On-board computer, vehicle management server and computer program

Abstract

To provide a technique for deleting data corresponding to personal information of a user with respect to a multi-functional car navigation device mounted on a service object vehicle of a vehicle sharing service.SOLUTION: An on-vehicle computer includes: data reception means for receiving position data received by a GPS receiver and drive device data of a drive device; data deletion determination means for determining timing to delete personal information of a user in a multi-functional car navigation device based on the data received by the data reception means; and data deletion instruction transmission means for outputting an instruction to delete the personal information of the user to the multi-functional car navigation device when the data deletion determination means determines that the timing is the one to delete the personal information of the user.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present invention relates to an information processing technique for erasing data relating to a user that has been input into a car navigation device installed in a car sharing or rental car. [Background technology]

[0002] In addition to rental car services, car sharing services in which multiple users share multiple vehicles are becoming popular. Hereinafter, the system that provides the rental car service and the system that provides the car sharing service will be collectively referred to as the "vehicle sharing service system," and the vehicles used in the vehicle sharing service will be referred to as the "service target vehicles."

[0003] Users of car sharing services register as members and go directly to a parking lot where a car is reserved for car sharing, or use a reservation system by contacting the parking lot in advance by mobile phone or personal computer about the time period when the car will be used. Rental car services are also increasingly adopting membership registration systems in order to retain customers and improve the service they provide to users.

[0004] In vehicle sharing service systems, in order to improve convenience for users, it has become common for vehicles that receive the service to be equipped with a GPS receiver that can identify the vehicle's location by receiving radio waves from GPS (Global Position System) satellites, and a car navigation device that uses the location data obtained by the GPS receiver and pre-prepared map information to display the vehicle's location on a map and provide route guidance.

[0005] The car navigation device installed in the vehicle to which the service is provided is a "multi-function car navigation device" that can also receive and transmit data via a communication in-vehicle device that can communicate two-way with a data management server in the vehicle sharing service system so that data collection for vehicle management is possible. In recent years, a function that allows communication with a communication terminal related to the user has been added, making the device even more multifunctional.

[0006] In a vehicle sharing service system that employs a multi-function car navigation device, in order to improve convenience for users, for example, when a user reserves a service-relevant vehicle, the destination at the time of use is registered, and the destination data is pre-entered into the multi-function car navigation device installed in the vehicle when the user uses the service-relevant vehicle. Once a user gets into a vehicle that is eligible for the service, the user can start driving the vehicle without inputting destination data into the car navigation device.

[0007] Furthermore, a technique such as that disclosed in Patent Document 1 is also provided. In other words, when a vehicle that is eligible for the service approaches a destination, an electronic coupon that can be used in the vicinity of the destination is transmitted. This type of service is possible only because the vehicle is equipped with the multi-function car navigation device described above.

[0008] Now, the car navigation device itself has also been improving in usability for users. For example, devices that record search results and destination histories are becoming common. Car navigation devices installed in private cars are often shared by multiple people, mainly family members. A representative technique for protecting privacy among family members is to provide a password entry screen and select users.

[0009] However, since there are inconveniences such as having to remember a password and what to do if the password is forgotten, a technique such as that disclosed in Patent Document 2 has been proposed. That is, the technology is "a display device (car navigation device) that displays history, comprising: a storage means for storing history data; a display means for displaying a predetermined number of histories corresponding to new history data among the history data stored in the storage means; an erasing means for erasing the history data displayed by the display means; and a supplementing means for supplementing the history data with another history so as to fill in the blank portions of the history display erased by the erasing means." This technology makes it possible to maintain the intended display layout even if the usage history of the car navigation device is partially deleted. [Prior art documents] [Patent documents]

[0010] [Patent Document 1] Patent No. 6601759 [Patent Document 2] JP 2007-334454 A DISCLOSURE OF THEINVENTION [Problem to be solved by the invention]

[0011] The technology disclosed in Patent Document 2 is based on the premise that a vehicle equipped with a car navigation device is shared by a small number of people (for example, only family members). Therefore, when a vehicle equipped with a car navigation device is a vehicle that is a target vehicle for the service, protection of personal information is insufficient. For example, destination data entered by a user into a multifunction car navigation device to provide route guidance, destination data during route guidance, destination history data when multiple destinations are set, trajectory (route) data traveled by the vehicle, keywords entered by the user to search for a destination, and registered location data entered by the user as a registered location may all be considered personal information in a broad sense.

[0012] In addition, in car sharing and rental services using vehicles covered by the service, functions of multi-function car navigation devices are being added one after another to improve the service. For example, by performing short-distance communication with a user's smartphone, the multi-function car navigation device can receive music data specified by the smartphone and output the music data from the speaker installed in the vehicle covered by the service.

[0013] When a user uses the device in the manner described above, the smartphone's device data, phone book data, and other data may be entered into the multifunction car navigation device, and this data may remain after the user has finished using the device.

[0014] In order to provide the vehicle sharing service, a data management server is required to transmit and receive data to and from all service target vehicles. The data management server transmits data for managing all service target vehicles to the service target vehicles and receives data from the service target vehicles. The received data among the data to be transmitted and received includes data stored in the multi-function car navigation device.

[0015] It has become clear that if a method of erasing data from the multi-function car navigation device of each service target vehicle is adopted, there is a risk that the data to be collected will also be erased. Therefore, a method of erasing data from the multi-function car navigation device installed in each service target vehicle alone while cutting off communication with the data management server cannot be adopted. In other words, a technology that allows a user to erase data entered into the multi-function car navigation device when the user finishes using a certain service target vehicle, or that automatically erases data when it detects that the user has finished using the service target vehicle, or a technology such as that disclosed in Patent Document 2 cannot be adopted.

[0016] The problem that the present invention aims to solve is to provide a technology that erases data that corresponds to a user's personal information from a multi-function car navigation device installed in a vehicle that is the target of a vehicle sharing service, without interfering with data collection by the vehicle management server.

[0017] In addition, the present invention provides technology that erases data that corresponds to the user's personal information from a multi-function car navigation device without interfering with data collection in the vehicle management server, even if the vehicle to be serviced is stored in an environment where wireless communication via public telephone lines cannot be secured (for example, an underground parking lot of a building). [Means for solving the problem]

[0018] In order to solve the above-mentioned problem, when the return of the vehicle to be serviced by the user is confirmed, data related to the user is erased from the multi-function car navigation device installed in the vehicle to be serviced. The above-mentioned confirmation may be performed by an on-board computer installed in the vehicle to be serviced, or may be performed by a vehicle management server that manages the vehicle to be serviced.

[0019] (First Invention) The first invention relates to an on-board computer installed in a service target vehicle used in a vehicle sharing service (see FIG. 3). The vehicle to be serviced is equipped with a GPS receiver that receives location data from GPS satellites, a multi-function car navigation device that outputs the location data for the user of the vehicle to be serviced, and a drive device that drives the vehicle to be serviced. the on-board computer includes a data receiving means for receiving the position data received by the GPS receiver and the drive device data of the drive device; a data erasure determination means for determining a timing for erasing the personal information of the user in the multi-function car navigation device based on the data received by the data receiving means; a data erasure command transmission means for outputting a command to erase the personal information of the user to the multifunction car navigation device when the data erasure determination means determines that it is time to erase the personal information of the user; Equipped with. The data erasure determination means determines that it is time to erase the personal information of the user after determining that the vehicle to be serviced has departed from the departure determination area set at the departure point and has determined that the vehicle to be serviced has entered the return determination area set at the return point (see S3 and S5 in Figure 2, and similarly for S13 and S15 in Figure 6).

[0020] (Terminology) "Vehicle sharing service" refers to both a service that manages and operates car sharing, and a car rental service. "Vehicle subject to the service" refers to a "shared car" in the case of car sharing, and a "rented vehicle (rental car)" in the case of a car rental service. A "multi-function car navigation device" has a car navigation function, and can also receive and transmit data via a communication device capable of two-way communication with a data management server, and can communicate with a communication terminal related to the user.

[0021] In the case of car sharing, a "user" is generally a member user who has registered as a member in advance. The "drive system" refers to the engine in a gasoline vehicle, and the engine and main switch in an electric or hybrid vehicle.

[0022] "Personal information" may include personal information protected by the Personal Information Protection Act, as well as data entered by the user into a multifunction car navigation device, such as destination data, destination history data, trajectory (route) data, keywords entered by the user to search for a destination, registered location data, smartphone device data, and phone book data.

[0023] The "point from which the serviced vehicle departs" and the "point to which the serviced vehicle is returned" are often the same, but may be different. The "GPS receiver" may be a GPS receiver attached to a multifunction car navigation device (integrated with a multifunction car navigation device), or a GPS receiver integrated with an on-board computer (pre-installed in the on-board computer).

[0024] (action) The data receiving means receives the position data received by the GPS receiver and the drive device data of the drive device. Based on the data received by the data receiving means, the data erasure determination means determines the timing to erase the personal information of the user in the multi-function car navigation device. When the data erasure determination means determines that it is time to erase the personal information of the user, the data erasure command transmission means outputs a command to the multifunction car navigation device to erase the personal information of the user.

[0025] The data erasure determination means determines that it is time to erase the personal information of the user after determining that the vehicle to be serviced has departed from a departure determination area set at the departure point and when it determines that the vehicle to be serviced has entered a return determination area set at the return point.

[0026] Users can use the data they have input into their multi-function car navigation device until just before returning the vehicle.In addition, the data they have input will be deleted, so users can use the multi-function car navigation device with peace of mind.

[0027] (Variation 1 of the first invention) In the first aspect of the present invention, it is preferable that the departure determination area (R1) is set to be larger than the return determination area (R2) (see FIG. 4). The departure judgment area (R1) and the return judgment area (R2) are set based on the characteristics of the departure point or return point of the vehicle to be serviced. As described later, they may be set to specific values, or the optimal values ​​may be searched for by machine learning a predetermined number of times, or they may be made variable values ​​by continuous learning.

[0028] (action) Immediately after the user starts using the service vehicle, the GPS receiver of the service vehicle starts receiving radio waves from GPS satellites, but the accuracy of the location data is low immediately after the reception starts. Therefore, the multi-function car navigation device may display that the service vehicle has left the starting point even though it has not started from the starting point. In this case, the multi-function car navigation device may determine that the vehicle has returned to the starting point after starting. To avoid such inconvenience, the departure judgment area is set to be about 3 to 5 times larger than the return judgment area. This makes it possible to reduce the number of cases where the timing of erasing the user's personal information is incorrect to almost zero. Specifically, the return judgment area will be a radius of 30 to 50 meters, and the departure judgment area will be a radius of 150 to 250 meters.

[0029] (Variation 2 of the first invention) The first invention is more preferably formed as follows. That is, the vehicle management system includes a data transmission means for transmitting data to a vehicle management server that manages the vehicle to be serviced, The data transmission means transmits the position data, the drive device data, and the data erase command (see FIG. 3).

[0030] (action) The vehicle management server receives the position data, drive unit data and data deletion command of the vehicle to be serviced, thereby enabling the vehicle to be managed in a detailed manner.

[0031] (Variation 3 of the first invention) It is more preferable that the variation 1 in the first invention is formed as follows. That is, when the departure point of the service target vehicle cannot receive GPS radio waves, the departure determination area (S1) is set to a donut-shaped area from a point where GPS radio waves can be received (see FIG. 5).

[0032] "When GPS signals cannot be received from the starting point of the vehicle to be serviced" refers, for example, to an underground parking lot in a building or a mechanical parking lot.

[0033] (action) Even if the departure point of the vehicle being serviced is unable to receive GPS signals, this will help to prevent mistakes in erasing the user's personal information at the correct time.

[0034] (Variation 4 of the first invention) The first invention is more preferably formed as follows. That is, a deletion confirmation means is provided for confirming whether or not the personal information has been deleted from the multi-function car navigation device when the command to delete the personal information is output by the data deletion command transmission means, If the deletion confirmation means confirms that the personal information that should have been deleted has not been deleted, the data deletion command is output again by the data deletion command sending means, on the condition that the data receiving means receives the drive unit data and thereby confirms that the vehicle to be serviced has been driven again (see Figures 9 and 10).

[0035] (action) The erasure confirmation means confirms whether or not the personal information has been erased from the multi-function car navigation device by outputting a command to erase the personal information from the data erasure command transmission means. If it is confirmed that the personal information to be erased has not been erased, the data erasure command is output again by the data erasure command transmitting means under the following conditions: That is, the condition is that the data receiving means receives drive unit data to confirm that the vehicle to be serviced has been driven again. In most cases, this condition is met when the next user after the current user starts using the vehicle to be serviced. At this point in time, the personal information to be erased (at this point in time, the personal information of the previous user) is erased, and the next user will not be able to view or obtain the personal information of the previous user.

[0036] (Second Invention) A second invention relates to a computer program for controlling an on-board computer installed in a service target vehicle used in a vehicle sharing service (see FIG. 3). The vehicle to be serviced is equipped with a GPS receiver that receives location data from GPS satellites, a multi-function car navigation device that outputs the location data for the user of the vehicle to be serviced, and a drive device that drives the vehicle to be serviced. The computer program for controlling the vehicle-mounted computer includes a data receiving procedure for receiving position data received by the GPS receiver and drive device data of the drive device; a data erasure decision step for deciding a timing for erasing the personal information of the user in the multifunction car navigation device based on the data received in the data reception step; a data erasure command transmission step of outputting a command to the multifunction car navigation device to erase the personal information of the user when it is determined in the data erasure determination step that it is time to erase the personal information of the user; The computer program is executed by the vehicle-mounted computer. The data deletion determination procedure determines that it is time to delete the user's personal information after it has been determined that the vehicle to be serviced has departed from a departure determination area set at the departure point, and has entered a return determination area set at the return point.

[0037] (Variation 1 of the second invention) It is preferable that the departure determination area (R1) in the second invention is set larger than the return determination area (R2) (see FIG. 4).

[0038] (Variation 2 of the second invention) The second invention is more preferably formed as follows. That is, a driving device data transmission procedure for transmitting the driving device data to a vehicle management server that manages the vehicle to be serviced; a location data transmission step of transmitting the location data to the vehicle management server; a data erasure command transmission step indicating that the data erasure command has been transmitted to the multifunction car navigation device; The above is executed by the onboard computer (see Figure 3).

[0039] (Variation 3 of the second invention) It is more preferable that the variation 1 in the second invention is formed as follows. That is, when the departure point of the service target vehicle cannot receive GPS radio waves, the departure determination area (S1) is set to a donut-shaped area from a point where GPS radio waves can be received (see FIG. 5).

[0040] (Variation 4 of the second invention) The second invention may be formed as follows. That is, an erasure confirmation step of confirming whether or not the personal information has been erased from the multi-function car navigation device by outputting a command to erase the personal information by the data erasure command transmission step; a data erasure command retransmission procedure for outputting a data erasure command again when it is confirmed by the erasure confirmation procedure that the personal information to be erased has not been erased; The vehicle-mounted computer is caused to execute the above steps, The data erase command retransmission procedure outputs a data erase command when the drive data of the drive is received (see Figs. 9 and 10).

[0041] (Variation 5 of the second invention) The second invention may be formed as follows. That is, a next user detection step of detecting that a user following the above user has started using the service target vehicle; a data erasure command retransmission means for re-outputting a command to erase the personal information of the previous user when it is detected that the next user has started using the vehicle to be serviced by the next user through the next user detection procedure; The above is executed by the on-board computer (see Figs. 11 and 12).

[0042] In this variation, the data erase command is sent twice, regardless of whether the erase confirmation procedure has been passed or not. This reduces the probability that the previous user's personal information will remain in the multifunction car navigation device due to the second data erase command, even if the first data erase command results in a transmission error or an erase error by the multifunction car navigation device.

[0043] (Third Invention) The third invention relates to a vehicle management server that manages service target vehicles used in a vehicle sharing service by two-way communication with the service target vehicles (see FIG. 7). That is, in the first invention, data erasure from a multi-function car navigation device that was completed in the service target vehicles in the first invention is made the management server that manages the service target vehicles take charge of this.

[0044] The vehicle to be serviced is equipped with a GPS receiver that receives location data from GPS satellites, a multi-function car navigation device that outputs the location data for the user of the vehicle to be serviced, a driving device that drives the vehicle to be serviced, and an on-board computer that transmits and receives data to and from the vehicle management server. A vehicle management server according to a third aspect of the present invention comprises: A drive unit data receiving means for receiving drive unit data related to the drive unit of the service target vehicle; a position data receiving means for continuously receiving position data via the GPS receiver in the service target vehicle; a departure area determination means for determining whether or not the vehicle to be serviced has left the departure area based on a predetermined departure area and the position data; a return area determination means for determining whether the service target vehicle has entered a return area based on a predetermined return area and the position data when the departure area determination means determines that the service target vehicle has left the departure area; a car navigation data deletion command sending means for sending a data deletion command to the multifunction car navigation device in the vehicle to be serviced when the return area determining means determines that the vehicle to be serviced has entered the return area, the data deletion command being a command to delete user data related to the user of the vehicle to be serviced; Equipped with.

[0045] (action) A driving device data receiving means receives driving device data relating to a driving device of a service target vehicle. In addition, a position data receiving means receives position data acquired by the service target vehicle via a GPS receiver. Based on a predetermined departure area and the received position data, a departure area determining means determines whether or not the service target vehicle has left the departure area. Next, when the departure area determination means determines that the service target vehicle has left the departure area, the return area determination means determines whether the service target vehicle has entered the return area based on a predetermined return area and continuously received position data. When the return area determination means determines that the vehicle to be serviced has entered the return area, the car navigation data erasure command sending means sends a data erasure command to the multifunction car navigation device in the vehicle to be serviced, which is a command to erase user data related to the user of the vehicle to be serviced.

[0046] Users can use the data they have input into their multi-function car navigation device until just before returning the vehicle.In addition, the data they have input will be deleted, so users can use the multi-function car navigation device with peace of mind.

[0047] (Variation 1 of the third invention) The third invention may be formed as follows. That is, it is preferable to set the departure determination area (R1) larger than the return determination area (R2) (see FIG. 4).

[0048] (Variation 2 of the third invention) It is more preferable that the variation 1 in the third invention is formed as follows. That is, when the departure point of the service target vehicle cannot receive GPS radio waves, the departure determination area (S1) is set to a donut-shaped area from a point where GPS radio waves can be received (see FIG. 5).

[0049] (Fourth Invention) A fourth aspect of the present invention relates to a computer program for controlling the vehicle management server according to the third aspect of the present invention. That is, a computer program for controlling a vehicle management server that manages a vehicle to be serviced, the vehicle management server comprising a GPS receiver that receives position data from a GPS satellite, a multi-function car navigation device that outputs the position data for a user of the vehicle to be serviced, a drive device that drives the vehicle to be serviced, and an on-board computer that transmits and receives data to and from the vehicle management server, A drive unit data receiving procedure for receiving drive unit data related to the drive unit of the service target vehicle; a location data receiving step of continuously receiving location data via the GPS receiver in the service target vehicle; a departure area determination step for determining whether the vehicle to be serviced has left the departure area based on a predetermined departure area and the position data; a return area determination step of determining whether the service target vehicle has entered a return area based on a predetermined return area and the position data when the service target vehicle has left the departure area in the departure area determination step; a car navigation data deletion command transmission step of transmitting a data deletion command to the multifunction car navigation device in the vehicle to be serviced when it is determined in the return area determination step that the vehicle to be serviced has entered the return area, the data deletion command being a command to delete user data related to the user of the vehicle to be serviced; The vehicle management server executes the above-mentioned computer program.

[0050] (Variation 1 of the fourth invention) In the fourth aspect of the present invention, it is preferable that the departure determination area (R1) is set larger than the return determination area (R2) (see FIG. 4).

[0051] (Variation 2 of the fourth invention) It is more preferable that the variation 1 in the fourth aspect of the invention is formed as follows. That is, when the departure point of the service target vehicle cannot receive GPS radio waves, the departure determination area (T1) is set to a donut-shaped area from a point where GPS radio waves can be received (see FIG. 5).

[0052] The computer programs according to the second and fourth aspects of the present invention may be provided by being stored in a recording medium. Here, a "recording medium" refers to a medium that can carry a program that does not occupy space by itself, such as a flexible disk, a hard disk, a CD-R, a CD-RW, an MO (magneto-optical disk), a DVD-R, a DVD-RW, or a flash memory. It is also possible to transmit the program according to the present invention from a computer storing the program to other terminal means via a communication line. Effect of the Invention

[0053] According to the first and second inventions, it is possible to provide an in-vehicle computer and a computer program that can erase data that corresponds to a user's personal information from a multi-function car navigation device installed in a vehicle that is the target of a vehicle sharing service, without interfering with the collection of necessary data by the vehicle management server. According to the third and fourth inventions, it has become possible to provide a vehicle management server and a computer program that can erase data that corresponds to a user's personal information from a multi-function car navigation device installed in a vehicle that is the target of a vehicle sharing service, without interfering with the collection of necessary data by the vehicle management server. [Brief description of the drawings]

[0054] [Figure 1] FIG. 2 is a conceptual diagram showing a hardware configuration constituting the present invention. [Diagram 2] 10 is a flowchart showing a procedure for deleting personal information of a user from the multifunction car navigation device. [Diagram 3] 13 is a block diagram showing a case where an on-board computer installed in a service target vehicle is operated to erase personal information of a user from a multi-function car navigation device. [Figure 4] FIG. 13 is a conceptual diagram showing a departure determination area and a return determination area. [Diagram 5]This is a conceptual diagram showing a departure determination area when the starting point is a mechanical parking lot where GPS satellite signals cannot reach. [Figure 6] 11 is a flowchart showing a procedure for erasing personal information of a user from a multifunction car navigation device in a case where data erasure is possible only while the drive device is activated. [Figure 7] 11 is a block diagram showing a case where the vehicle management server operates and commands to erase personal information of a user from the multifunction car navigation device. FIG. [Figure 8] 11 is a block diagram showing a case where, when the multifunction car navigation device receives and processes position data from a GPS receiver, the in-vehicle computer operates to erase personal information of the user from the multifunction car navigation device. FIG. [Figure 9] 10 is a flowchart showing a procedure for increasing the reliability of data erasure. [Figure 10] FIG. 11 is a block diagram showing a configuration for improving the reliability of data erasure. [Figure 11] 13 is a flowchart showing another procedure for increasing the reliability of data erasure. [Figure 12] 13 is a flowchart showing another procedure for increasing the reliability of data erasure. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0055] The present invention will be described below based on the embodiments, with reference to the drawings shown in Figs. In the following embodiment, a car sharing service will be described as a vehicle sharing service.

[0056] In order to use the car sharing described in this embodiment, for the convenience of management and operation, it is necessary to first complete member registration. In other words, all "vehicle users" and "users" who can receive the services described in the following embodiment must complete member registration. Although not shown in the figure, a member who can use a vehicle that is eligible for service sends reservation data to the vehicle management server using a PC or smartphone.

[0057] (Figure 1) FIG. 1 shows the relationship between a vehicle management server and vehicles that are subject to service and are managed by the vehicle management server. The vehicle to be serviced is equipped with a drive unit for driving the vehicle, an on-board computer for transmitting data to and from the drive unit, and a GPS receiver for receiving radio waves from GPS satellites. The on-board computer communicates bidirectionally with the multi-function car navigation device. In the figure, a GPS receiver, a drive unit, an on-board computer, and a multi-function car navigation device are shown as a group of on-board devices.

[0058] The vehicle-mounted computer communicates bidirectionally with the vehicle management server via a communication network. Although not shown in the figure, the vehicle management server includes a membership database that stores attribute information about the members mentioned above and data related to usage fees, as well as a vehicle management database that stores data such as shared car usage status and reservation status.

[0059] The reservation data transmitted from the communication terminal related to the member user is received by the reservation data receiving means of the car sharing management server, and the reservation possibility determining means determines whether or not the reservation is possible using the member database and the vehicle management database. Then, the reservation possibility output means returns reservation possibility data regarding whether or not the reservation is possible to the communication terminal.

[0060] (Figure 2) The procedure for deleting data related to personal information of a user acquired by the multi-function car navigation device will be described with reference to FIG. First, when a user gets into a vehicle that is the subject of the service and starts the drive unit, the on-board computer receives data indicating that the drive unit has started. The on-board computer then transmits the data to the vehicle management server, thereby starting communication between the vehicle management server and the on-board computer (S1).

[0061] Meanwhile, the GPS receiver of the in-vehicle device group receives radio waves from GPS satellites, and the acquisition of location data also begins (S2). With the objective of erasing data related to personal information, the purpose of acquiring this location data is to confirm that the vehicle to be serviced has departed.

[0062] By comparing the acquired position data with a preset departure judgment area, the on-board computer determines whether the service target vehicle has left the departure judgment area (S3). The "departure judgment area" will be described later with reference to FIG. 4. If it is determined that the vehicle has not left the departure determination area, reception of the position data is repeated.

[0063] If it is determined that the vehicle has left the departure determination area, the acquisition of location data continues (S4). Then, the on-board computer determines whether the vehicle to be serviced has entered a return determination area (S5). The "return determination area" will also be described later with reference to FIG. 4. If it is determined that the vehicle is not within the return determination area, reception of the location data is repeated.

[0064] When it is determined that the vehicle to be serviced has entered the return determination area, the on-board computer receives drive unit data from the drive unit to confirm that the drive unit has been stopped (S6).Then, the car navigation device transmits a command to the multi-function car navigation device to erase data related to the user's personal information, and the multi-function car navigation device erases the data (S7).

[0065] Since the vehicle to be serviced has entered the return judgment area and the drive mechanism has been stopped, the user will (should) finish using the vehicle to be serviced shortly. When the deletion of data related to the user's personal information in the multi-function car navigation device is completed, preparation for the next user begins (S8).

[0066] In addition, in the above-mentioned S2, immediately after the start of communication, the calculated position data often differs greatly from the actual position due to the effect of correction calculations based on radio waves received from multiple GPS satellites. This can be up to several hundred meters. For this reason, the departure judgment area is set wider than the return judgment area and is recorded in the memory of the on-board computer.

[0067] (Figure 3) Figure 3 shows in a block diagram the types of data transmitted and received by the in-vehicle devices of vehicles covered by the service before erasing data related to the user's personal information in the multifunction car navigation device, along with the functions (each means) of the in-vehicle computer.

[0068] The data receiving means of the on-board computer receives the position data from the GPS receiver and the drive device data from the drive device, and the data erasure decision means determines the timing for data erasure based on the algorithm shown in Fig. 2. When the data erasure decision means determines the timing for erasure, the data erasure command sending means sends a data erasure command to the multi-function car navigation device.

[0069] The on-board computer frequently transmits drive unit data and position data to the vehicle management server via the data transmission means, and also transmits the data deletion command to the vehicle management server when a data deletion command is issued. In the vehicle management server, the driving device data receiving means, the vehicle position data receiving means, and the data deletion command receiving means receive the respective data, and store them in the vehicle management database.

[0070] (Figure 4) FIG. 4(a) shows that a departure determination area is set with a radius R1 of 200 meters from the service station where the service target vehicle is rented to the user. FIG. 4(b) shows that the return judgment area is set to a radius R2 of 40 meters from the service station where the user returns the vehicle to be serviced. In addition, for both R1 and R2, the optimal values ​​may be searched for by machine learning a predetermined number of times, or they may be variable values ​​that are continuously learned.

[0071] The departure judgment area is set larger than the return judgment area because, whereas the error is large immediately after the GPS receiver starts receiving radio waves from the GPS satellites, as the vehicle approaches the service station to be returned, the error is small because the GPS receiver is receiving radio waves continuously.

[0072] The service station where the user rents the vehicle to be serviced is often the same as the service station where the user returns the vehicle, but they may be different. The size of the departure judgment area and the return judgment area is not limited to the aforementioned values ​​of 200 meters and 40 meters in radius, but may be determined taking into consideration the location conditions of each service station and the condition of radio wave reception from GPS satellites.

[0073] (Figure 5) Figure 5 shows how the departure determination area is determined when the service station is a mechanical parking lot and therefore the GPS receiver installed in the vehicle being serviced cannot receive radio waves (or the reception sensitivity is low) even when the engine is started.

[0074] Specifically, the departure determination area is set to a donut-shaped area excluding areas where the GPS receiver cannot receive radio waves (or where the reception sensitivity is low). In other words, T1 is set to 200 meters from the area where the GPS receiver cannot receive radio waves. FIG. 5 shows an example of a departure determination area, but in the case of a return determination area, it can be set to an area smaller than S1.

[0075] (Figure 6) FIG. 6 shows an algorithm to be adopted in a vehicle type that cannot be processed by the processing procedure shown in FIG. That is, there is a type of vehicle in which the multifunction car navigation device only operates when the drive unit is in operation, and in the case of such a vehicle, the processing procedure shown in FIG. 2 is to erase data only after confirming that the drive unit has stopped.

[0076] The processing procedure in Fig. 6 from S11 to S15 is the same as S1 to S5 in Fig. 2, and therefore the description thereof will be omitted. When it is determined that the vehicle to be serviced has entered the return judgment area, the on-board computer determines that it is time to erase the data in the multifunction car navigation device, and outputs a data erasure command to the multifunction car navigation device. The data is then erased in the multifunction car navigation device (S16). After that, it is confirmed that the drive device has stopped (and at the same time, the multifunction car navigation device has stopped) (S17). Then, preparations for the next user are started (S18).

[0077] (Figure 7) FIG. 7 is a block diagram showing a case where a vehicle management server controls the timing of erasing data related to personal information of a user in a multifunction car navigation device.

[0078] The vehicle management server includes a departure area determination means for determining whether the vehicle to be serviced has left the departure area by acquiring drive unit data and position data via the vehicle-mounted computer of the vehicle to be serviced. After judging that the departure is complete, the return area judgment means judges whether the vehicle to be serviced has entered the return judgment area by continuing to acquire position data. If it is judged that the vehicle has entered the return area, it judges that it is time to issue a car navigation data deletion command, and transmits the car navigation data deletion command to the in-vehicle computer by the car navigation data deletion command transmission means.

[0079] When the car navigation data erase command receiving means in the on-board computer receives the data erase command, it outputs the data erase command to the multifunction car navigation device, causing the multifunction car navigation device to erase the data.

[0080] When data erasure is performed in the multifunction car navigation device for each service target vehicle as shown in FIG. 3, the load on the vehicle management server is small, but it is necessary to install a computer program in the on-board computer and check its operation for each service target vehicle. When data erasure is performed in a multifunction car navigation device under the management of the vehicle management server shown in FIG. 7, there is no need to set up each vehicle to be serviced, but the load on the vehicle management server increases. Therefore, depending on the number of vehicles to be serviced (the scale of the service business), one of the above two patterns is selected or combined. If complete data erasure is required, both of the two patterns may be implemented.

[0081] (Figure 8) The handling of position data in Figure 8 is slightly different from that shown in Figure 3. That is, the position data received by the GPS receiver is sent to the multi-function car navigation device instead of to the on-board computer, and the on-board computer receives the position data processed by the multi-function car navigation device, which is different from the case shown in Figure 3.

[0082] In cases where the on-board computer does not have a GPS receiver, or in cases where the on-board computer has a GPS receiver but cannot use the position data received by the GPS receiver, a configuration such as that shown in FIG. 8 is adopted.

[0083] (Fig. 9) FIG. 9 is a flowchart illustrating an embodiment including a step (S28) of checking whether data erasure of personal information to be erased has been successful, and a step (S30) of performing data erasure again if data erasure has not been successful.

[0084] If the data erasure is not successful ("No" in S28), the system detects when the next user drives the drive unit of the vehicle to be serviced, and outputs the data erasure command again at that time (S30). This makes it possible to minimize errors in erasing data that should be erased. The other steps are the same as those in the flowchart shown in FIG. 2, and therefore the description thereof will be omitted.

[0085] (Figure 10) FIG. 10 is a block diagram showing the functions (means) of the on-board computer for implementing the flowchart shown in FIG. The difference with Fig. 3 is that it is provided with an erasure confirmation means, which verifies the multifunction car navigation device and verifies whether the data to be erased has been erased (data erasure confirmation).

[0086] When the data deletion is confirmed, a data deletion confirmation is transmitted to the vehicle management server via the data transmission means. If data deletion cannot be confirmed, the data deletion command is output again to the multi-function car navigation device via the data deletion command transmitting means (the portion indicated by the dashed line in the figure).

[0087] (Fig. 11) FIG. 11 is a flowchart for implementing the complete data erasure shown in FIG. 9 and FIG. 10 in a different procedure. In other words, there is no deletion confirmation means (confirmation step = S28) for confirming whether or not the user's personal information has been deleted, and when the next user begins to use the device, a data deletion command is sent again to the multifunction car navigation device (S40).

[0088] Even if the user's personal information is erased in S37 but the data erasure fails, the data erasure command is issued again when the next user begins using the service-covered vehicle, thereby increasing the certainty that the data will be erased before the next user sees the previous user's personal information.

[0089] (Fig. 12) FIG. 12 is a flow chart for implementing complete data erasure using a different procedure when the procedure shown in FIG. 6 is adopted. In this case, too, similarly to the procedure shown in FIG. 11, when the next user starts to use the device, a data deletion command is again transmitted to the multifunction car navigation device (S50).

[0090] The procedure and configuration of double erasure to achieve complete data erasure have been explained in Figures 9 to 12. As shown in Figure 10, it has been explained that double erasure is executed on the vehicle-mounted computer side. However, even if the vehicle management server sends a data erasure command twice, double erasure can be performed to achieve complete data erasure (not shown).

[0091] According to the embodiments described above, an in-vehicle computer, a vehicle management server, and a computer program can be provided that can erase data that corresponds to a user's personal information from a multi-function car navigation device installed in a vehicle that is the target of a vehicle sharing service without interfering with the collection of necessary data by the vehicle management server. [Industrial Applicability]

[0092] The present invention has applicability in the service industry that manages and operates car sharing or rental cars, the information and communications service industry that supports the realization of car sharing or rental cars, the manufacturing industry of in-vehicle computers and multi-function car navigation devices, the software industry that creates computer software for in-vehicle computers and vehicle management servers, the manufacturing industry of parking lot equipment, and the like.

Claims

1. An on-board computer installed in a service target vehicle used in a vehicle sharing service, The vehicle to be serviced is equipped with a GPS receiver for receiving position data from a GPS satellite, a multi-function car navigation device for outputting the position data, and a drive device for driving the vehicle to be serviced, the on-board computer includes a data receiving means for receiving the position data received by the GPS receiver and the drive device data of the drive device; a data erasure determination means for determining a timing for erasing personal information of a user in the multi-function car navigation device based on the data received by the data receiving means; a data erasure command transmission means for outputting a data erasure command for erasing the user's personal information to the multifunction car navigation device when the data erasure determination means determines that it is time to erase the user's personal information; Equipped with The data erasure determination means determines that it is time to erase the personal information of the user when it has determined that the service target vehicle has departed from a departure determination area set at the departure point and has entered a return determination area set at the return point, and The on-board computer is configured so that the departure determination area is set to be larger than the return determination area.

2. a data transmission means for transmitting data to a vehicle management server that manages the vehicle to be serviced; The data transmission means transmits the position data, the drive device data, and the data erase command. The vehicle-mounted computer according to claim 1 .

3. In the case where the departure point of the service target vehicle cannot receive GPS signals, the departure judgment area is a donut-shaped area from the point where GPS signals can be received. The vehicle-mounted computer according to claim 1 .

4. a deletion confirmation means for confirming whether or not the personal information has been deleted from the multifunction car navigation device when the command to delete the personal information is output by the data deletion command transmission means, When the deletion confirmation means confirms that the personal information to be deleted has not been deleted, the data deletion command is output again by the data deletion command transmission means on the condition that the data receiving means receives the drive device data and confirms that the vehicle to be serviced has been driven again.

4. The vehicle-mounted computer according to claim 1.

5. A computer program for controlling an on-board computer installed in a service target vehicle used in a vehicle sharing service, The vehicle to be serviced is provided with a GPS receiver for receiving position data from a GPS satellite, a multi-function car navigation device for outputting the position data for a user of the vehicle to be serviced, and a drive device for driving the vehicle to be serviced; The computer program for controlling the vehicle-mounted computer includes a data receiving procedure for receiving position data received by the GPS receiver and drive device data of the drive device; a data erasure decision step for deciding a timing for erasing the personal information of the user in the multifunction car navigation device based on the data received in the data reception step; a data erasure command transmission step of outputting a command to the multifunction car navigation device to erase the personal information of the user when it is determined in the data erasure determination step that it is time to erase the personal information of the user; The vehicle-mounted computer is caused to execute the above steps, The data deletion determination procedure is to determine that it is time to delete the personal information of the user when it is determined that the vehicle to be serviced has departed from a departure determination area set at the departure point and that the vehicle to be serviced has entered a return determination area set at the return point, The computer program is configured so that the departure determination area is set to be larger than the return determination area.

6. a driving device data transmission procedure for transmitting the driving device data to a vehicle management server that manages the vehicle to be serviced; a location data transmission step for transmitting location data; a data erasure command transmission step indicating that the data erasure command has been transmitted to the multifunction car navigation device; 6. The computer program according to claim 5, wherein the computer program is executed by an on-board computer.

7. a deletion confirmation step of confirming whether or not the personal information has been deleted from the multifunction car navigation device by outputting a command to delete the personal information by the data deletion command transmission step; a data erasure command retransmission procedure for outputting a data erasure command again when it is confirmed by the erasure confirmation procedure that the personal information to be erased has not been erased; The vehicle-mounted computer is caused to execute the above steps, The data erase command retransmission procedure outputs a data erase command when the drive data of the drive is received. A computer program according to claim 5 or claim 6.

8. A next user detection step for detecting that a user following the user has started using the vehicle to which the service is applied; a data erasure command retransmission means for re-outputting a command to erase the personal information of the previous user when it is detected that the next user has started using the vehicle to be serviced by the next user through the next user detection procedure; The vehicle-mounted computer is then caused to execute the above. A computer program according to claim 5 or claim 6.

9. A vehicle management server that manages a service target vehicle used in a vehicle sharing service by two-way communication with the service target vehicle, The vehicle to be serviced is provided with a GPS receiver for receiving position data from GPS satellites, a multi-function car navigation device for outputting the position data for a user of the vehicle to be serviced, a drive device for driving the vehicle to be serviced, and an on-board computer for transmitting and receiving data to and from the vehicle management server, The vehicle management server includes: A drive unit data receiving means for receiving drive unit data related to the drive unit of the service target vehicle; a position data receiving means for continuously receiving position data via the GPS receiver in the service target vehicle; a departure area determination means for determining whether or not the vehicle to be serviced has left the departure area based on a predetermined departure area and the position data; a return area determination means for determining whether the service target vehicle has entered a return area based on a predetermined return area and the position data when the departure area determination means determines that the service target vehicle has left the departure area; a car navigation data deletion command sending means for sending a data deletion command to the multifunction car navigation device in the vehicle to be serviced when the return area determining means determines that the vehicle to be serviced has entered the return area, the data deletion command being a command to delete user data related to the user of the vehicle to be serviced; Equipped with The departure judgment area is set to be larger than the return judgment area. Vehicle management server.

10. In the case where the departure point of the service target vehicle cannot receive GPS signals, the departure judgment area is a donut-shaped area from the point where GPS signals can be received. The vehicle management server according to claim 9.

11. A computer program for controlling a vehicle management server that manages a vehicle to be serviced, the vehicle management server comprising a GPS receiver that receives position data from GPS satellites, a multi-function car navigation device that outputs the position data for a user of the vehicle to be serviced, a drive device that drives the vehicle to be serviced, and an on-board computer that transmits and receives data to and from the vehicle management server, A drive unit data receiving procedure for receiving drive unit data related to the drive unit of the service target vehicle; a location data receiving step of continuously receiving location data via the GPS receiver in the service target vehicle; a departure area determination step for determining whether the vehicle to be serviced has left the departure area based on a predetermined departure area and the position data; a return area determination step of determining whether the service target vehicle has entered a return area based on a predetermined return area and the position data when the service target vehicle has left the departure area in the departure area determination step; When it is determined in the return area determination procedure that the vehicle to be serviced has entered the return area, the multi-function car navigation device in the vehicle to be serviced a car navigation data erasure command transmission procedure for transmitting a data erasure command which is a command for erasing user data related to the user of the vehicle that is the subject of the service; The vehicle management server executes the above. The departure judgment area is set to be larger than the return judgment area. Computer program.

12. In the case where the departure point of the service target vehicle cannot receive GPS signals, the departure judgment area is a donut-shaped area from the point where GPS signals can be received.

12. A computer program according to claim 11.

Images