, after a process based on a predetermined corresponding instruction is executed in a vehicle, if canceling the process afterwards would cause the user to suffer a disadvantage for example, the corresponding instruction is altered. For example, the content of the corresponding instruction is altered according to the level of disadvantage the user suffers. Further, for example, if some state of the vehicle is changed by the process, the content of the corresponding instruction is altered in consideration of the changed state of the vehicle.

[0017] Thereby, processing conforming to the state of the vehicle can be executed by the vehicle more appropriately than in the conventional art. In addition, disadvantages caused by erroneous corresponding instructions in the vehicle can be mitigated.

[0018] Hereinafter, embodiments of the present disclosure will be specifically described with reference to the drawings.

[0019] It should be noted that all of the embodiments described below show specific examples of the present disclosure. The numerical values, shapes, materials, constituent elements, arrangement positions and connection forms of the constituent elements, steps, order of steps, and the like shown in the following embodiments are merely examples, and are not intended to limit the present disclosure. In addition, among the constituent elements in the following embodiments, constituent elements not described in the independent claims will be described as optional constituent elements.

[0020] Further, in the present specification, ordinal numbers such as "first" and "second" do not indicate the number or order of constituent elements unless otherwise specified, and are used for the purpose of avoiding confusion between and distinguishing constituent elements of the same type.

[0021] Further, in the present specification, for example, when descriptions are made in contrast to "equal to or greater than a threshold" and "less than a threshold", it means that the distinction is made with the threshold as a boundary, and each may mean "greater than the threshold" and "equal to or less than the threshold" respectively.

[0022] (Embodiment) [Configuration] Figure 1 is a schematic diagram of a security system 500 that provides information to a vehicle according to an embodiment.

[0023] The security system 500 is an in-vehicle communication network system comprising vehicles 200 and a security center 300 that are connected to each other via a network 400, which is a wireless network such as the Internet (e.g., a mobile communication network), enabling them to communicate with each other (more specifically, to communicate wirelessly). In the security system 500, for example, the vehicles 200 and the security center 300, such as a Security Operation Center (SOC) (more specifically, a computer located in the SOC, etc.), communicate to monitor whether there are any abnormalities in each device such as ECUs connected to the in-vehicle communication network in the vehicles 200, as well as in the bus that connects them in a way that enables communication.

[0024] Security system 500 is an example of an information processing system.

[0025] The security system 500 comprises 200 vehicles and 300 security centers.

[0026] Vehicle 200 is any vehicle, such as a motorcycle or a four-wheeled vehicle. Vehicle 200 may be an autonomous vehicle equipped with an autonomous driving function, or it may be a vehicle without such a function.

[0027] Vehicle 200, for example, includes a TCU (Telematics Control Unit) and multiple ECUs as part of its hardware configuration.

[0028] In addition, vehicle 200 is equipped with a security monitoring device 100.

[0029] The security monitoring device 100 is a device for monitoring the status of the vehicle 200. Specifically, the security monitoring device 100 detects security events of the vehicle 200 (events that cause security problems for the vehicle 200) and executes processing in response to the security events.

[0030] The security monitoring device 100 acquires information about attacks on vehicle 200 (specifically, cyberattacks) detected by vehicle 200, and monitors the status of vehicle 200 based on the acquired information. The security monitoring device 100 is, for example, a NIDS (Network-based Intrusion Detection System) and is communicated via a bus to each of the multiple ECUs in vehicle 200, and monitors the data flowing through the connected bus. Specifically, the security monitoring device 100 detects abnormalities (in other words, attacks) in vehicle 200 (more specifically, the ECUs in vehicle 200) as security events by monitoring the data flowing through the bus connected to the ECUs in vehicle 200.

[0031] Security events may be defined arbitrarily. Examples of security events include the absence of a response from the ECU of the vehicle 200 to an inquiry from the security monitoring device 100, the transmission of an unauthorized command to the bus, or the amount of commands being greater than or less than a predetermined amount. The predetermined amount may be defined arbitrarily.

[0032] The security monitoring device 100 (i.e., the vehicle 200) is connected to the security center 300 in a way that allows it to communicate with it. When the security monitoring device 100 detects a security event, it transmits information about that security event (also called security event information) to the security center 300. The security monitoring device 100 is a server used in monitoring centers such as SOCs to implement SIEM (Security Information and Event Management).

[0033] If the security monitoring device 100 detects an unauthorized command (for example, a command that should not normally be transmitted in the in-vehicle communication network) in the vehicle 200, it identifies the ECU among the multiple ECUs in the vehicle 200 that is capable of sending the unauthorized command. The security monitoring device 100 then transmits security event information to the security center 300, which includes information indicating the unauthorized command and an identifier (identification information) indicating the ECU.

[0034] Information regarding the commands that each ECU can transmit may be pre-stored in the memory of the security monitoring device 100, for example.

[0035] The security center 300 is a computer that performs processing based on security event information. For example, the security center 300 determines whether vehicle 200 is at risk based on security event information, and if it determines that vehicle 200 is at risk, it sends information to vehicle 200 (more specifically, the security monitoring device 100) indicating instructions for vehicle 200 to perform a specific action.

[0036] When vehicle 200 receives such information, it performs a specific process based on the received information. Specifically, when the security monitoring device 100 receives the second instruction information, it causes the ECU or other components in vehicle 200 to perform a process corresponding to the instruction indicated by the second instruction information.

[0037] The security center 300 is implemented, for example, by a communication interface for communicating (more specifically, wirelessly) with the vehicle 200 (more specifically, the security monitoring device 100), non-volatile memory where the program is stored, volatile memory which is a temporary storage area for executing the program, input / output ports for sending and receiving signals, and a processor for executing the program.

[0038] The security monitoring device 100 is implemented, for example, by including a TCU with a cellular module compliant with the standards of a mobile communication network for communicating with the security center 300, a communication interface for communicating with the ECU of the vehicle 200, a non-volatile memory where the program is stored, a volatile memory which is a temporary storage area for executing the program, input / output ports for sending and receiving signals, and a processor for executing the program.

[0039] The communication interface of the security monitoring device 100 may be a wired LAN (Local Area Network) interface or a wireless LAN interface. Furthermore, the communication interface of the security monitoring device 100 is not limited to a LAN interface; any communication interface capable of establishing a communication connection with a communication network may be used.

[0040] Furthermore, the security monitoring device 100 may be realized by having the TCU and ECU of the vehicle 200 perform the functions of the security monitoring device 100 in addition to their original functions.

[0041] A security monitoring device is an example of an information processing device.

[0042] Figure 2 is a block diagram showing the configuration of the vehicle 200 according to the embodiment.

[0043] The vehicle 200 is equipped with a security monitoring device 100, multiple ECUs 210, a wireless communication ECU 220, and an antenna 230.

[0044] The number of ECUs 210, wireless communication ECUs 220, and antennas 230 provided in the vehicle 200 can be any number and are not particularly limited.

[0045] The security monitoring device 100 comprises a SOC 110, a memory 120, and a switch 130.

[0046] SOC110 is a processing unit that performs various operations. SOC110 is a System On Chip (SOC) that includes a processor such as a CPU (Central Processing Unit). SOC110 is communicatively connected to multiple ECUs 210 provided in the vehicle 200. Some of the multiple ECUs 210 are connected via, for example, a switch 130.

[0047] The ECU210 controls, for example, the engine, motor, meters, transmission, brakes, steering, power windows, air conditioning, car navigation, display devices, and audio equipment of the vehicle 200.

[0048] Examples of ECUs 210 that are connected to the security monitoring device 100 without going through switch 130 include an ECU that controls the drive of the vehicle 200, an ECU that controls the braking of the vehicle 200, an ECU that controls the steering of the vehicle 200, an ECU that controls the air conditioning of the vehicle 200, and an ECU that controls the safety equipment of the vehicle 200.

[0049] Furthermore, examples of ECUs 210 connected to SOC 110 via switch 130 include a multimedia ECU that controls multiple media such as text, voice, still images, and moving images, and an ITS (Intelligent Transport Systems) ECU that controls traffic safety, congestion countermeasures, and environmental measures by transmitting and receiving information between people, roads, and vehicles 200.

[0050] The wireless communication ECU 220 is an ECU for wireless communication with the outside of the vehicle 200 (for example, a security center 300) via the antenna 230. The security monitoring device 100 communicates with the security center 300, for example, via the wireless communication ECU 220 and the antenna 230.

[0051] Memory 120 is a memory that stores various types of information. For example, memory 120 stores the control program executed by SOC 110, and the table information described later.

[0052] Switch 130 is a switch (for example, an Ethernet switch) used to switch the connection with SOC110 between ECU210 and wireless communication ECU220.

[0053] The security monitoring device 100 may also be equipped with a storage device such as an HDD (Hard Disk Drive) or SSD (Solid State Drive) for storing information.

[0054] The security monitoring device 100 detects security events by, for example, obtaining information about security events from multiple ECUs 210 equipped in the vehicle 200 (for example, information indicating commands sent and received by the ECUs 210, and identifiers of the ECUs 210).

[0055] Furthermore, the security monitoring device 100 determines, for example, whether it is necessary to transmit security event information regarding the detected security event to the security center 300 based on the acquired information. The security monitoring device 100 also determines, for example, whether it is possible to communicate with the security center 300. If the security monitoring device 100 determines, for example, that it is necessary to transmit security event information to the security center 300, and determines that it is possible to communicate with the security center 300, it transmits the security event information to the security center 300.

[0056] The security monitoring device 100 determines, for example, that it is necessary to send security event information to the security center 300 if an abnormality is detected in the ECU 210. On the other hand, the security monitoring device 100 determines, for example, that it is not necessary to send security event information to the security center 300 if no abnormality is detected in the ECU 210.

[0057] Here, if the security monitoring device 100 determines, for example, that it is necessary to send security event information to the security center 300, and determines that communication with the security center 300 is not possible, it outputs instruction information (also called first response instruction information) indicating an instruction (also called first response instruction) to one of the multiple ECUs 210 equipped in the vehicle 200 to perform a predetermined response (also called first response).

[0058] This causes one of the multiple ECUs 210 to perform the first response. In other words, if the security monitoring device 100 cannot communicate with the security center 300, for example, if it cannot send security event information to the security center 300, or if it cannot receive second response instruction information from the security center 300, it outputs first response instruction information to the vehicle 200, which indicates a first response instruction to cause the vehicle 200 to perform the first response in response to the security event.

[0059] Information showing the relationship between the type of security event (for example, the type of anomaly detected) and the content of the first response is pre-stored in memory 120, for example.

[0060] Furthermore, the security monitoring device 100 measures, for example, the period during which communication with the security center 300 is not possible. The security monitoring device 100 may also be equipped with a timing unit such as an RTC (Real Time Clock) for measuring time. For example, if the security monitoring device 100 has transmitted security information to the security center and has not received instruction information (also called second response instruction information) from the security center 300 indicating an instruction (also called second response instruction) to execute a predetermined response (also called second response) to any of the multiple ECUs 210 equipped in the vehicle 200 for a predetermined period of time, it outputs first response instruction information to any of the multiple ECUs 210.

[0061] The prescribed period may be determined arbitrarily and is not particularly limited.

[0062] The security monitoring device 100 may or may not encrypt data such as security event information that it transmits to the security center 300.

[0063] For example, if the security monitoring device 100 outputs first response instruction information to the vehicle 200 and then receives second response instruction information indicating a second response instruction that causes the vehicle 200 to perform a second response in response to a security event, it will determine whether the first response instruction and the second response instruction are the same response instruction. In other words, for example, if the security monitoring device 100 outputs first response instruction information to the vehicle 200, and then communication with the security center 300 is restored and second response instruction information is received from the security center 300, it will determine whether the first response instruction and the second response instruction are the same response instruction.

[0064] If the security monitoring device 100 determines that the first response instruction and the second response instruction are the same instruction, it will not take action, for example, towards the vehicle 200. In this case, for example, the security monitoring device 100 will send information to the security center 300 indicating that the second response instruction has already been executed.

[0065] On the other hand, if the security monitoring device 100 determines that the first response instruction and the second response instruction are not the same response instruction, it executes the first process based on the content of the first response instruction. Specifically, for example, if the security monitoring device 100 determines that the first response instruction and the second response instruction are not the same response instruction, it causes the vehicle 200 to execute the second response, and further, if predetermined conditions are met, it executes the first process based on the content of the first response instruction.

[0066] For example, the first process includes at least one of the following processes: a process for controlling the vehicle 200, a process for controlling a predetermined application stored in the vehicle 200, and a process for notifying the user of information regarding the first response. If the first response instruction is an instruction to stop the vehicle 200 from driving, the security monitoring device 100 may, for example, execute a process to restart the vehicle 200 from driving, restart the stopped application for automatic driving, or display information on a display device provided in the vehicle 200 indicating that it is safe to restart the vehicle 200 from driving.

[0067] The specified application may be arbitrarily defined and is not particularly limited.

[0068] Furthermore, notification of information to the user may be achieved by displaying the information on a display device, or by outputting the information as sound from an audio device such as a speaker, or by any other method. In addition, notification of information to the user may be made from equipment installed in the vehicle 200, or via a device such as a smartphone carried by the user.

[0069] Furthermore, if the security monitoring device 100 determines, for example, that the first response instruction and the second response instruction are not the same response instruction, it determines whether it is necessary to have the vehicle 200 execute a process other than the process of canceling the execution of the first response. For example, the security monitoring device 100 determines whether the process based on the first response instruction has already been executed by the vehicle 200. If the security monitoring device 100 determines, for example, that the process based on the first response instruction has not yet been executed by the vehicle 200, it prevents the vehicle 200 from executing the first response and has the vehicle 200 execute the second response. For example, the security monitoring device 100 prevents the vehicle 200 from executing the first response and has the vehicle 200 execute the second response by transmitting information indicating an instruction to cancel the execution of the first response and information on the second response to the vehicle 200. When the second response instruction information is transmitted to the vehicle 200, the vehicle 200 may not execute the first response and may execute the second response.

[0070] On the other hand, if the security monitoring device 100 determines, for example, that the first response instruction and the second response instruction are not the same response instruction, it determines whether it is necessary to have the vehicle 200 execute a process other than the process of stopping the execution of the first response. If the security monitoring device 100 determines, for example, that the process based on the first response instruction has already been executed by the vehicle 200, it determines whether it is necessary to have the vehicle 200 execute a process other than the process of stopping the execution of the first response (also called a cancellation process). In other words, if the security monitoring device 100 determines, for example, whether it is necessary to have the vehicle 200 execute a process other than the process of stopping the execution of the first response, it determines whether the process based on the first response instruction has already been executed by the vehicle 200, and if it determines that the process based on the first response instruction has already been executed by the vehicle 200, it determines whether it is necessary to have the vehicle 200 execute a process other than the process of stopping the execution of the first response. If the security monitoring device 100 determines, for example, that it is necessary to have the vehicle 200 perform a process other than a cancellation process that would stop the execution of the first response, it determines that predetermined conditions are met and executes the first process based on the content of the first response instruction.

[0071] Furthermore, when the security monitoring device 100 determines whether it is necessary to have the vehicle 200 perform a process other than the process of stopping the execution of the first response, it may determine whether it is necessary to have the vehicle 200 perform a process other than the process of stopping the execution of the first response based on the state of the vehicle 200.

[0072] The state of vehicle 200 may include, for example, the driving state of vehicle 200, the version of software (application) used by vehicle 200, and / or the state of data stored by vehicle 200. The security monitoring device 100 may, for example, determine that if the state of vehicle 200 changes as a result of vehicle 200 executing a first response, it is necessary to have vehicle 200 execute a process other than the process of stopping the execution of the first response, and if the state of vehicle 200 does not change, it may determine that it is not necessary to have vehicle 200 execute a process other than the process of stopping the execution of the first response. If the first response is, for example, the presentation of information to the user using a display device connected to vehicle 200, the security monitoring device 100 may, for example, determine that the state of vehicle 200 has not changed and determine that it is not necessary to have vehicle 200 execute a process other than the process of stopping the execution of the first response. Information indicating the state of vehicle 200 is obtained, for example, from at least one of the multiple ECUs 210 provided in vehicle 200.

[0073] Furthermore, the security monitoring device 100 may determine that if the content of the first response instruction is included in the table information described later, it is necessary to have the vehicle 200 perform a process other than the process of canceling the execution of the first response, and if the content of the first response instruction is not included in the table information, it may determine that it is not necessary to have the vehicle 200 perform a process other than the process of canceling the execution of the first response.

[0074] Furthermore, if the security monitoring device 100 determines, for example, that the first response instruction and the second response instruction are not the same response instruction, it may determine the level of disadvantage the user will suffer when the first response is performed by the vehicle 200. The security monitoring device 100 determines, for example, whether the level of disadvantage is above a predetermined level. In this case, if the security monitoring device 100 determines, for example, that the level of disadvantage is above a predetermined level, it executes the first process based on the content of the first response instruction.

[0075] Furthermore, the level of disadvantage indicates, for example, that a higher level means that the user of vehicle 200 will suffer more (greater) disadvantages.

[0076] For example, if the security monitoring device 100 determines that the level of disadvantage is above a predetermined level, it determines that the predetermined conditions are met and executes the first process based on the content of the first response instruction. On the other hand, if the security monitoring device 100 determines that the level of disadvantage is not above a predetermined level, it determines that the predetermined conditions are not met and does not execute the first process, instead causing the vehicle 200 to execute a cancellation process.

[0077] The predetermined level can be arbitrarily set in advance and is not particularly limited. Information indicating the predetermined level is stored in memory 12 beforehand, for example.

[0078] Furthermore, the level of disadvantage suffered by the user when the first response is performed by the vehicle 200 can be arbitrarily determined in advance and is not particularly limited. In this embodiment, information indicating the level of disadvantage suffered by the user when the first response is performed by the vehicle 200 is included in the table information.

[0079] Figure 3 is a diagram showing table information according to the embodiment.

[0080] The table information indicates the content of the first process (action) to be executed in response to the content of the first response instruction when the security monitoring device 100 determines that the first response instruction and the second response instruction are not the same instruction.

[0081] The table information includes, for example, information indicating the content of the first response instruction, information indicating the response status, information indicating the nature of the disadvantage, information indicating the level of the disadvantage, and information indicating the action taken.

[0082] The information indicating the content of the first response instruction is information indicating the content corresponding to the first response instruction.

[0083] The information indicating the response status is information indicating whether or not vehicle 200 performed the first response based on the first response instruction information.

[0084] The information indicating the nature of the disadvantage is information indicating the nature of the disadvantage the user will suffer when the first response is performed by vehicle 200.

[0085] The information indicating the level of disadvantage is the level of disadvantage the user will suffer when the first response is performed by vehicle 200.

[0086] The information indicating the action taken corresponds to the information regarding the first action.

[0087] For example, if the content of the first response instruction is "delete user data" and the vehicle 200 has "completed" the first response, the security monitoring device 100 will notify the user of information regarding the content of the first response instruction, such as "Please re-transfer the data for XX. The transfer procedure is as follows..." using a notification device (presentation device) such as a display device.

[0088] Furthermore, for example, if the content of the first response instruction is "delete user data" and the vehicle 200 has not responded to the first response, the security monitoring device 100 will cause the vehicle 200 to perform a cancellation process and will not perform the first process.

[0089] Furthermore, the predetermined level mentioned above is defined as, for example, "medium." The security monitoring device 100 executes the process indicated in "Action taken" if, for example, the level of disadvantage corresponding to the content of the first response instruction is "medium" or "high," that is, if the level of disadvantage is above the predetermined level. If the level of disadvantage corresponding to the content of the first response instruction is "low," that is, if the level of disadvantage is above the predetermined level, the device does not execute the first process.

[0090] Furthermore, the information regarding the first response described above that is notified to the user is, for example, the information shown in "User Notification" under "Response Details" in the table information.

[0091] Furthermore, if, during the execution of the first process, the security monitoring device 100 executes a process to notify the user of information indicating the content of the process other than the process that notifies the user of information regarding the first response, the security monitoring device 100 may execute a process that notifies the user of information indicating the content of the process other than the process that notifies the user of information regarding the first response.

[0092] For example, if the security monitoring device 100 causes vehicle 200 to perform "vehicle data erasure" as a first response, it will perform a process to stop the engine of vehicle 200 after a predetermined period of time as a first process, and will also notify the user of information indicating that the process to stop the engine of vehicle 200 after a predetermined period of time will be performed.

[0093] The prescribed period may be determined at any discretion and is not particularly limited.

[0094] Furthermore, for example, the security monitoring device 100 outputs processing information related to the first process after executing the first process.

[0095] Processing information is, for example, the content of the first action instruction, and is included in the table information. For example, if the content of the first action instruction is "Delete user data", the processing information will include information indicating at least one of the following: "Content of first instruction: Delete user data", "Status of action: Action taken", "Content of disadvantage: Loss of user data", "Level of disadvantage: Medium", and "Action taken: User notification: 'Please re-transfer the data for XX. The transfer procedure is as follows...'"

[0096] Furthermore, the security monitoring device 100, for example, determines whether the first process was valid based on the processing information, and outputs validity information indicating the result of the determination of whether the first process was valid or not.

[0097] The security monitoring device 100 displays, for example, validity information and processing information on a display device used by the user of the vehicle 200 (for example, a display on the vehicle 200 and / or a smartphone carried by the user).

[0098] The security monitoring device 100 determines whether the first process was appropriate based on information indicating appropriateness (not shown), which is linked to items such as "Content of the first response instruction" and "Response content" in the table information used to determine whether the first process was appropriate. The information indicating appropriateness is stored in memory 120 in advance, for example.

[0099] The security monitoring device 100 may, for example, use an LLM (Large Language Model) to determine whether the first process was valid. The LLM is, for example, pre-stored in memory 12. Alternatively, the security monitoring device 100 may be equipped with a memory device for storing the LLM. The LLM is, for example, a trained machine learning model that takes processing information as input and outputs information indicating whether the first process was valid or not. The security monitoring device determines whether the first process was valid or not based on the information indicating whether the first process was valid or not, obtained by inputting processing information into the LLM. The LLM learns using, for example, information from table information such as "Content of the first response instruction" and "Response content," and information indicating whether the first process (i.e., the response content) was valid or not. The learning method of the LLM is arbitrary and not particularly limited.

[0100] The Security Center 300 may also perform the determination of whether the first process was appropriate or not.

[0101] For example, after the security monitoring device 100 executes the first process, it further transmits processing information related to the first process to the security center 300. The security center 300, for example, determines whether the first process was valid based on the processing information and outputs validity information indicating the result of the determination of whether the first process was valid or not.

[0102] The security center 300 displays, for example, validation information and processing information on a display device used by an operator utilizing the security center 300.

[0103] The security center 300, similar to the security monitoring device 100, determines whether the first process was appropriate based on information indicating appropriateness, which is linked to items such as "Content of the first response instruction" and "Action taken" in the table information used to determine whether the first process was appropriate. Alternatively, the security center 300 may also determine whether the first process was appropriate using, for example, an LLM, similar to the security monitoring device 100. The information indicating appropriateness and / or the LLM may be pre-stored in a storage device provided by the security center 300.

[0104] Furthermore, the first process may include outputting instruction information indicating an instruction for the vehicle 200 or the user to execute the second process. For example, after executing the first process, the security monitoring device 100 may further determine whether or not the second process has been executed. If the security monitoring device 100 determines, for example, that the second process has not been executed, it outputs the instruction information again, and if it determines that the second process has been executed, it terminates the process.

[0105] The security monitoring device 100 displays instruction information on a display device provided by the vehicle 200, for example, instructing the user to restart operation as a second process. If the security monitoring device 100 determines, for example, that the operation of the vehicle 200 has not been restarted within a predetermined period, it displays the instruction information again on the display device. In this way, the instruction information is repeatedly output until, for example, the second process is executed.

[0106] The number of times the instruction information is output can be determined arbitrarily and is not particularly limited.

[0107] Furthermore, the content of the second process may be determined arbitrarily and is not particularly limited.

[0108] [Processing Procedure] Next, we will explain the processing procedures in security system 500.

[0109] <Security System> Figure 4 is a sequence diagram showing the processing procedures of the security monitoring device 100 and security center 300 according to the embodiment.

[0110] First, the security monitoring device 100 performs detection processing for security events in the vehicle 200. At this point, the security monitoring device 100 detects a security event (S110).

[0111] Next, the security monitoring device 100 determines whether or not it is possible to communicate with the security center 300 (S120).

[0112] If the security monitoring device 100 determines that it can communicate with the security center 300 (Yes in S120), it sends security event information indicating the detected security event to the security center 300.

[0113] Here, if the security monitoring device 100 determines that it is not possible to communicate with the security center 300 (No in S120), or if communication with the security center 300 is blocked, and the security center 300 has sent second response instruction information (S140), but the second response instruction information cannot be received, the security monitoring device 100 determines whether it is necessary to output information to the vehicle 200 indicating an instruction to execute processing (response instruction) for the security event (S150). For example, the security monitoring device 100 determines whether it is necessary to output information indicating a response instruction to the vehicle 200 based on information showing the relationship between the type of security event and the content of the first response.

[0114] If the security monitoring device 100 determines that it is not necessary to output information indicating a response instruction to the vehicle 200 (No in S150), it terminates the process.

[0115] On the other hand, if the security monitoring device 100 determines that it is necessary to output information indicating a response instruction to the vehicle 200 (Yes in S150), it determines the content of the response instruction (i.e., the content of the first response instruction) (S160). The security monitoring device 100 determines the content of the first response instruction, for example, based on information indicating the relationship between the type of security event and the content of the first response.

[0116] Next, the security monitoring device 100 outputs first response instruction information indicating a first response instruction to the vehicle 200 (S170).

[0117] Here, let's assume, for example, that communication between the security monitoring device 100 and the security center 300 is restored, and the security center 300 sends the second response instruction information to the security monitoring device 100 again (S180), and the security monitoring device 100 receives the second response instruction information. Note that if step S120 is No, the second response instruction information is not sent in step S180.

[0118] In this case, the security monitoring device 100 transmits security event information and first response instruction information to the security center 300 (S190).

[0119] The security monitoring device 100 determines whether the response instruction (i.e., the first response instruction) was valid (S200). The security monitoring device 100 determines whether the response instruction was valid by, for example, determining whether the first response instruction and the second response instruction are the same response instruction. In Figure 4, the security center 300 determines the validity of the response instruction in step S200, but the security monitoring device 100 may also determine the validity of the response instruction after receiving instruction information from the security center 300.

[0120] If the security monitoring device 100 determines, for example, that the first response instruction and the second response instruction are the same response instruction, it determines that the response instruction is valid (Yes in S200) and terminates the process.

[0121] On the other hand, if the security monitoring device 100 determines, for example, that the first response instruction and the second response instruction are not the same instruction, it determines that the response instruction is not valid (No in S200) and resends the second response instruction information to the security monitoring device 100 (S210).

[0122] When the security monitoring device 100 receives the second response instruction information again, it executes the response process (S220).

[0123] Next, the security monitoring device 100 sends processing completion notification information to the security center 300 indicating that the corresponding processing has been completed (S230). The processing completion notification information is, for example, information that includes the processing information described above.

[0124] <Security monitoring device> Figure 5 is a flowchart showing the processing procedure of the security monitoring device 100 according to the embodiment. Specifically, Figure 5 is a flowchart showing the details of step S220.

[0125] First, the security monitoring device 100 receives the second response instruction information (S310). Step S310 is a process that is performed, for example, by the execution of step S210.

[0126] Next, the security monitoring device 100 determines whether the first response instruction and the second response instruction are the same response instruction (S320).

[0127] The security monitoring device 100 terminates processing if it determines that the first response instruction and the second response instruction are the same response instruction (Yes in S320).

[0128] On the other hand, if the security monitoring device 100 determines that the first response instruction and the second response instruction are not the same response instruction (No in S320), it determines whether or not a change in the response instruction is necessary (S330). Specifically, the security monitoring device 100 determines whether or not it is necessary to have the vehicle 200 perform a process other than cancellation. In other words, the security monitoring device 100 determines whether or not it is sufficient to have the vehicle 200 perform only an instruction to cancel the process based on the first response instruction information. For example, the security monitoring device 100 determines whether or not the content of the first response instruction is included in the "Content of the first response instruction" item in the table information. For example, if the content of the first response instruction is included in the "Content of the first response instruction" item in the table information, the security monitoring device 100 determines that it is necessary to have the vehicle 200 perform a process other than cancellation, that is, that a change in the response instruction is necessary. On the other hand, for example, if the content of the first response instruction is not included in the "Content of the first response instruction" item in the table information, the security monitoring device 100 determines that there is no need to have the vehicle 200 perform any processing other than cancellation processing, that is, there is no need to change the response instruction.

[0129] If the security monitoring device 100 determines that no change in the response instruction is necessary (No in S330), it instructs the vehicle 200 to perform a cancellation process (S340).

[0130] On the other hand, if the security monitoring device 100 determines that a change in the response instruction is necessary (Yes in S330), it determines the level of disadvantage (S350). The security monitoring device 100 determines the level of disadvantage based, for example, on the first response instruction information and the table information.

[0131] Next, the security monitoring device 100 determines whether or not it is necessary to perform a corrective action (i.e., the first action) (S360). For example, the security monitoring device 100 determines whether or not the level of disadvantage is above a predetermined level. If it determines that the level of disadvantage is above a predetermined level, it determines that it is necessary to perform a corrective action. If it determines that the level of disadvantage is below a predetermined level, it determines that it is not necessary to perform a corrective action.

[0132] If the security monitoring device 100 determines that it is not necessary to perform any corrective action (No in S360), it proceeds to step S340.

[0133] On the other hand, if the security monitoring device 100 determines that it is necessary to perform corrective action (Yes in S360), it determines the content of the corrective action (corrective action content) (S370). In other words, the security monitoring device 100 creates information indicating the content of the action to be performed by the vehicle 200. The security monitoring device 100 determines the corrective action content based, for example, on the first response instruction information, the level of disadvantage, and the table information.

[0134] The security monitoring device 100 executes the action taken according to the determined action (S380). In other words, the security monitoring device 100 executes the first action. For example, the security monitoring device 100 outputs information to a display device in order to display the information on the display device, or outputs predetermined information to one or more ECUs in the vehicle 200 in order to have those ECUs execute a specific action.

[0135] The security monitoring device 100 may, at any timing after step S320, cause the vehicle 200 to perform a second response based on the second response instruction information. This timing may be immediately after step S320, or after step S340 and / or step S380, and is not particularly limited.

[0136] Furthermore, each of the processes in steps S320, S330, S350, and S370 may be executed based on table information, or they may be executed using LLM.

[0137] Furthermore, step S370 may be performed on a computer other than the security monitoring device 100, such as the security center 300.

[0138] <Summary> Figure 6 is a block diagram showing the configuration of the information processing device 10 according to the embodiment. Figure 7 is a flowchart showing the information processing method according to the embodiment.

[0139] The information processing device 10 is, for example, the security monitoring device 100 described above. The information processing device 10 comprises a processor 11 and a memory 12 connected to the processor 11. The processor 11 uses the memory 12 to execute the information processing method shown in Figure 7, for example, by executing a control program stored in the memory 12. SOC 110 is a specific example of the processor 11. Memory 120 is a specific example of the memory 12.

[0140] First, the information processing device 10 outputs first response instruction information to the vehicle 200, which indicates a first response instruction that causes the vehicle 200 to execute a first response in response to a security event (S10). For example, when the information processing device 10 detects a security event, it determines whether or not it is possible to communicate with a security device. The security device is, for example, the security center 300 described above. For example, if the information processing device 10 determines, by performing the determination in step S120, that it is not possible to communicate with the security device, it outputs first response instruction information to the vehicle 200 (specifically, one or more ECUs among the multiple ECUs provided in the vehicle 200 that correspond to the security event), as shown in step S170. Information showing the relationship between the type of security event and the content of the first response is, for example, stored in memory 12 beforehand. Also, for example, if the information processing device 10 determines, for example, that it is possible to communicate with the security device, it transmits security event information related to the security event to the security device. Here, for example, if the information processing device 10 does not receive the second response instruction information (described later) within a predetermined period (a predetermined first period) after transmitting security event information to the security device, it outputs the first response instruction information to the vehicle 200.

[0141] The prescribed first period may be arbitrarily determined in advance and is not particularly limited.

[0142] Next, the information processing device 10 determines whether or not it has received second response instruction information indicating a second response instruction that causes the vehicle 200 to perform a second response in response to a security event (S20).

[0143] The information processing device 10 may determine whether or not it has received the second response instruction information from the security device within a predetermined period (a predetermined second period) after transmitting the first response instruction information to the vehicle 200.

[0144] The prescribed second period may be arbitrarily determined in advance and is not particularly limited. The prescribed second period does not need to be determined.

[0145] When the information processing device 10 receives second response instruction information indicating a second response instruction that causes the vehicle 200 to execute a second response in response to a security event (Yes in S20), it determines whether the first response instruction and the second response instruction are the same response instruction (S30). In other words, after step S310 shown in Figure 5, the information processing device 10 performs the determination in step S320 to determine whether the first response instruction and the second response instruction are the same response instruction.

[0146] If the information processing device 10 determines that the first correspondence instruction and the second correspondence instruction are not the same correspondence instruction (No in S30), it executes the first process based on the content of the first correspondence instruction (S40).

[0147] Specifically, if the information processing device 10 determines that the first response instruction and the second response instruction are not the same response instruction, and if predetermined conditions are met, it executes the first process based on the content of the first response instruction. For example, if the information processing device 10 determines No in step S320 shown in Figure 5, and further determines Yes in steps S330 and S360 shown in Figure 5, it determines the action to be taken as the first process, as shown in step S370 in Figure 5, and executes the action to be taken according to the action to be taken, as shown in step S380 in Figure 5.

[0148] If the information processing device 10 determines, for example, that it is necessary to have the vehicle 200 perform a process other than a cancellation process that would stop the execution of the first response (for example, Yes in step S330), it determines that predetermined conditions are met and executes the first process (for example, steps S370 and S380) based on the content of the first response instruction. Also, if the information processing device 10 determines, for example, that the level of disadvantage is above a predetermined level (for example, Yes in step S360), it determines that predetermined conditions are met and executes the first process based on the content of the first response instruction.

[0149] On the other hand, for example, if the information processing device 10 does not receive second response instruction information indicating a second response instruction that causes the vehicle 200 to perform a second response in response to a security event (No in S20), or if it determines that the first response instruction and the second response instruction are the same response instruction (Yes in S30), it terminates processing without performing the first process. For example, if step S310 shown in Figure 5 is not performed, or if step 320 shown in Figure 5 is No, the information processing device 10 terminates processing without performing steps S370 and S380.

[0150] As described above, when the information processing device 10 determines, for example, that the second response instruction information received from the security center 300 differs from the first response instruction information output to the vehicle 200, and therefore it becomes necessary to have the vehicle 200 cancel the execution of the process corresponding to the first response instruction information, the information processing device 10 performs the optimal processing according to the content of the first response instruction information. For example, in order to have the vehicle 200 cancel the execution of the process corresponding to the first response instruction information, the information processing device 10 uses a presentation device to present information (cancellation operation instruction information) to the user of the vehicle 200. In this way, the information processing device 10 changes the content of the response instruction to the vehicle 200, for example. Alternatively, the information processing device 10 creates information indicating the content of the changed response instruction and executes processing (such as "application control" or "user notification" as shown in Figure 3) to have the vehicle 200 execute the response instruction based on the created information.

[0151] Furthermore, if the information processing device 10 would suffer a disadvantage by causing the vehicle 200 to cancel the execution of the processing based on the first response instruction information after outputting the first response instruction information to the vehicle 200, it may change the response instruction to the vehicle 200.

[0152] Furthermore, for example, if phonebook data stored in vehicle 200 is deleted due to the first response instruction information, and the phonebook data must be re-stored in vehicle 200, the level of inconvenience suffered by the user is considered low. On the other hand, if the data received from the OTA (Over The Air) server must be rolled back due to the first response instruction information, and vehicle 200 must be brought to the vehicle 200 dealer, the level of inconvenience suffered by the user is considered high. Therefore, the information processing device 10 may change the response instruction depending on the level of inconvenience estimated to be suffered by the user.

[0153] Furthermore, if any state of the vehicle 200 changes as a result of the information processing device 10 causing the vehicle 200 to execute processing based on the first corresponding instruction information, the information processing device 10 may change the corresponding instruction based on the state of the vehicle 200.

[0154] [Effects, etc.] The following describes examples of inventions that can be obtained from the disclosures in this specification, and explains the effects that can be obtained from these examples.

[0155] Technology 1 is an information processing device 10 mounted on a vehicle 200, comprising a processor 11 and a memory 12. The processor 11 uses the memory 12 to output first response instruction information to the vehicle 200 indicating a first response instruction that causes the vehicle 200 to execute a first response in response to a security event. If it receives second response instruction information indicating a second response instruction that causes the vehicle 200 to execute a second response in response to a security event, it determines whether the first response instruction and the second response instruction are the same response instruction. If it determines that the first response instruction and the second response instruction are not the same response instruction, it executes a first process based on the content of the first response instruction.

[0156] Specifically, the information processing device 10 outputs first response instruction information to at least one of the multiple ECUs 210 equipped in the vehicle 200, indicating a first response instruction that causes at least one of them to perform a first response in response to a security event. Subsequently, for example, if the information processing device 10 determines that the first response instruction and the second response instruction are not the same response instruction, and if predetermined conditions are met, it executes a first process based on the content of the first response instruction. For example, if the information processing device 10 determines that the first response instruction and the second response instruction are not the same response instruction, it causes the vehicle 200 to perform a second response, and further, if predetermined conditions are met, it executes a first process based on the content of the first response instruction.

[0157] According to this, even if it is not possible to stop the vehicle 200 from executing the first response, a predetermined first process based on the content of the first response instruction will be executed. Therefore, even if the state of the vehicle 200 changes due to the first response instruction, processing can be performed in accordance with the changed state of the vehicle 200. Furthermore, even if the first response instruction causes, for example, the user of the vehicle 200 to suffer a disadvantage, processing can be performed to mitigate that disadvantage. Thus, according to the information processing device 10 of Technology 1, the disadvantages incurred by the user in the vehicle 200 can be mitigated.

[0158] Technology 2 is an information processing device 10 as described in Technology 1, which, if it is determined that the first response instruction and the second response instruction are not the same response instruction, determines whether it is necessary to have the vehicle 200 perform a process other than a process to stop the execution of the first response, and if it is determined that it is necessary to have the vehicle 200 perform a process other than a cancellation process to stop the execution of the first response, executes the first process based on the content of the first response instruction.

[0159] If the information processing device 10 determines, for example, that it is necessary to have the vehicle 200 perform a process other than a cancellation process that stops the execution of the first response, it determines that the predetermined conditions are met and executes the first process based on the content of the first response instruction. If the information processing device 10 determines, for example, that it is not necessary to have the vehicle 200 perform a process other than a cancellation process that stops the execution of the first response, it determines that the predetermined conditions are not met and does not execute the first process, but instead executes a cancellation process that stops the execution of the first response.

[0160] For example, if the content of the first response instruction is included in the table information, the information processing device 10 determines that it is necessary to have the vehicle 200 perform a process other than the process of canceling the execution of the first response, and if the content of the first response instruction is not included in the table information, it determines that it is not necessary to have the vehicle 200 perform a process other than the process of canceling the execution of the first response.

[0161] For example, if it is possible to stop the vehicle 200 from performing the first response, such as when the vehicle 200 has not yet performed the first response, then it is highly likely that no disadvantage will occur if a process is performed to stop the vehicle 200 from performing the first response. On the other hand, if it is not possible to stop the vehicle 200 from performing the first response, such as when the vehicle 200 has already performed the first response, then it is highly likely that the user will suffer a disadvantage compared to the case where the vehicle 200 can stop the vehicle 200 from performing the first response. Therefore, according to the information processing device 10 related to Technology 2, the first process may be executed when it is highly likely that the user will suffer a disadvantage.

[0162] Technology 3 is an information processing device 10 as described in Technology 2, which determines whether it is necessary to have the vehicle 200 perform a process other than the process of stopping the execution of the first response, by determining whether the process based on the first response instruction has already been performed by the vehicle 200, and if it is determined that the process based on the first response instruction has already been performed by the vehicle 200, it determines that it is necessary to have the vehicle 200 perform a process other than the process of stopping the execution of the first response.

[0163] The information processing device 10, for example, acquires information from the vehicle 200 indicating whether or not it has already performed processing based on the first response instruction.

[0164] According to this, the first process may be executed when it is considered highly likely that the user will suffer a disadvantage.

[0165] Technology 4 is the information processing device 10 described in Technology 2, which determines whether or not it is necessary to have the vehicle 200 perform a process other than the process of ceasing the execution of the first response, based on the state of the vehicle 200.

[0166] If the vehicle 200 being driven by the user is stopped by the first response instruction, there is a possibility of disadvantages such as the user being unable to determine whether or not they should resume driving. Therefore, according to the information processing device 10 related to technology 4, it is possible to determine whether or not the first process will be executed by taking into account the state of the vehicle 200.

[0167] Technology 5 is an information processing device 10 according to any of Technologies 1 to 4, which, when it is determined that the first response instruction and the second response instruction are not the same response instruction, determines the level of disadvantage the user will suffer when the first response is performed by the vehicle 200, determines whether the level of disadvantage is above a predetermined level, and if it is determined that the level of disadvantage is above a predetermined level, performs the first process based on the content of the first response instruction.

[0168] For example, if the information processing device 10 determines that the level of disadvantage is above a predetermined level, it determines that the predetermined conditions are met and executes the first process based on the content of the first response instruction. On the other hand, if the information processing device 10 determines that the level of disadvantage is not above a predetermined level, it determines that the predetermined conditions are not met and does not execute the first process, but instead executes a cancellation process.

[0169] According to this, the first process may be executed when the level of disadvantage suffered by the user is high, that is, when the user suffers a significant disadvantage.

[0170] Technology 6 is an information processing device 10 according to any one of Technologies 1 to 5, wherein the first process includes at least one of the following processes: a process for controlling a vehicle 200, a process for controlling a predetermined application stored in the vehicle 200, and a process for notifying the user of information regarding the first correspondence.

[0171] According to this, the disadvantages to the user that occur in vehicle 200 can be mitigated.

[0172] Technology 7 is an information processing device 10 as described in Technology 6, which, in the execution of the first process, if a process other than the process of notifying the user of information regarding the first response is executed, executes a process to notify the user of information indicating the content of the process other than the process of notifying the user of information regarding the first response.

[0173] Information indicating the content of processes other than the process of notifying the user of information regarding the first response is, for example, information indicating the "action taken" included in the table information.

[0174] According to this, the user can recognize the processes performed in vehicle 200.

[0175] Technology 8 is an information processing device 10 according to any of Technologies 1 to 7, which, after executing the first process, further outputs processing information related to the first process.

[0176] According to this, for example, when a security device that has transmitted second instruction information to the vehicle 200 acquires processing information, an operator using the security device can recognize the processing performed in the vehicle 200.

[0177] Technology 9 is an information processing device 10 as described in Technology 8, which further determines whether the first process was valid based on the processing information and outputs validity information indicating the result of the determination of whether the first process was valid or not.

[0178] According to this, a user of vehicle 200 can determine whether the processing performed on vehicle 200 was appropriate or not.

[0179] Technology 10 is an information processing device 10 according to any one of Technologies 1 to 9, wherein the first process includes outputting instruction information indicating an instruction for the vehicle 200 or the user to perform a second process, and after performing the first process, it further determines whether or not the second process has been performed, and if it determines that the second process has not been performed, it outputs the instruction information again.

[0180] According to this, the occurrence of a problem where the second process is not executed can be suppressed.

[0181] Technology 11 is an information processing system comprising an information processing device 10 described in any of Technologies 1 to 10 and a security device that communicates wirelessly with the information processing device 10. When the information processing device 10 cannot communicate wirelessly with the security device and a security event occurs, it outputs a first response instruction information to the vehicle 200. After outputting the first response instruction information to the vehicle 200, if it receives a second response instruction information from the security device, it determines whether the first response instruction and the second response instruction are the same response instruction. If it determines that the first response instruction and the second response instruction are not the same response instruction, it executes a first process based on the content of the first response instruction.

[0182] The security device is, for example, the security center 300 mentioned above.

[0183] According to this, it will have the same effect as the information processing device 10 related to Technology 1.

[0184] Technology 12 is an information processing system as described in Technology 11, wherein the information processing device 10, after executing the first process, further transmits processing information related to the first process to a security device, the security device determines whether or not the first process was valid based on the processing information, and outputs validity information indicating the result of the determination of whether or not the first process was valid.

[0185] The security device displays, for example, validation information and processing information on a display device used by the operator using the security device.

[0186] The security device may, for example, determine whether the first process was valid based on validity information linked to items such as "Content of the first response instruction" and "Response content" in the table information, similar to the information processing device 10 described above. Alternatively, the security device may, similar to the information processing device 10 described above, determine whether the first process was valid using, for example, an LLM. The validity information and / or the LLM may be pre-stored in a storage device provided by the security device.

[0187] According to this, an operator using a security device can determine whether the processing performed in vehicle 200 was appropriate or not.

[0188] Technology 13 is an information processing method executed by an information processing device 10 mounted on a vehicle 200, wherein after outputting first response instruction information to the vehicle 200 (S10) indicating a first response instruction to cause the vehicle 200 to execute a first response in response to a security event, if second response instruction information indicating a second response instruction to cause the vehicle 200 to execute a second response in response to a security event is received (Yes in S20), it is determined whether the first response instruction and the second response instruction are the same response instruction (S30), and if it is determined that the first response instruction and the second response instruction are not the same response instruction (No in S30), the first process is executed based on the content of the first response instruction (S40).

[0189] According to this, it will have the same effect as the information processing device 10 related to Technology 1.

[0190] These general or specific embodiments may be implemented in a system, method, integrated circuit, computer program, or non-temporary recording medium such as a computer-readable CD-ROM, or in any combination of a system, method, integrated circuit, computer program, and non-temporary recording medium.

[0191] (Other embodiments) Although information processing devices and the like according to one or more embodiments have been described above based on the above embodiments, this disclosure is not limited to the above embodiments. Various modifications to the above embodiments that a person skilled in the art can conceive of may also be included within the scope of this disclosure, as long as they do not deviate from the spirit of this disclosure.

[0192] For example, in the above embodiment, a process executed by a specific processing unit may be executed by another processing unit. Furthermore, the order of multiple processes may be changed, or multiple processes may be executed in parallel.

[0193] Furthermore, for example, in the above embodiment, each component of the processing unit may be implemented by dedicated hardware or by executing a software program suitable for each component. Each component may also be implemented by a program execution unit such as a CPU or processor reading and executing a software program recorded on a recording medium such as a hard disk or semiconductor memory.

[0194] The following cases are also included in this disclosure.

[0195] (1) The at least one device described above is specifically a computer system consisting of a microprocessor, ROM, RAM, hard disk unit, display unit, keyboard, mouse, etc. A computer program is stored in the RAM or hard disk unit. The at least one device described above achieves its function by the operation of the microprocessor in accordance with the computer program. Here, the computer program is composed of a combination of multiple instruction codes that indicate instructions to the computer in order to achieve a predetermined function.

[0196] (2) Some or all of the components constituting at least one of the above-described devices may be made up of a single system LSI (Large Scale Integration). The system LSI is a multi-functional LSI manufactured by integrating multiple components onto a single chip, and specifically, it is a computer system comprising a microprocessor, ROM, RAM, etc. The RAM stores a computer program. The system LSI achieves its function by operating the microprocessor in accordance with the computer program.

[0197] (3) Some or all of the components constituting at least one of the above-described devices may consist of an IC card or a standalone module that is detachable from the device. The IC card or module is a computer system consisting of a microprocessor, ROM, RAM, etc. The IC card or module may include the above-described multi-function LSI. The IC card or module achieves its function by the operation of the microprocessor in accordance with a computer program. The IC card or module may be tamper-resistant.

[0198] (4) The disclosure may also be the methods described above. Alternatively, it may be a computer program that implements these methods using a computer, or a digital signal consisting of a computer program.

[0199] Furthermore, this disclosure may also refer to a computer program or digital signal recorded on a computer-readable recording medium, such as a flexible disk, hard disk, CD (Compact Disc)-ROM, DVD, DVD-ROM, DVD-RAM, BD (Blu-ray® Disc), semiconductor memory, etc. Alternatively, it may refer to a digital signal recorded on such a recording medium.

[0200] Furthermore, this disclosure may also describe the transmission of computer programs or digital signals via telecommunications lines, wireless or wired communication lines, networks such as the Internet, or data broadcasting.

[0201] Alternatively, the program or digital signal may be carried out by another independent computer system by recording and transferring it on a recording medium, or by transferring the program or digital signal via a network or the like. [Industrial applicability]

[0202] This disclosure is applicable to vehicles that communicate with external servers, etc. [Explanation of Symbols]

[0203] 10 Information Processing Devices 11 processors 12,120 memory 100 Security monitoring devices 110 SOC 130 switches 200 vehicles 210 ECU 220 Wireless communication ECU 230 Antenna 300 Security Center 400 Networks 500 Security Systems

Claims

1. An information processing device installed in a vehicle, Processor and Equipped with memory, The processor uses the memory to: After outputting first response instruction information to the vehicle indicating a first response instruction to cause the vehicle to perform a first response in response to a security event, if second response instruction information indicating a second response instruction to cause the vehicle to perform a second response in response to the security event is received, it is determined whether the first response instruction and the second response instruction are the same response instruction. If it is determined that the first correspondence instruction and the second correspondence instruction are not the same correspondence instruction, the first process is executed based on the content of the first correspondence instruction. Information processing device.

2. If it is determined that the first response instruction and the second response instruction are not the same response instruction, it is determined whether or not it is necessary to have the vehicle perform a process other than the process of canceling the execution of the first response. If it is determined that the vehicle needs to perform a process other than the process that cancels the execution of the first response, the first process is executed based on the content of the first response instruction. The information processing apparatus according to claim 1.

3. In determining whether it is necessary to have the vehicle perform a process other than the process of ceasing the execution of the first response, it is determined whether the process based on the first response instruction has already been performed by the vehicle. If it is determined that the processing based on the first response instruction has already been executed by the vehicle, it is determined that it is necessary to have the vehicle execute processing other than the processing that cancels the execution of the first response. The information processing apparatus according to claim 2.

4. In determining whether it is necessary to have the vehicle perform a process other than the process of ceasing the execution of the first corresponding action, the determination is made based on the state of the vehicle whether it is necessary to have the vehicle perform a process other than the process of ceasing the execution of the first corresponding action. The information processing apparatus according to claim 2.

5. If it is determined that the first response instruction and the second response instruction are not the same response instruction, the level of disadvantage the user will suffer when the first response is performed by the vehicle is determined. Determine whether the level of the aforementioned disadvantage is above a predetermined level, If it is determined that the level of the disadvantage is equal to or greater than a predetermined level, the first process is executed based on the content of the first response instruction. The information processing apparatus according to claim 1.

6. The first process includes at least one of the following processes: a process for controlling the vehicle, a process for controlling a predetermined application stored in the vehicle, and a process for notifying the user of information relating to the first correspondence. The information processing apparatus according to claim 1.

7. In the execution of the first process, if a process other than the process of notifying the user of information regarding the first correspondence is executed, a process is executed to notify the user of information indicating the content of the process other than the process of notifying the user of information regarding the first correspondence. The information processing apparatus according to claim 6.

8. After executing the first process, the system further outputs processing information related to the first process. The information processing apparatus according to claim 1.

9. moreover, Based on the processing information, determine whether the first processing was appropriate. The system outputs validity information indicating whether the first process was valid or not. The information processing apparatus according to claim 8.

10. The first process includes outputting instruction information indicating an instruction for the vehicle or user to execute the second process, After executing the first process, it is determined whether or not the second process has been executed. If it is determined that the second process has not been executed, the instruction information is output again. The information processing apparatus according to claim 1.

11. An information processing device according to any one of claims 1 to 10, The system comprises the aforementioned information processing device and a security device that communicates wirelessly with it. When the information processing device cannot communicate wirelessly with the security device, and the security event occurs, it outputs the first corresponding instruction information to the vehicle. If, after outputting the first response instruction information to the vehicle, the second response instruction information is received from the security device, it is determined whether the first response instruction and the second response instruction are the same response instruction. If it is determined that the first correspondence instruction and the second correspondence instruction are not the same correspondence instruction, the first process is executed based on the content of the first correspondence instruction. Information processing system.

12. After executing the first process, the information processing device further transmits processing information related to the first process to the security device. The security device determines whether the first process was valid based on the processing information and outputs validity information indicating the result of the determination of whether the first process was valid. The information processing system according to claim 11.

13. An information processing method performed by an information processing device installed in a vehicle, After outputting first response instruction information to the vehicle indicating a first response instruction to cause the vehicle to perform a first response in response to a security event, if second response instruction information indicating a second response instruction to cause the vehicle to perform a second response in response to the security event is received, it is determined whether the first response instruction and the second response instruction are the same response instruction. If it is determined that the first correspondence instruction and the second correspondence instruction are not the same correspondence instruction, the first process is executed based on the content of the first correspondence instruction. Information processing methods.

Images