Map output device and map output system

Abstract

To provide a map output device and a map output system that can save time and effort for changing specifications related to calculation of an update period of map data.SOLUTION: A map output device 3 comprises an on-vehicle control unit 35 that stores, in a first recording medium 2, use start information for specifying the time when the first recording medium 2 is connected to a connection part 34 for the first time or the time when a movable body 30 is used beyond a predetermined usage. The on-vehicle control unit 35 updates map data stored in the first recording medium 2 within a predetermined period from the time specified by the use start information.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a map output device and a map output system for outputting map data. [Background technology]

[0002] Patent Document 1 discloses a navigation system. When an SD card is inserted into a navigation unit that constitutes the navigation system, the navigation unit reads map data from the SD card and displays an image of the map on a display screen of a monitor.

[0003] The navigation unit is configured to provide a map update deadline to the SD card when the SD card is first inserted in the navigation unit, and the map data stored in the SD card is updated based on the map update deadline. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2011-169825 A Summary of the Invention [Problem to be solved by the invention]

[0005] However, the navigation system disclosed in Patent Document 1 calculates the map update deadline in the navigation unit, so if the specifications related to the calculation of the map update deadline are changed, the change process must be made in each navigation unit installed in two or more automobiles, which is time-consuming.

[0006] An object of the present invention is to provide a map output device and a map output system that can reduce the effort required when changing specifications related to calculation of an update deadline for map data. [Means for solving the problem]

[0007] A map output device according to a first aspect of the present disclosure is mounted on a moving body. The map output device outputs map data. The map output device includes a connection unit and an in-vehicle control unit. A recording medium is connected to the connection unit. The recording medium stores the map data. The in-vehicle control unit controls the connection unit. The in-vehicle control unit stores usage start information in the recording medium. The usage start information specifies the time when the recording medium is connected to the connection unit for the first time. Alternatively, the usage start information specifies the time when the moving body has been used beyond a predetermined usage amount. The in-vehicle control unit updates the map data within a predetermined period from the time specified by the usage start information. The map data is map data stored in the recording medium.

[0008] The map output device of the first aspect can store in the recording medium the start-of-use information required when, for example, a server sets an update deadline for map data. For example, if the server is configured to calculate the update deadline for map data, when specifications related to calculation of the update deadline are changed, the change process can be performed on the server, not on each map output device. Therefore, the map output device can update the map data stored in the recording medium, and it is possible to reduce the effort required when specifications related to calculation of the update deadline for map data are changed.

[0009] A map output system according to a second aspect of the present disclosure includes a map output device and a server. The map output device is mounted on a mobile body. The map output device outputs map data. The server communicates with the map output device. The map output device includes a connection unit and an in-vehicle control unit. A recording medium is connected to the connection unit. The recording medium stores map data. The in-vehicle control unit controls the connection unit. The in-vehicle control unit stores usage start information in the recording medium. The usage start information specifies when the recording medium is connected to the connection unit for the first time. Alternatively, the usage start information specifies when the mobile body has been used beyond a predetermined usage amount. The server sets an update deadline based on the usage start information. The update deadline is a deadline by which the map data stored in the recording medium can be updated.

[0010] The map output system of the second aspect can store in the recording medium the start-of-use information required when setting the update deadline for map data in the server. Therefore, when changing the specifications for calculating the update deadline, the map output system does not need to process the changes in each map output device, but instead performs the process of changing in the server, thereby reducing the effort required when changing the specifications for calculating the update deadline for map data.

[0011] In a map output system according to a third aspect of the present disclosure, the recording medium stores initial usage information in advance. The initial usage information indicates a predetermined character string. When the recording medium is connected to the connection unit for the first time, the in-vehicle control unit changes the initial usage information stored in the recording medium to start-of-use information. Alternatively, when the mobile object is used beyond a predetermined usage amount, the in-vehicle control unit changes the initial usage information stored in the recording medium to start-of-use information.

[0012] The map output system of the third aspect can store the start-of-use information in the recording medium in which the initial use information is stored, and therefore the map output system can update the map data in the genuine recording medium in which the initial use information is stored.

[0013] In the map output system according to the fourth aspect of the present disclosure, the server sets an update deadline for a recording medium in which no usage start information is stored, based on the date on which the map output device accesses the server.

[0014] The map output system of the fourth aspect can set an update deadline even for a recording medium in which no usage start information is stored. Effect of the Invention

[0015] According to the present invention, it is possible to reduce the effort required when changing the specifications related to the calculation of the update deadline for map data. [Brief description of the drawings]

[0016] [Figure 1]1 is a configuration diagram of a map output system according to an embodiment of the present invention; [Diagram 2] 4 is a table showing information stored in a first recording medium. [Diagram 3] 4 is a flowchart showing a start-up process of the map output device. [Figure 4] 5 is a flowchart showing a process of updating map data via a map output device. [Diagram 5] 6 is a flowchart showing a process of updating map data via a personal PC. [Figure 6] Configuration diagram of the production system. [Figure 7] A flow diagram of the processes carried out in the fabrication system. [Figure 8] FIG. 13 is a diagram showing an image of a process executed in an update process. [Figure 9] 1 is a flow chart of the process executed in the update process. [Figure 10] FIG. 2 is a block diagram showing an example of a hardware configuration of the map output device according to the embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0017] A map output system 1 according to an embodiment of the present invention includes a first recording medium 2, a map output device 3, a first server 4, a second server 5, and a personal computer 6. In this embodiment, the map output system 1 includes two or more first recording media 2 and two or more map output devices 3.

[0018] The first recording medium 2 includes a first medium management unit 21, a first storage unit 22, and a first control unit 23. In this embodiment, the first recording medium 2 is a secure digital (SD) card.

[0019] The map output device 3 includes an output unit 31, an on-vehicle storage unit 32, an input / output unit 33, a connection unit 34, an on-vehicle control unit 35, and an on-vehicle communication unit 36. The on-vehicle control unit 35 includes a mileage acquisition unit 37, a determination unit 38, and a data processing unit 39. In this embodiment, the map output device 3 is a navigation device. The map output device 3 is mounted on a moving object 30. In this embodiment, the moving object 30 is a vehicle. The vehicle is, for example, an automobile, a motorcycle, a bicycle, or a train.

[0020] The first server 4 includes a first server storage unit 41, a first server communication unit 42, and a first server control unit 43. The second server 5 includes a second server storage unit 51, a second server communication unit 52, and a second server control unit 53. In this embodiment, the first server 4 and the second server 5 are managed by different organizations. In this embodiment, the first server 4 is managed by an organization involved in the manufacture of the map output device 3, and the second server 5 is managed by a sales company of the map data 11.

[0021] The personal computer 6 includes a display unit 61, a PC storage unit 62, a PC communication unit 63, a PC interface 64, and a PC control unit 65. The personal computer 6 is a general computer that is personally owned by a user. Hereinafter, the personal computer 6 is also referred to as a "personal PC 6."

[0022] The map output device 3 is mounted on a moving object 30. When the first recording medium 2 is inserted into the connection unit 34, the map output device 3 reads the map data 11 shown in Fig. 2 from the first storage unit 22, and displays on the output unit 31 a map showing the position of the moving object 30 and a route to the destination.

[0023] The first recording medium 2 is a genuine product. The first recording medium 2 is, for example, a recording medium recognized as genuine by the manufacturer or distributor of the map output device 3. The first recording medium 2 is sold as a set with the map output device 3. Alternatively, the first recording medium 2 is sold separately. Hereinafter, a recording medium without a reference symbol indicates a recording medium that is not a genuine product.

[0024] For the user of the map output device 3, the newer the version of the map data 11, the more preferable it is. The map data 11 of an older version is more likely to cause inconvenience to the user of the map output device 3 than the map data 11 of a newer version. For example, the map data 11 of an older version does not include road information corresponding to a newly installed road and facility information corresponding to a newly constructed facility. In this case, the map output device 3 cannot search for a route that passes through the new road or set the new facility as a destination. The first recording medium 2 is configured such that the information stored in the first storage unit 22 is read by the personal PC 6, similar to commercially available recording media. Therefore, there is a risk that the latest map data 11 may be illegally copied to another first recording medium 2 or a commercially available recording medium.

[0025] As a security measure for the map data 11, in this embodiment, the map output device 3 is configured to read the map data 11 from the first recording medium 2, rather than from a commercially available recording medium. The map output device 3 is configured to read the map data 11 from a first recording medium 2 in which information has not been illegally rewritten. Therefore, illegally copied map data 11 cannot be used by the map output device 3.

[0026] Furthermore, the map output device 3 is configured not to read the map data 11 from the first recording medium 2 that has been used by another map output device 3. When the first recording medium 2 is connected to the connection unit 34, the data processing unit 39 writes the vehicle identification information of the mobile body 30 on which the map output device 3 is mounted to the first storage unit 22. The vehicle identification information is different for each of the two or more mobile bodies 30. The first recording medium 2 is linked to a specific mobile body 30 by the vehicle identification information. Hereinafter, the process in which the data processing unit 39 writes the vehicle identification information to the first storage unit 22 is referred to as a "lock process." The map output system 1 can prevent the first recording medium 2 from being reused by two or more map output devices 3 by the lock process.

[0027] <Configuration of first recording medium 2> The first medium management unit 21 stores medium identification information. The medium identification information is information capable of identifying each of the two or more first recording media 2. The medium identification information indicates an arbitrary character string. The character string includes, for example, at least one of numbers, letters, symbols, etc. The medium identification information stored in the first medium management unit 21 is set to a different character string for each of the two or more first recording media 2.

[0028] The first medium management unit 21 is a memory configured so that it cannot be read or written by the personal PC 6. The first medium management unit 21 is configured so that it can be written and read only when certain conditions are met. In this embodiment, the certain conditions are determined by the manufacturer of the first recording medium 2. The certain condition is, for example, the use of a certain management program corresponding to the first medium management unit 21. The medium-specific information stored in the first medium management unit 21 cannot be read or rewritten by the user of the map output device 3.

[0029] In this embodiment, a part of the medium-specific information is common to two or more first recording media 2. The common information is set, for example, in association with the map output device 3. The common information indicates, for example, the name of the organization that manufactures the map output device 3, the product name of the map output device 3, or the product name of the mobile object 30 on which the map output device 3 is mounted. The first server 4 uses the common information in the update process of the map data 11.

[0030] The first storage unit 22 stores various types of information. In this embodiment, the first storage unit 22 stores the map data 11, the map difference data 15, the vehicle specific file 12, the use date file 13, and the license file .

[0031] The map data 11 includes road information, facility information, version information, etc. The version information indicates the version of the map data 11. The road information is represented by a combination of nodes and links. The nodes are set at intersections, ends of roads, etc. The links are set at positions connecting adjacent nodes. The facility information indicates, for example, the positions and types of buildings, and the positions and types of POIs (points of interest), etc.

[0032] The map data 11 is composed of data corresponding to a plurality of parcels, for example. Parcels are set by dividing the earth's surface into rectangles of a predetermined size based on latitude and longitude. The map data 11 stored in the first storage unit 22 is updated to a new version of the map data 11 via the map output device 3 or the personal PC 6.

[0033] The map difference data 15 is map data that is different from the map data 11 stored in the first storage unit 22. The map difference data 15 is handled in parcel units. New versions of the map difference data 15 are created more frequently by the distributor of the map data 11 than the map data 11.

[0034] In this embodiment, the first server 4 stores the map difference data 15 of the latest version. The second server 5 stores the map difference data 15 of the latest version and the map data 11 of the latest version. The map data 11 stored in the first storage unit 22 is updated by storing the map difference data 15 of the latest version transmitted from the first server 4 in the first storage unit 22. Alternatively, the map data 11 stored in the first storage unit 22 is updated by replacing it with the map data 11 of the latest version transmitted from the second server 5. Alternatively, the map data 11 stored in the first storage unit 22 is updated by replacing it with the map data 11 of the latest version transmitted from the second server 5 and storing the map difference data 15 of the latest version transmitted from the second server 5 in the first storage unit 22. The output unit 31 can output a map based on the map data 11 and the map difference data 15 stored in the first storage unit 22. Hereinafter, updating the map data 11 stored in the first storage unit 22 is also referred to as “map update.” Note that the map output system 1 may be configured so that the second server 5 does not store the map difference data 15.

[0035] By using the map difference data 15, the map output system 1 can shorten the time required for updating the map compared to the case where the entire map data 11 is downloaded.

[0036] The vehicle specific file 12 is a file indicating that the first recording medium 2 is a genuine product. As shown in FIG. 2, the vehicle specific file 12 before the locking process includes vehicle initial information, medium specific information, and version information. The vehicle initial information indicates a predetermined character string. The vehicle initial information is the same for each of the two or more first recording media 2. Therefore, the vehicle initial information may also be called an initial value. In this embodiment, the vehicle initial information is set by an organization involved in the manufacture of the map output device 3. If the information has not been illegally rewritten, the medium specific information included in the vehicle specific file 12 is the same as the medium specific information stored in the first medium management unit 21. Hereinafter, the version of the map data 11 will also be referred to as the "map version."

[0037] In this embodiment, the vehicle identification file 12 after the locking process includes vehicle identification information, medium identification information, and version information. The vehicle identification information can identify the moving body 30 in which the map output device 3 is mounted. The vehicle identification information indicates a predetermined character string. The vehicle identification information is different for each of the two or more moving bodies 30. The vehicle identification information is created based on the device identification information. The device identification information is specific and unique information that each moving body 30 has. In this embodiment, the device identification information is set by the organization that manufactures the moving body 30.

[0038] The above-mentioned locking process is a process for storing vehicle identification information in the first storage unit 22. In this embodiment, the vehicle initial information in the vehicle identification file 12 is changed to the vehicle identification information by the locking process.

[0039] The usage date file 13 and the license file 14 are used for map updates. As shown in FIG. 2, the usage date file 13 before the locking process includes usage initial information, medium identification information, and version information. The usage initial information indicates a character string different from the vehicle initial information. The usage initial information is the same for each of the two or more first recording media 2. In this embodiment, the usage initial information is set by an organization involved in the manufacture of the map output device 3.

[0040] When the first recording medium 2 is subjected to a locking process or a map update, use start information is stored in the first storage unit 22. The use start information indicates when the locking process was performed on the first recording medium 2. Alternatively, the use start information indicates when the first recording medium 2 was first updated on the map. These times are specified by at least one of the year, month, day, and time. In this embodiment, the use start information indicates a date. Although omitted in FIG. 2, if a map update is performed prior to the locking process, the use start information is stored in the first storage unit 22 even before the locking process. In this embodiment, the use date file 13 after the locking process or the map update includes the use start information, the medium specification information, and the version information.

[0041] The license file 14 before the locking process includes vehicle identification information, medium identification information, and version information. The license file 14 after the locking process includes vehicle identification information, medium identification information, version information, and flag information. The flag information is information that indicates that the first recording medium 2 has been locked. The inclusion of flag information in the license file 14 is determined by obtaining a bit from an area of ​​numerical data that indicates a set of flags.

[0042] The first server control unit 43 uses the usage date file 13 and the license file 14 in updating the map. The first server control unit 43 manages the update deadline and map version of the map data 11 for each first recording medium 2, based on the usage date file 13 and the license file 14. The update deadline is a deadline during which the map output system 1 can update the map data 11 stored in the first storage unit 22.

[0043] The first recording medium 2 stores the vehicle specific file 12 and the usage date file 13 even before the first recording medium 2 is connected to the connection unit 34. The license file 14 is created by the data processing unit 39 when the first recording medium 2 is connected to the connection unit 34, and is stored in the first storage unit 22. The vehicle specific file 12, the usage date file 13, and the license file 14 are each encrypted and stored in the first storage unit 22 to prevent unauthorized rewriting.

[0044] The first control unit 23 controls the first medium management unit 21 and the first storage unit 22.

[0045] <Configuration of map output device 3> The output unit 31 displays a map based on the map data 11 stored in the first storage unit 22. Alternatively, the output unit 31 displays a map based on the map data 11 and map difference data 15 stored in the first storage unit 22. The output unit 31 is configured with, for example, a liquid crystal display or the like.

[0046] The on-vehicle storage unit 32 stores various information related to the navigation function, map updates, etc. In this embodiment, the on-vehicle storage unit 32 pre-stores vehicle initial information, an encryption key, and a navigation program. The predetermined encryption key is an encryption key for encrypting and decrypting the vehicle-specific file 12, the usage date file 13, and the license file 14, respectively. The programs are various programs executed by the map output device 3. These programs include a program for starting the map output device 3, a program for map updates, and a management program for reading out medium-specific information from the first medium management unit 21.

[0047] The in-vehicle storage unit 32 is realized by a storage device, such as a semiconductor memory element such as a random access memory (RAM) or a flash memory, a hard disk, or an optical disk.

[0048] The input / output unit 33 inputs and outputs data between the moving body 30 and the map output device 3 mounted on the moving body 30. The input / output unit 33 is configured by, for example, an I / O (Input / Output) interface.

[0049] The map output device 3 is connected to various car navigation sensors and input / output devices provided in the mobile object 30 via the input / output unit 33. The car navigation sensors are a GPS (Global Positioning System) receiver, a direction sensor, a distance sensor, etc. The GPS receiver receives GPS signals from GPS satellites. The direction sensor detects the traveling direction of the mobile object 30 or a change in the traveling direction. The distance sensor detects the speed and travel distance of the mobile object 30.

[0050] The connection unit 34 is a device for exchanging data between the map output device 3 and the first recording medium 2. The connection unit 34 is configured so that the first recording medium 2 can be inserted therein. In this embodiment, the connection unit 34 is configured by an SD host module.

[0051] The in-vehicle control unit 35 controls each device included in the map output device 3. The mileage acquisition unit 37 controls the input / output unit 33 to acquire mileage information from the distance sensor. The mileage information is information indicating the mileage of the mobile object 30. The mileage is the cumulative distance traveled since the mobile object 30 was not used.

[0052] The judgment unit 38 makes a judgment to prevent unauthorized map data 11 from being used in the map output device 3. In this embodiment, when the first recording medium 2 is connected to the connection unit 34, the judgment unit 38 judges whether or not the vehicle specific file 12 is stored in the first storage unit 22. A recording medium in which the vehicle specific file 12 is not stored is not a genuine product. When the vehicle specific file 12 is stored in the first storage unit 22, the judgment unit 38 judges whether or not the vehicle specific file 12 is proper. The judgment unit 38 is configured to start the map output device 3 when the vehicle specific file 12 is proper. When reading each piece of information included in the vehicle specific file 12, the judgment unit 38 decrypts the vehicle specific file 12 with an encryption key stored in the in-vehicle storage unit 32.

[0053] To determine whether the vehicle-specific file 12 is appropriate, the judgment unit 38 judges whether the medium-specific information included in the vehicle-specific file 12 matches the medium-specific information stored in the first medium management unit 21. To determine whether the vehicle-specific file 12 is appropriate, the judgment unit 38 judges whether the version information included in the vehicle-specific file 12 matches the version information included in the map data 11.

[0054] When the first recording medium 2 on which the locking process has not been executed is connected to the connection unit 34, the determination unit 38 determines whether the vehicle initial information included in the vehicle identification file 12 matches the vehicle initial information stored in the in-vehicle storage unit 32. When the first recording medium 2 on which the locking process has already been executed is connected to the connection unit 34, the determination unit 38 determines whether the vehicle initial information included in the vehicle identification file 12 matches the vehicle identification information created by the data processing unit 39 based on the device identification information. When the vehicle initial information does not match, or when the vehicle identification information does not match, the determination unit 38 is configured not to start the map output device 3. For example, the first recording medium 2 that has been locked by another map output device 3 is not authenticated by the determination unit 38 because the vehicle identification information included in the vehicle identification file 12 does not match the vehicle identification information created by the data processing unit 39.

[0055] In the vehicle-specific file 12 that has been illegally copied or rewritten, at least one of the vehicle initial information, the vehicle specific information, the medium specific information, and the version information does not correspond to at least one of the vehicle initial information stored in the in-vehicle storage unit 32, the vehicle specific information created by the data processing unit 39, the medium specific information stored in the first medium management unit 21, and the version information included in the map data 11. Therefore, the map output device 3 can prevent an illegal first recording medium 2 from being used. In this embodiment, the determination unit 38 makes the above determination every time the first recording medium 2 is inserted into the connection unit 34.

[0056] When the first recording medium 2 is connected to the connection unit 34, the judgment unit 38 judges whether the first storage unit 22 stores the license file 14. When the first storage unit 22 stores the license file 14, the judgment unit 38 judges whether the license file 14 is proper. Specifically, the judgment unit 38 judges whether the vehicle identification information included in the license file 14 matches the vehicle identification information created by the data processing unit 39. The judgment unit 38 judges whether the medium identification information included in the license file 14 matches the medium identification information stored in the first medium management unit 21. The judgment unit 38 judges whether the version information included in the license file 14 matches the version information of the map data 11 stored in the first storage unit 22. The match of all of these pieces of information means that the information included in the license file 14 matches the current situation. When reading the information included in the license file 14, the judgment unit 38 decrypts the license file 14 with the encryption key stored in the in-vehicle storage unit 32.

[0057] The determination unit 38 determines whether or not the mileage information acquired by the mileage acquisition unit 37 has exceeded a predetermined value for the locking process. The determination unit 38 determines whether or not the locking process has already been executed on the first recording medium 2 inserted into the connection unit 34, based on the vehicle initial information or vehicle identification information included in the vehicle identification file 12.

[0058] The data processing unit 39 creates the license file 14 based on the judgment of the judgment unit 38. The data processing unit 39 creates the license file 14 when the license file 14 is not stored in the first storage unit 22 and when the license file 14 stored in the first storage unit 22 is not appropriate. The data processing unit 39 creates the license file 14 based on, for example, the device identification information, the medium specification information stored in the first medium management unit 21, and the map data 11 and the vehicle specification file 12 stored in the first storage unit. The data processing unit 39 encrypts the newly created license file 14 with an encryption key stored in the in-vehicle storage unit 32. The data processing unit 39 stores the encrypted license file 14 in the first storage unit 22. When the license file 14 is already stored in the first storage unit 22, the data processing unit 39 overwrites the license file 14 stored in the first storage unit 22 with the newly created license file 14. The data processing unit 39 can update the license file 14 stored in the first storage unit 22 to contents corresponding to the current state.

[0059] The data processing unit 39 executes a lock process when the moving object 30 has traveled beyond a predetermined travel distance. Specifically, the data processing unit 39 creates a vehicle specific file 12 when the determination unit 38 determines that the travel distance information has exceeded a predetermined value. The vehicle specific file 12 created by the data processing unit 39 includes vehicle specific information, medium specific information, and version information. The data processing unit 39 creates the vehicle specific information based on the device identification information. The data processing unit 39 creates the vehicle specific information from the device identification information, for example, by hashing. The data processing unit 39 encrypts the vehicle specific file 12 with an encryption key stored in the in-vehicle storage unit 32. The data processing unit 39 overwrites the vehicle specific file 12 stored in the first storage unit 22 with the newly created vehicle specific file 12. This allows the data processing unit 39 to change the vehicle initial information included in the vehicle specific file 12 to the vehicle specific information.

[0060] The predetermined value is not particularly limited. For example, the predetermined value is set to a value of 10 km or more and 100 km or less. It is preferable that the predetermined value is set to a value of 10 km or more and 50 km or less. It is more preferable that the predetermined value is set to a value of 10 km or more and 30 km or less. It is even more preferable that the predetermined value is set to a value of 10 km or more and 20 km or less.

[0061] The data processing unit 39 may be configured to perform the locking process based on the output period during which the map data 11 was output to the output unit 31, instead of the mileage. In this configuration, the data processing unit 39 executes the locking process when the map data 11 stored in the first storage unit 22 has been used for a certain period. The certain period is, for example, from one hour to one year. The certain period is preferably from one hour to 24 hours. The certain period is more preferably from one hour to 10 hours. In this configuration, the in-vehicle control unit 35 preferably has, for example, a timer function for measuring time.

[0062] The case where the vehicle has traveled more than a predetermined mileage corresponds to the case where the vehicle has been used in excess of a predetermined usage amount. The usage amount is a parameter that indicates the extent to which the vehicle has been used. In other words, the data processing unit 39 may be configured to perform the locking process based on a parameter that indicates that the mobile object 30 has been used not temporarily but fully. The mileage and the output period of the map data 11 are parameters that indicate that the mobile object 30 has been used fully. The mileage and the output period of the map data 11 each correspond to the usage amount. The data processing unit 39 may be configured to perform the locking process when the mobile object 30 has been used in excess of a predetermined usage amount.

[0063] After the moving body 30 has traveled a predetermined distance or more, the data processing unit 39 performs a locking process every time another first recording medium 2 that has not been locked is inserted into the connection unit 34.

[0064] The data processing unit 39 is not limited to a configuration that performs the locking process based on the amount of usage of the mobile object 30, and may be configured to perform the locking process, for example, when the first recording medium 2 is inserted into the connection unit 34 for the first time. The first insertion of the first recording medium 2 into the connection unit 34 also includes the time when the map output device 3 detects that the first recording medium 2 is connected to the connection unit 34, and the time when the map data 11 read from the first recording medium 2 is output to the output unit 31 for the first time.

[0065] When executing the lock process on the first recording medium 2 that does not store the use start information, the data processing unit 39 creates the use date file 13. The use date file 13 created by the data processing unit 39 includes the use start information, the medium identification information, and the version information. The data processing unit 39 creates the use start information based on the GPS signal received by the GPS receiver. The data processing unit 39 encrypts the created use date file 13 with the encryption key stored in the in-vehicle storage unit 32. The data processing unit 39 controls the connection unit 34 so that the encrypted use date file 13 is overwritten and saved in the first storage unit 22. In this way, the data processing unit 39 stores the use start information in the first storage unit when the travel distance of the mobile unit 30 reaches a predetermined value and the reception date and time is confirmed by the GPS receiver.

[0066] In this embodiment, the map output device 3 performs a map update using the map difference data 15. The in-vehicle control unit 35 automatically performs the map update process at a predetermined time interval, for example, once a month. When performing a map update, the in-vehicle control unit 35 requests the first server 4 for the latest version. The request for the latest version is a request for the first server 4 to transmit the map difference data 15 of the latest version to the map output device 3. In this embodiment, when requesting the latest version, the data processing unit 39 transmits the version information and medium identification information of the map data 11 stored in the first storage unit 22 to the first server 4. Specifically, the data processing unit 39 transmits the use date file 13 and the license file 14 to the first server 4.

[0067] When the data processing unit 39 receives the map difference data 15 from the first server 4 , it controls the connection unit 34 so that the map difference data 15 is written to the first storage unit 22 .

[0068] When executing a map update, the data processing unit 39 creates a vehicle-specific file 12 whose version information indicates the latest map version, based on the map difference data 15 received from the first server 4. The data processing unit 39 encrypts the created vehicle-specific file 12 with an encryption key stored in the in-vehicle storage unit 32. The data processing unit 39 controls the connection unit 34 so that the encrypted vehicle-specific file 12 is overwritten and saved in the first storage unit 22.

[0069] The connection unit 34 exchanges data between the map output device 3 and the first recording medium 2. The connection unit 34 is configured so that the first recording medium 2 can be inserted therein. In this embodiment, the connection unit 34 is an SD host module. The connection unit 34 is not limited to an SD host module as long as it can read data from the first recording medium 2.

[0070] The in-vehicle control unit 35 is realized, for example, by executing a program stored in the in-vehicle storage unit 32 by a CPU (Central Processing Unit), an MPU (Micro Processing Unit), or the like.

[0071] The in-vehicle communication unit 36 ​​communicates with each of the first server 4 and the second server 5 via the Internet 10. In this embodiment, the in-vehicle communication unit 36 ​​is configured with a TCU (telecommunication control unit).

[0072] <Configuration of the first server 4> In the case of a map update via the map output device 3, the map output system 1 determines whether or not the map update is possible in the first server 4, and if the map update is possible, performs the map update using the map difference data 15 received from the first server 4. In the case of a map update via the personal PC 6, the map output system 1 determines whether or not the map update is possible in the first server 4, and if the map update is possible, performs the map update using the map data 11 and map difference data 15 received from the second server 5.

[0073] The first server storage unit 41 stores various information. The first server storage unit 41 stores in advance a predetermined encryption key, common information, a map database, map difference data 15, and a program. The predetermined encryption key is the same as the encryption key stored in the in-vehicle storage unit 32. The program is various programs executed by the first server 4. The common information is the above-mentioned information that is commonly included in two or more first recording media 2 as part of the medium-specific information. The first server storage unit 41 stores two or more map difference data 15 of different versions. The map difference data 15 stored in the first server storage unit 41 is updated to a new version of the map difference data 15 by an organization that manages the first server 4, for example, several times a year.

[0074] The map database is used to manage the update deadline of the map data 11. The map database stores medium specification information, update deadline information, and version information in association with each other. The version information stored in the map database indicates the version of the map data 11 stored in the first storage unit 22.

[0075] The first server storage unit 41 is configured with a storage device. Examples of the storage device include a semiconductor memory element such as a RAM or a flash memory, a hard disk, an optical disk, and the like.

[0076] The first server communication unit 42 communicates with the map output device 3 and the personal PC 6 via the Internet 10.

[0077] The first server control unit 43 controls the first server storage unit 41 and the first server communication unit 42. The first server control unit 43 performs judgment and processing for map update. When performing a map update, the map output device 3 or the personal PC 6 acquires the use date file 13 and the license file 14 from the first storage unit 22 and transmits them to the first server 4. The use date file 13 and the license file 14 are data files required for the map output system 1 to perform a map update, respectively. The first server control unit 43 verifies the license file 14 transmitted from the map output device 3 or the personal PC 6. If the first server control unit 43 determines that the license file 14 can be decrypted with the encryption key stored in the first server storage unit 41 and that the license file 14 contains the above-mentioned common information, it authenticates the license file 14.

[0078] After authenticating the license file 14, the first server control unit 43 judges whether or not the update right is granted to the first recording medium 2 to be subjected to the map update, based on the license file 14 and the map database. The update right is the right to update the map data 11 stored in the first storage unit 22. The update right is granted for each first recording medium 2. If the same medium identification information as that included in the license file 14 is associated with update deadline information and version information and registered in the map database, the first server control unit 43 judges that the update right is granted to the first recording medium 2 to be subjected to the map update. Note that if the license file 14 is not authenticated, the first server control unit 43 stops the map update process.

[0079] If the update right is granted, the first server control unit 43 judges whether or not the map update can be performed on the first recording medium 2 that is the target of the map update. Specifically, the first server control unit 43 judges whether or not the update deadline has passed. In addition, in the case of a map update via the map output device 3, the first server control unit 43 judges whether or not a newer version of the map difference data 15 than the map data 11 stored in the first storage unit 22 is stored in the first server storage unit 41 based on the map database and the license file 14. Alternatively, in the case of a map update via the personal PC 6, the first server control unit 43 judges whether or not a newer version of the map data 11 and the map difference data 15 than the map data 11 stored in the first storage unit 22 are stored in the second server storage unit 51 based on the map database and the license file 14. If the update deadline has already passed, the first server control unit 43 stops the map update process. If the latest versions of the map data 11 and the map difference data 15 are already stored in the first storage unit 22, the first server control unit 43 stops the map update process.

[0080] If the update right is not granted, the first server control unit 43 grants the update right to the first recording medium 2 that is the target of the map update. The first server control unit 43 grants the update right to the first recording medium 2 in which the use start information is already stored, based on the use start information. The first server control unit 43 sets the update deadline so that the map update is performed within a predetermined period from the time specified by the use start information. In this embodiment, the first server control unit 43 sets the update deadline to a date that is a predetermined number of years after the date indicated by the use start information. In this embodiment, the date indicated by the use start information is considered to be the use start date, which is the date on which the first recording medium 2 began to be used by the map output device 3. The map output system 1 calculates the update deadline by setting the date indicated by the use start information as the first day, so even if the use start dates are different for two or more first recording media 2, the length of the period from the use start date to the update deadline is the same for each first recording medium 2. For the first recording medium 2 in which no usage start information is stored but initial usage information is stored, the first server control unit 43 calculates the update deadline based on the time when the map output device 3 or the personal PC 6 accessed the first server 4. That is, the first server control unit 43 regards the date when the map output device 3 or the personal PC 6 accessed the first server 4 as the usage start date, and sets the date a predetermined number of years after this date as the update deadline. The first server control unit 43 reflects the determined update deadline in the map database together with the medium identification information and version information of the first recording medium 2 that is the target of the map update. As a result, the first server control unit 43 grants the update right to the first recording medium 2 that is the target of the map update.

[0081] If the license file 14 is authenticated, the first server control unit 43 creates authentication information. The authentication information is information that proves that the map output device 3 or the personal PC 6 has normally accessed the first server 4. The authentication information is expressed as a character string that has no particular meaning. The first server control unit 43 sets the validity period of the authentication information so that the map output system 1 can use the authentication information until one map update is completed. The validity period is, for example, 12 hours or 24 hours. The authentication information is transmitted, together with various information, between the first server 4 and the map output device 3 or the personal PC 6. By using the authentication information, the map output system 1 does not need to transmit and decrypt the license file 14 every time it is accessed, so that the processing load of the map output system 1 can be reduced while taking security measures.

[0082] When a request for issuing the vehicle specific file 12 and the usage date file 13 is made from the personal PC 6 in a map update via the personal PC 6, the first server control unit 43 creates the vehicle specific file 12 and the usage date file 13. The first server control unit 43 encrypts the created vehicle specific file 12 and usage date file 13 based on an encryption key stored in the first server storage unit 41. In the case of a map update via the personal PC 6, the personal PC 6 obtains the map data 11 from the second server 5.

[0083] The vehicle specific file 12 created by the first server control unit 43 indicates the latest map version in version information. Therefore, when the first recording medium 2 with an updated map is connected to the connection unit 34, the vehicle specific file 12 is determined to be proper by the determination unit 38. If the version information included in the vehicle specific file 12 is not updated after the map update, the version information included in the vehicle specific file 12 and the version information of the map data 11 stored in the first storage unit 22 will not match when the first recording medium 2 is next connected to the connection unit 34, and the vehicle specific file 12 will not be authenticated by the determination unit 38. When creating the vehicle specific file 12, the first server control unit 43 obtains the version information of the map data 11 downloaded from the second server 5 from the personal PC 6.

[0084] The version information of the use date file 13 created by the first server control unit 43 is not updated. Therefore, the map output system 1 can leave the version information of the map data 11 initially stored in the first recording medium 2 in the use date file 13 even after the map update. In this way, when performing a map update on the first recording medium 2 that pre-stores the map data 11 and the vehicle specific file 12 and the use date file 13 that respectively store the version information, the map output device 3 updates the vehicle specific information included in the vehicle specific file 12 to vehicle specific information indicating the latest map version. The version information of the map data 11 initially stored in the first recording medium 2 is used, for example, for analysis when a bug occurs.

[0085] When a map update is performed, the first server control unit 43 updates the version information stored in the map database to match the version of the map data 11 or the map difference data 15 newly stored in the first storage unit 22.

[0086] The first server control unit 43 is realized, for example, by executing a program stored in the first server storage unit 41 by a CPU, an MPU, or the like.

[0087] <<Personal PC6 Configuration>> In this embodiment, the personal PC 6 performs map updates using the map data 11, without using the map difference data 15. The personal PC 6 corresponds to an update unit. The update unit is not limited to the personal PC 6, and may be a smartphone, a tablet terminal, or the like.

[0088] The display unit 61 is configured, for example, by a liquid crystal display.

[0089] The PC storage unit 62 stores various programs and the like. These programs include an update tool program, a program necessary for processing performed by the PC 6, and a program for reading out medium specification information from the first medium management unit 21. The update tool is dedicated software for map updates. The update tool is programmed to download update map data 11 from the second server 5 to the personal PC 6 and overwrite the map data 11 stored in the first storage unit 22 with the downloaded update map data 11. Map updates via the personal PC 6 are performed by the user using the update tool installed in the personal PC 6.

[0090] The PC communication unit 63 communicates with each of the first server 4 and the second server 5 via the Internet 10. The PC interface 64 is a device for exchanging data between the personal PC 6 and the first recording medium 2. The PC interface 64 is configured so that the first recording medium 2 can be inserted therein.

[0091] The PC control unit 65 controls the PC storage unit 62, the PC communication unit 63, and the PC interface 64.

[0092] When executing a map update, the PC control unit 65 transmits the use date file 13 and the license file 14 to the first server 4.

[0093] When the first server control unit 43 determines that the map update can be performed on the first recording medium 2, the PC control unit 65 determines the version of the map data 11 for update. The PC control unit 65 can obtain the latest version of the map data 11 that can be downloaded from the second server 5, among the map data 11 for update stored in the second server storage unit 51. The PC control unit 65 communicates the determined version to the second server 5. The PC control unit 65 controls the PC interface 64 to store the map data 11 transmitted from the second server 5 in the first storage unit 22. Note that the PC control unit 65 may be configured to be able to obtain information required to obtain the latest map version from at least one of the first server 4 and the second server 5.

[0094] When the PC control unit 65 receives the update map data 11 and the map difference data 15 from the second server 5, it requests the first server 4 to issue the vehicle specific file 12 and the usage date file 13 described above. When making the request to issue the vehicle specific file and the usage date file 13, the PC control unit 65 notifies the first server 4 of the version of the update map data 11 sent from the second server 5. Hereinafter, the request to issue the vehicle specific file 12 and the usage date file 13 is also referred to as a "file issue request."

[0095] The PC control unit 65 controls the PC interface 64 so that the update map data 11 and map difference data 15 received from the second server 5, and the vehicle-specific file 12 and usage date file 13 received from the first server 4 are respectively stored in the first memory unit 22.

[0096] The PC control unit 65 is realized, for example, by executing a program stored in the PC storage unit 62 by a CPU, an MPU, or the like.

[0097] <Configuration of the second server 5> The second server 5 has a configuration similar to that of the first server 4, and a description of the same configuration as that of the first server 4 will be omitted. The second server 5 has a different configuration from the first server 4 in that it stores update map data 11 in the second server storage unit 51. The second server 5 differs from the first server 4 in that it does not store a predetermined encryption key and a map database. The map data 11 and map difference data 15 stored in the second server storage unit 51 are updated to new versions of the map data 11 by an organization that manages the second server 5, for example, several times a year.

[0098] When the second server control unit 53 is notified of the map version determined by the personal PC 6 in a map update via the personal PC 6, it obtains the map data 11 for update and the map difference data 15 corresponding to that version from the second server storage unit 51. The second server control unit 53 transmits the map data 11 and the map difference data 15 obtained from the second server storage unit 51 to the personal PC 6.

[0099] <<Changes in information stored in the first recording medium 2>> Before being connected to the connection unit 34 for the first time, the first recording medium 2 stores map data 11, a vehicle specific file 12, and a usage date file 13. The vehicle specific file 12 includes vehicle initial information. When the first recording medium 2 is connected to the connection unit 34, it further stores a license file 14.

[0100] The locked first recording medium 2 stores vehicle identification information and use start information. In this embodiment, the vehicle initial information of the vehicle identification file 12 is changed to vehicle identification information by the locking process. The use initial information of the use date file 13 is changed to use start information by the locking process.

[0101] The first recording medium 2, which has undergone a map update via the map output device 3, further stores map difference data 15. Furthermore, the version information of the vehicle specific file 12 and the license file 14 stored in the first storage unit 22 has been updated to the latest map version. The first recording medium 2, which has undergone a map update via the personal PC 6, stores the vehicle specific file 12 and the license file 14, which have been updated to the latest map version.

[0102] <<Startup process of map output device 3>> When the first recording medium 2 is inserted into the connection unit 34 and power is supplied to the map output device 3, the map output device 3 starts the start-up process shown in FIG.

[0103] In step S11, the judgment unit 38 judges whether or not the vehicle specific file 12 is stored in the first storage unit 22. If the vehicle specific file 12 is stored in the first storage unit 22, the judgment unit 38 advances the startup process of the map output device 3 to step S12. If the vehicle specific file 12 is not stored in the first storage unit 22, the judgment unit 38 advances the startup process of the map output device 3 to step S13.

[0104] In step S12, the judgment unit 38 judges whether or not the vehicle specific file 12 is appropriate. If the vehicle specific file 12 is appropriate, the judgment unit 38 advances the startup process of the map output device 3 to step S14. If the vehicle specific file 12 is not appropriate, the judgment unit 38 advances the startup process of the map output device 3 to step S13.

[0105] In step S13, the determination unit 38 does not authenticate the first recording medium 2 inserted into the connection unit 34. The determination unit 38 causes the output unit 31 to output an error screen, and ends the startup process of the map output device 3. When the error screen is output, the map output device 3 does not read the map data 11 from the first recording medium 2, and cannot perform navigation.

[0106] In step S14, the determination unit 38 starts up the map output device 3.

[0107] In step S15, the determination unit 38 determines whether or not the license file 14 is stored in the first storage unit 22. If the license file 14 is stored in the first recording medium 2, the determination unit 38 advances the startup process of the map output device 3 to step S16. If the license file 14 is not stored in the first recording medium 2, the determination unit 38 advances the startup process of the map output device 3 to step S17.

[0108] In step S16, the judgment unit 38 judges whether the license file 14 is proper. If the license file 14 is proper, the judgment unit 38 advances the start-up process of the map output device 3 to step S19. If the license file 14 is not proper, the judgment unit 38 advances the start-up process of the map output device 3 to step S17.

[0109] In step S17, the data processing unit 39 creates the license file 14.

[0110] In step S18, the data processing unit 39 writes the license file 14 created in step S17 to the first storage unit 22. If the license file 14 is stored in the first storage unit 22, the data processing unit 39 overwrites the license file 14 stored in the first storage unit 22 with the license file 14 created in step S17.

[0111] In step S19, the determination unit 38 determines whether the travel distance of the moving object 30 exceeds a predetermined value. If the moving object 30 has traveled a distance exceeding the predetermined value, the determination unit 38 advances the startup process of the map output device 3 to step S20. If the moving object 30 has not traveled a distance exceeding the predetermined value, the determination unit 38 ends the startup process of the map output device 3. In this case, the map output device 3 becomes ready to perform navigation.

[0112] In step S20, the determination unit 38 determines whether or not the first recording medium 2 inserted into the connection unit 34 is a first recording medium 2 that has already been locked. If a first recording medium 2 that has already been locked is inserted into the connection unit 34, the determination unit 38 ends the startup process of the map output device 3. This enables the navigation function of the map output device 3. If the lock process has not yet been executed on the first recording medium 2, the determination unit 38 advances the startup process of the map output device 3 to step S21.

[0113] In step S21, the data processing unit 39 executes a locking process. After the locking process, the map output device 3 is in a state in which it can execute navigation.

[0114] <<Updating process of map data 11 via map output device 3>> When performing a map update on the first recording medium 2 in which the license file 14 is stored in the first storage unit 22, the in-vehicle control unit 35 controls the in-vehicle communication unit 36 ​​to transmit data files necessary for the map update to the first server 4 in step S21 shown in Fig. 4. In this embodiment, the data files necessary for the map update are the use date file 13 and the license file 14.

[0115] After the data files necessary for the map update are received in step S22, the first server control unit 43 verifies the license file 14 in step S23.

[0116] In step S24, the first server control unit 43 determines whether or not the update right is granted to the first recording medium 2 that is the target of the map update. If the update right is granted, the first server control unit 43 advances the update process of the map data 11 to step S26. If the update right is not granted, the first server control unit 43 advances the update process of the map data 11 to step S25.

[0117] In step S25, the first server control unit 43 determines the update deadline for the map data 11 based on the use date file 13 received in step S23.

[0118] In step S26, the first server control unit 43 creates authentication information.

[0119] In step S27, the first server control unit 43 controls the first server communication unit 42 to transmit the authentication information created in step S26 to the map output device 3.

[0120] After the authentication information is received in step S28, the in-vehicle control unit 35 requests the latest version in step S29. When requesting the latest version, the in-vehicle control unit 35 controls the in-vehicle communication unit 36 ​​to transmit to the first server 4 the version information and medium identification information of the map data 11 stored in the first storage unit 22, and the authentication information received in step S28.

[0121] In step S30, the first server control unit 43 determines the latest map version based on the map difference data 15 stored in the first server storage unit 41.

[0122] In step S31, the first server control unit 43 controls the first server communication unit 42 to transmit to the map output device 3 the map difference data 15 of the map version determined in step S30 and the authentication information created in step S27.

[0123] In step S32, the data processing unit 39 controls the connection unit 34 so that the map difference data 15 transmitted from the first server 4 is written into the first storage unit 22.

[0124] In step S33, the data processing unit 39 updates the vehicle specific file 12 stored in the first storage unit 22. The vehicle specific file 12 is updated by overwriting the vehicle specific file 12 stored in the first storage unit 22 with the vehicle specific file 12 created by the data processing unit 39. <<Updating map data 11 via personal PC 6>> When performing a map update on the first recording medium 2 in which the license file 14 is stored in the first storage unit 22, the PC control unit 65 controls the PC communication unit 63 to transmit data files necessary for the map update to the first server 4 in step S41 shown in Fig. 5. In this embodiment, the data files necessary for the map update are the use date file 13 and the license file 14.

[0125] The processing in steps S42 to S46 is similar to the processing in steps S22 to S26 shown in FIG.

[0126] In step S47, the first server control unit 43 controls the first server communication unit 42 to transmit the authentication information created in step S46 to the personal PC 6.

[0127] After the authentication information is received in step S48, the PC control unit 65 determines the latest map version in step S49.

[0128] In step S50, the PC control unit 65 controls the PC communication unit 63 to transmit to the second server 5 version information indicating the map version determined in step S49.

[0129] After the version information is received in step S51, the second server control unit 53 controls the second server communication unit 52 to transmit the update map data 11 and the map difference data 15 to the personal PC 6 in step S52. The map data 11 and the map difference data 15 transmitted to the personal PC 6 correspond to the version information received by the second server 5 in step 51.

[0130] In step S53, the PC control unit 65 writes the update map data 11 and the map difference data 15 transmitted by the second server 5 in step S52 into the first storage unit 22. As a result, the map data 11 stored in the first storage unit 22 is overwritten with the latest version of the map data 11. Furthermore, the first storage unit 22 stores the latest version of the map difference data 15.

[0131] In step S54, the PC control unit 65 makes a request for issuing the vehicle specific file 12 and the usage date file 13. When making the file issuance request, the PC control unit 65 controls the PC communication unit 63 to transmit, to the first server 4, the version information of the map data 11 received in step S53 and the authentication information received in step S48.

[0132] In step S55, the first server control unit 43 creates the vehicle specific file 12 indicating the latest map version and the usage date file 13 in which the version information has not been updated.

[0133] In step S56, the first server control unit 43 controls the first server communication unit 42 to transmit the vehicle-specific file 12 and the usage date file 13 created in step S55, and the authentication information created in step S47, to the personal PC 6.

[0134] In step S57, the PC control unit 65 controls the PC interface 64 so as to write, into the first storage unit 22, the vehicle specific file 12 and the usage date file 13 transmitted by the first server 4 in step S56.

[0135] As described above, the map output device 3 of this embodiment is mounted on the moving body 30. The map output device 3 outputs the map data 11. The map output device 3 includes a connection unit 34 and an in-vehicle control unit 35. The first recording medium 2 is connected to the connection unit 34. The first recording medium 2 stores the map data 11. The in-vehicle control unit 35 controls the connection unit 34. The in-vehicle control unit 35 stores the use start information in the first recording medium 2. The use start information specifies the time when the first recording medium 2 is connected to the connection unit 34 for the first time. Alternatively, the use start information specifies the time when the moving body 30 is used beyond a predetermined usage amount. The in-vehicle control unit 35 updates the map data 11 within the update deadline set based on the use start information. The map data 11 is the map data 11 stored in the first recording medium 2.

[0136] The map output device 3 can store in the first recording medium 2 use start information required when, for example, the first server 4 sets an update deadline for map data. For example, if the first server 4 is configured to calculate the update deadline for the map data 11, when specifications related to calculation of the update deadline are changed, the change process can be performed in the first server 4 without performing the change process in each map output device 3. Therefore, the map output device 3 can update the map data 11 stored in the first recording medium 2, and the effort required when specifications related to calculation of the update deadline for the map data 11 are changed can be reduced.

[0137] In the map output system 1 of this embodiment, when the map output device 3 cannot access the first server 4 for a long period of time, the map output device 3 can record the use start date on the first recording medium 2 according to a specific rule. In the case of this embodiment, the specific rule is the timing of the lock process. Therefore, even if the map output device 3 accesses the first server 4 later, the map output system 1 prevents the first server 4 from being unable to know the true use start date of the first recording medium 2, or from having a large error in the use start date of the first recording medium 2, and allows the first server 4 to know the accurate use start date.

[0138] <<Regarding the method for producing the first recording medium>> The first recording medium 2, which stores the map data 11, the vehicle-specific file 12, and the usage date file 13, is produced by a production system 100 shown in FIG. 6. The production system 100 includes the first recording medium 2, the second recording medium 120, the third recording medium 130, and a computer 140. The second recording medium 120 includes a second storage unit 121 and a second control unit 122. The third recording medium 130 includes a third medium management unit 131, a third storage unit 132, and a third control unit 133. The computer 140 includes a first interface 141, a second interface 142, a third interface 143, a storage device 144, and a control device 145. The storage device 144 includes a volatile memory 146 and a non-volatile memory 147. In this embodiment, the computer 140 is owned by the manufacturer of the first recording medium 2. Hereinafter, the computer 140 is also referred to as the "manufacturer's PC 140."

[0139] The production system 100 is a system for producing two or more first recording media 2. The production system 100 executes a copy step S101 and an update step S102 shown in Fig. 7 to produce the first recording media 2. In this embodiment, the production system 100 is implemented by the manufacturer of the first recording media 2 at the request of an organization involved in the manufacture of the map output device 3. Note that in this embodiment, the medium identification information is written in the first medium management unit 21 by the manufacturer of the first recording media 2 before the copy step S101 shown in Fig. 7 is executed.

[0140] In this embodiment, the map data 11, the vehicle specific file 12, and the usage date file 13 are copied directly from the third recording medium 130 to two or more first recording media 2 in the copy step S101. The map data 11, the vehicle specific file 12, and the usage date file 13 are stored in advance in the third storage unit 132. As shown in FIG. 2, the vehicle specific file 12 stored in the third storage unit 132 includes vehicle initial information, medium initial information, and version information. The usage date file 13 stored in the third storage unit 132 includes usage initial information, medium initial information, and version information. The vehicle specific file 12 and the usage date file 13 are encrypted and stored in the third storage unit 132.

[0141] The production system 100 may be configured not to use the third recording medium 130 in the copy step S101. For example, the map data 11, the vehicle specific file 12, and the usage date file 13 may be stored in advance in the non-volatile memory 147, and copied from the non-volatile memory 147 to the first recording medium 2 in the copy step S101.

[0142] In this embodiment, the third recording medium 130 is provided to the manufacturer of the first recording medium 2 by an organization involved in the production of the map output device 3. In this embodiment, the map data 11 stored in the third storage unit 132 is the latest version of the map data 11 at the time when the third recording medium 130 is provided to the manufacturer of the first recording medium 2.

[0143] The vehicle-specific file 12 copied from the third storage unit 132 to the first storage unit 22 in the copy step S101 includes vehicle initial information, medium initial information, and version information, as shown in Fig. 2. The vehicle-specific file 12 after the update step S102 includes vehicle initial information, medium initial information, and version information. The usage date file 13 copied from the third storage unit 132 to the first storage unit 22 in the copy step S101 includes usage initial information, medium initial information, and version information. The usage date file 13 after the update step S102 includes usage initial information, medium initial information, and version information.

[0144] In this embodiment, the third recording medium 130 is an SD card. The third recording medium 130 is electrically connected to the manufacturer PC 140 via the third interface 143. The third recording medium 130 is not limited to an SD card as long as the manufacturer PC 140 can read data therein. In this embodiment, the first recording medium 2 and the third recording medium 130 are of the same type, but may be of different types.

[0145] The production system 100 uses the second recording medium 120 in the update step S102 for security measures of the encryption key. The second storage unit 121 stores an update program 123 and license information 124 in advance. In this embodiment, the second recording medium 120 is provided to the manufacturer of the first recording medium 2 by an organization involved in the manufacture of the map output device 3. The second storage unit 121 is configured by, for example, a semiconductor memory element such as a flash memory. Note that the second recording medium 120 only needs to store at least the update program 123 in advance, and does not necessarily need to store the license information 124.

[0146] The update program 123 is a program for updating the vehicle specific file 12. As shown in FIG. 6, the update program 123 includes encrypted program data 123a. In this embodiment, the encrypted program data 123a is program data for respectively decrypting or encrypting the vehicle specific file 12 and the usage date file 13. The encrypted program data 123a includes an encryption key. The encryption key included in the encrypted program data 123a is the same as the encryption key pre-stored in the in-vehicle storage unit 32. In this embodiment, the encryption key is a common key.

[0147] In this embodiment, the update program 123 cannot control the manufacturer PC 140 by itself. When the executable file 148 is executed, the update program 123 is read from the second storage unit 121 and stored in the volatile memory 146, and causes the control device 145 to execute processes such as decryption and encryption of the vehicle specific file 12. When the executable file 148 is executed, the update program 123 causes the control device 145 to execute processes such as decryption and encryption of the usage date file 13.

[0148] The encryption key applied to the vehicle specific file 12, the encryption key applied to the usage date file 13, and the encryption key applied to the license file 14 may be different from each other. In this case, the on-board storage unit 32 needs to store in advance the encryption key applied to the vehicle specific file 12, the encryption key applied to the usage date file 13, and the encryption key applied to the license file 14. The encryption program data 123a may be program data for performing at least one of encryption and decryption on the vehicle specific file 12 and the usage date file 13. The update program 123 is configured like a library that is called by other programs to provide some function.

[0149] The encrypted program data 123a is designed to perform an update process in the update step S102 on files that are exactly the same as the vehicle specific file 12 and the usage date file 13 stored in the third storage unit 132. As described above, the vehicle specific file 12 and the usage date file 13 are copied directly from the third recording medium 130 to the first recording medium 2 in the copy step S101. Therefore, if the vehicle specific file 12 or the usage date file 13 copied to the first storage unit 22 in the copy step S101 is rewritten for some reason before the update step S102, the control device 145 may not be able to recognize the vehicle specific file 12 and the usage date file 13, and may not be able to perform processing based on the encrypted program data 123a.

[0150] The second control unit 122 controls the second storage unit 121. The second control unit 122 writes information to the second storage unit 121 and reads information from the second storage unit 121. The second control unit 122 is formed of, for example, a controller.

[0151] In this embodiment, the second recording medium 120 is a USB memory. The second recording medium 120 is electrically connected to the manufacturer's PC 140 via the second interface 142. The second recording medium 120 is not limited to a USB memory as long as the computer can read data. The second recording medium 120 may be an SD card, a microSD card, a nanoSD card, a CD-R, or the like. In this embodiment, the second recording medium 120 is a different type from the first recording medium 2 and the third recording medium 130, but may be the same type as the first recording medium 2 or the third recording medium 130.

[0152] The manufacturer PC 140 is configured so that the first recording medium 2, the second recording medium 120, and the third recording medium 130 can be attached and detached. In this embodiment, the first interface 141 and the third interface 143 are each an SD card interface. The first interface 141 may be an interface other than an SD card interface as long as it can read data from the first recording medium 2. Alternatively, the manufacturer PC 140 may be configured to read and write data from the first recording medium 2, the second recording medium 120, or the third recording medium 130 via another device. In this embodiment, the first interface 141 is configured so that two or more first recording media 2 can be connected simultaneously. The third interface 143 may be an interface other than an SD card interface as long as it can read data from the third recording medium 130. In this embodiment, the second interface 142 is a USB memory interface. The second interface 142 may be an interface other than a USB memory interface as long as it can read data from the second recording medium 120.

[0153] Volatile memory 146 temporarily stores program code being executed by control device 145 and data necessary for this processing. Volatile memory 146 is a main storage device. Volatile memory 146 requires power to hold data. Therefore, when the power supply of manufacturer PC 140 is turned off, all data stored in volatile memory 146 is erased. Volatile memory 146 is configured by, for example, a RAM.

[0154] The non-volatile memory 147 stores data necessary for the control device 145 to execute various processes. The non-volatile memory 147 is an auxiliary storage device. The non-volatile memory 147 does not require power to hold data. The non-volatile memory 147 holds data even when the power supply of the manufacturer PC 140 is turned off. The non-volatile memory 147 is composed of, for example, a semiconductor memory element such as a flash memory, a hard disk, or the like.

[0155] An executable file 148 is prestored in the non-volatile memory 147. The executable file 148 is a program for causing the manufacturer PC 140 to execute processes that do not require an encryption key among the processes executed in the update step S102. The processes that do not require an encryption key in the update step S102 are, for example, a process of reading medium-specific information from the first medium management unit 21, a process of reading the vehicle-specific file 12 and the usage date file 13 from the first storage unit 22, a process of reading the update program 123 from the second storage unit 121, and a process of writing the updated vehicle-specific file 12 and the usage date file 13 back to the first storage unit 22.

[0156] The executable file 148 corresponds to a predetermined condition for reading the medium specifying information from the first medium management unit 21. For example, a predetermined management program corresponding to the first medium management unit 21 is embedded in the executable file 148 so that the medium specifying information can be read from the first medium management unit 21. The executable file 148 is designed to correspond to the first recording medium 2, the vehicle specific file 12, and the usage date file 13 so that the control device 145 can read the vehicle specific file 12 and the usage date file 13 from the first storage unit 22. In this embodiment, the executable file 148 is created by the manufacturer of the first recording medium 2.

[0157] The control device 145 controls the first interface 141, the second interface 142, the third interface 143, and the storage device 144. The control device 145 is, for example, a CPU or an MPU.

[0158] In the copy step S101, the control device 145 controls the third interface 143 to read the map data 11, the vehicle specific file 12, and the use date file 13 from the third storage unit 132. The control device 145 controls the first interface 141 to store the read map data 11, the vehicle specific file 12, and the use date file 13 in two or more first recording media 2, respectively. As a result, the map data 11, the encrypted vehicle specific file 12, and the use date file 13 are stored in two or more first recording media 2, respectively.

[0159] In an update step S102, the control device 145 executes an update process based on the executable file 148 and the update program 123 shown in Fig. 6 and Fig. 8. Specifically, in step S105 in Fig. 8 and Fig. 9, the control device 145 controls the first interface 141 to read the vehicle specific file 12 and the usage date file 13 from the first storage unit 22 based on the executable file 148. The control device 145 also controls the first interface 141 to read the medium specific information from the first medium management unit 21. Note that in Fig. 8 and Fig. 9, the vehicle specific file 12 and the usage date file 13 are simply described as "files 12, 13."

[0160] In step S106, the control device 145 controls the second interface 142 to read the license information 124 from the second storage unit 121 based on the execution file 148. When the control device 145 approves the license information 124, the control device 145 controls the second interface 142 and the volatile memory 146 to read the update program 123 from the second storage unit 121 based on the execution file 148 and store the read update program 123 in the volatile memory 146. Note that, when the license information 124 is not stored in the second recording medium 120, the control device 145 reads the update program 123 from the second storage unit 121 without approval based on the license information 124 in step S106.

[0161] In step S107 of FIG. 9, the control device 145 decrypts the vehicle specific file 12 and the usage date file 13 read in step S105 based on the encrypted program data 123a.

[0162] In step S108, the control device 145 controls the volatile memory 146 to change the medium initial information contained in the vehicle-specific file 12 and the usage date file 13, respectively, to the medium-specific information based on the medium-specific information read in step S105 and the update program 123 read in step S106.

[0163] In step S9, the control device 145 encrypts the vehicle specific file 12 and the use date file 13 based on the encrypted program data 123a. The encryption key used to encrypt the vehicle specific file 12 and the use date file 13 in step S9 may be different from the encryption key used to decrypt the vehicle specific file 12 and the use date file 13 in step S107, as long as it is the same as the encryption key stored in the in-vehicle storage unit 32. If the encryption keys are different between encryption and decryption, the encrypted program data 123a must include two different encryption keys. In this case, the vehicle specific file 12 and the use date file 13 in the third recording medium 130 must be encrypted with the same encryption key as the encryption key used to decrypt the vehicle specific file 12 and the use date file 13 in step S107. The encryption key is not limited to a common key, and may be, for example, a public key or a private key.

[0164] 8 and 9, the control device 145 controls the first interface 141 to write the vehicle specific file 12 and the usage date file 13 encrypted in step S109 to the first recording medium 2 based on the execution file 148.

[0165] In this manner, the control device 145 updates the vehicle specific file 12 and the usage date file 13 stored in the first storage unit 22 in the updating step S102. This enables the production system 100 to produce the first recording medium 2 including the same medium specific information in the first medium management unit 21, the vehicle specific file 12, and the usage date file 13.

[0166] As described above, the production system 100 of this embodiment includes the first recording medium 2, the second recording medium 120, and the manufacturer PC 140. The first recording medium 2 stores the vehicle specific file 12 and the usage date file 13. The second recording medium 120 stores the encrypted program data 123a. The encrypted program data 123a includes an encryption key. The encrypted program data 123a encrypts and decrypts the vehicle specific file 12. The manufacturer PC 140 reads data from the first recording medium 2 and the second recording medium 120. The manufacturer PC 140 stores the encrypted program data 123a read from the second recording medium 120 in the volatile memory 146. The volatile memory 146 can hold data when power is supplied. The manufacturer PC 140 stores the vehicle specific file 12 encrypted with the encrypted program data 123a stored in the volatile memory 146 in the first recording medium 2.

[0167] Since the encrypted program data 123a is stored in the volatile memory 146 and not in the non-volatile memory 147, it is automatically deleted from the storage device 144 when the power supply of the manufacturer PC 140 is turned off. Therefore, the production system 100 can prevent the encrypted program data 123a from being taken out of the manufacturer PC 140 whose power supply is turned off, for example, by a malicious third party. Furthermore, since the second recording medium 120 is configured with a relatively small size such as a USB memory, it can be easily stored in a highly secure location while the update step S102 is not being performed. Therefore, the production system 100 can prevent the encryption key used by the manufacturer PC 140 for encrypting and decrypting the vehicle-specific file 12 from being leaked to the outside.

[0168] In the manufacturing system 100 of this embodiment, the non-volatile memory 147 stores an execution file 148. The execution file 148 corresponds to the encrypted program data 123a. When the execution file 148 is executed, the manufacturer PC 140 reads the encrypted program data 123a from the second recording medium 120 and stores it in the volatile memory 146.

[0169] In the production system 100 of this embodiment, the manufacturer PC 140 acquires the medium identification information from the first recording medium 2 based on the execution file 148. The medium identification information is information for identifying each of the two or more first recording media 2. The manufacturer PC 140 encrypts the vehicle identification file 12 and the usage date file 13, into which the medium identification information has been written, with the encryption program data 123a.

[0170] The executable file 148 corresponds to a predetermined condition for reading the medium-specific information from the first medium management unit 21, and does not include an encryption key. Therefore, the encryption key is not necessary for creating the executable file 148. The encrypted program data 123a includes an encryption key, and does not correspond to a predetermined condition for reading the medium-specific information from the first medium management unit 21. Therefore, the predetermined condition for reading the medium-specific information from the first medium management unit 21 is not necessary for creating the encrypted program data 123a. In this embodiment, the executable file 148 is created by the manufacturer of the first recording medium 2, and the encrypted program data 123a is created by an organization involved in the manufacture of the map output device 3 and provided to the manufacturer of the first recording medium 2, so that the predetermined condition and the encryption key do not need to be shared between different organizations. For this reason, the creation system 100 of this embodiment can prevent the encryption key from leaking to the outside.

[0171] In this embodiment, the production system 100 executes the copy process S101 and the update process S102 using one manufacturer PC 140, but the copy process S101 and the update process S102 may be executed using two different manufacturer PCs 140, respectively.

[0172] <Hardware implementation example> As shown in Fig. 10, the map output device 3 of this embodiment includes an MPU 35a, a ROM (Read Only Memory) 32a, a RAM 32b, an I / O interface 33a, a display 31a, a TCU 36a, a storage device 32c, and an SD host module 34a. The MPU 35a functions as an arithmetic processing device and a control device. The MPU 35a controls the overall operation of the map output device 3 according to various programs. The MPU 35a uses the RAM 32b as a working area and executes various programs stored in the ROM 32a.

[0173] The ROM 32a stores programs and calculation parameters used by the MPU 35a. The RAM 32b temporarily stores programs used by the MPU 35a when it executes control. The RAM 32b also temporarily stores parameters that change as appropriate when the MPU 35a executes control.

[0174] The I / O interface 33a reads data such as mileage information and vehicle identification information from various car navigation sensors and input / output devices provided in the vehicle, and provides the data to the MPU 35a via the RAM 32b.

[0175] The TCU 36 a communicates with the first server 4 .

[0176] The storage device 32c is realized by, for example, a magnetic storage device, a semiconductor storage device, an optical storage device, or a magneto-optical storage device. The magnetic storage device is, for example, a HDD (Hard Disk Drive). The storage device 32c stores the programs and various data executed by the MPU 35a, and various data acquired from the outside.

[0177] The SD host module 34a reads and writes information from and to the inserted first recording medium 2. The SD host module 34a outputs the information read from the first recording medium 2 to the RAM 32b.

[0178] The MPU 35 a, the ROM 32 a, the RAM 32 b, the I / O interface 33 a, the display 31 a, the TCU 36 a, the storage device 32 c, and the SD host module 34 a are connected to one another by a bus 73.

[0179] The MPU 35a, for example, acquires mileage information via the I / O interface 33a and outputs the acquired mileage information to the RAM 32b. When the mileage of the moving object 30 exceeds a predetermined value, the MPU 35a creates the vehicle specific file 12 based on the vehicle specific information. The MPU 35a creates the usage date file 13 in the locking process or map update. When the usage date file 13 is created in the locking process, the MPU 35a generates usage start information based on the GPS signal acquired via the I / O interface 33a. The MPU 35a stores the vehicle specific file 12 and the usage date file 13 in the first storage unit 22 via the SD host module 34a.

[0180] The hardware configurations of the first server 4, the second server 5 and the personal PC 6 are also almost the same as the hardware configuration of the map output device 3, except for the I / O interface 33a and the like.

[0181] <<Variations>> In this embodiment, the moving body 30 is not limited to a vehicle, and may be a ship, an aircraft, or the like. For example, when the moving body 30 is a ship, the map output device 3 executes a locking process when the ship sails beyond a predetermined length. That is, the map output device 3 executes a locking process when the moving body moves beyond a predetermined length. This movement means that the moving body 30 moves by the power possessed by the moving body 30. This movement does not mean that the moving body 30 moves by the power possessed by another moving body 30.

[0182] In this embodiment, the first recording medium 2 and the third recording medium 130 are not limited to SD cards, and may be microSD cards, nanoSD cards, etc. The first recording medium 2 and the third recording medium 130 may be USB (Universal Serial Bus) memories, CD-Rs (Compact Disc Recordable), etc.

[0183] In this embodiment, the map output system 1 is not limited to a configuration in which the personal PC 6 downloads the update map data 11 from the second server 5, and may be configured to download the update map data 11 from the first server 4. In other words, the map output system 1 may not be configured to include the second server 5.

[0184] In this embodiment, the map data 11 stored in the first recording medium 2 may be at least partially encrypted.

[0185] In this embodiment, the map output system 1 may be configured such that the first server 4 and the second server 5 are managed by the same organization.

[0186] In this embodiment, the map output device 3 may be configured to be able to use a first recording medium 2 in which the use date file 13 is not stored. That is, the map output system 1 may be configured such that, among two or more map output devices 3, some of the map output devices 3 use a first recording medium 2 in which the use date file 13 is stored, and the remaining map output devices 3 use a first recording medium 2 in which the use date file 13 is not stored. When the target of the map update is a first recording medium 2 in which the use date file 13 is not stored, the first server 4 receives only the license file 14 as a data file required for the map update from the map output device 3 or the personal PC 6. When granting the update right to a first recording medium 2 in which the use date file 13 is not stored, the first server control unit 43 sets an update deadline based on the version of the map data 11 stored in the first storage unit 22. The update deadline is set to a later date as the map version is newer. When granting the right to update to a first recording medium 2 that does not store a usage date file 13, the first server control unit 43 may set the update deadline to a date on which a specified number of years have passed since a specified date in the year in which the map output device 3 or the personal PC 6 accessed the first server 4. The specified date is, for example, the last day of December. The first server control unit 43 can set the update deadline for a first recording medium 2 that does not store a usage date file 13, regardless of the date on which the first recording medium 2 actually began to be used by the map output device 3. In this modified example, the creation system 100 creates a first recording medium 2 that does not store a usage date file 13, for example, by using a third recording medium 130 that does not store a usage date file 13.

[0187] In this manner, the map output system 1 of this modified example can set the update deadline in the following three ways.

[0188] (1) When the use date file 13 exists and use start information is stored in the use date file 13, the first server control unit 43 sets the renewal deadline based on the use start information. (2) If a usage date file 13 exists and initial usage information is stored in the usage date file 13, the first server control unit 43 sets the update deadline based on the access time from the map output device 3 or the personal PC 6 to the first server 4. (3) If the use date file 13 does not exist, the first server control unit 43 sets the update deadline based on the map version stored in the first recording medium 2.

[0189] The present invention is not limited to the above-described embodiments, and various modifications are possible within the scope of the claims. Embodiments obtained by appropriately combining the technical means disclosed in each modified example are also included in the technical scope of the present invention. [Explanation of symbols]

[0190] 1 Map output system 2 First recording medium 3 Map output device 4 First server 11 Map data 30 Mobile body 34 Connection unit 35 Vehicle control unit

Claims

1. A map output system comprising a map output device mounted on a moving body and outputting map data, and a server communicating with the map output device, The map output device is a connection section to which a recording medium storing the map data is connected; an in-vehicle control unit that controls the connection unit to store in the recording medium usage start information that identifies when the recording medium is connected to the connection unit for the first time or when the moving body has been used beyond a predetermined usage amount; The server, a map output system that sets an update deadline during which the map data stored in the recording medium can be updated based on the use start information;

2. The recording medium stores in advance initial usage information indicating a predetermined character string, The vehicle control unit includes: The map output system according to claim 1, characterized in that when the recording medium is connected to the connection unit for the first time, or when the moving body is used beyond a predetermined usage amount, the initial usage information stored in the recording medium is changed to the start-of-use information.

3. The server, 3. The map output system according to claim 2, wherein for the recording medium on which the start-of-use information is not stored, the update deadline is set based on the date on which the map output device accesses the server.

Images