Vehicle Control Systems

Abstract

To further securely control utilization of a vehicle by other persons.SOLUTION: In a service of moving a prescribed vehicle by being taken over by another user of a plurality of users between points, a vehicle control system comprises: a determination unit that determines a person who wishes to use a vehicle and a vehicle which is scheduled to be used; a usage permit generation unit that generates a usage permit including user information and permission application information regarding a use of the determined vehicle scheduled to be used; an encryption unit that applies an electronic signature to the usage permit using a private key; and a vehicle control unit that allows a user to operate the vehicle based on the permit application information when it is determined that the usage permit to which an electronic signature has been applied satisfies a predetermined condition for indicating that the usage permit is valid using a public key, in a case where information stored in a personal identification medium which stores user information on an applicant who is trying to use the determined vehicle or information paired with the user information, and the user information included in the usage permit satisfy a predetermined condition.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a technology for controlling vehicle utilization. [Background technology]

[0002] In recent years, there have been cases where vehicles are used by multiple people, such as car sharing and rental cars. Conventionally, a vehicle could not be used unless one had a physical key for the vehicle. Therefore, the number of people who could use the vehicle was restricted by exchanging the physical key for the vehicle.

[0003] However, the exchange of physical keys requires procedures such as handing over the key in person or by mail between the giver and the receiver, which is not very convenient. To address this issue, a technology has been proposed that eliminates the need for physical key exchanges and improves convenience by sending and receiving electronic temporary usage rights via a network. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2019-133236 A Summary of the Invention [Problem to be solved by the invention]

[0005] However, if a vehicle is used by a malicious person, the owner of the vehicle may suffer a disadvantage. Therefore, it is necessary to improve security so that a third party cannot illegally obtain the right to use the vehicle, even if only temporarily.

[0006] In view of the above circumstances, an object of the present invention is to provide a technique that can more safely control the use of a vehicle by others. [Means for solving the problem]

[0007] One aspect of the present invention is a vehicle control system comprising: a determination unit that, in response to a request from a transportation requester to move a specified vehicle from one point to another by multiple users transferring, determines a user who will use the vehicle to move the vehicle in response to the request; a usage permit generation unit that generates a usage permit including user information that is information unique to the user of the vehicle and permission application information that indicates the content of the permission for the application for use of the planned vehicle determined by the determination unit; an encryption unit that grants an electronic signature to the usage permit using a predetermined private key; and a storage medium that stores the usage permit when it is determined that the usage permit to which the electronic signature is granted satisfies predetermined conditions indicating that it is a legitimate usage permit using a public key corresponding to the private key; and a vehicle control unit that performs an operation to enable the user to operate the vehicle based on the permission application information when predetermined conditions are satisfied for the usage permit to which the electronic signature is granted;

[0008] One aspect of the present invention is the above-mentioned vehicle control system, wherein, in response to a request from a transportation requester to move a specified vehicle from a certain point to another point by multiple users transferring between the two points, the determination unit determines a user who will use the vehicle to move the vehicle from the certain point to the other point in response to the request and the vehicle that will be used. Effect of the Invention

[0009] The present invention makes it possible to more safely control the use of a vehicle by others. [Brief description of the drawings]

[0010] [Figure 1]1 is a schematic block diagram showing a system configuration of a control system 100 according to the present invention. [Diagram 2] 2 is a diagram illustrating an example of a functional configuration of a personal identification medium 10. FIG. [Diagram 3] FIG. 2 is a diagram illustrating an example of a functional configuration of a communication device 20. [Figure 4] FIG. 2 is a diagram illustrating an example of a functional configuration of a personal authentication device 30. [Diagram 5] FIG. 2 is a diagram illustrating an example of a functional configuration of a vehicle authentication device 40. [Figure 6] FIG. 2 illustrates an example of a functional configuration of a service management device 50. [Figure 7] FIG. 2 is a diagram illustrating an example of a functional configuration of a vehicle 60. [Figure 8] 2 is a diagram illustrating an example of a functional configuration of a vehicle identification medium 70. FIG. [Figure 9] 4 is a sequence chart showing an example of a basic operation of the control system 100. [Figure 10] 11 is a diagram showing a process flow when a user who wishes to use a vehicle 60 registers with the service management device 50. FIG. [Figure 11] 11 is a diagram showing a process flow when a user who wishes to use a vehicle 60 registers with the service management device 50. FIG. [Figure 12] 11 is a diagram showing a process flow for an applicant who wishes to offer a vehicle 60 to obtain a vehicle digital certificate required for registration in the service management device 50. FIG. [Figure 13] 11 is a diagram showing a process flow when a provider who wishes to provide a vehicle 60 registers with the service management device 50. FIG. [Figure 14] 11 is a diagram showing a process flow when a provider who wishes to provide a vehicle 60 registers with the service management device 50. FIG. [Figure 15] 11 is a diagram showing a process flow when a provider who wishes to provide a vehicle 60 submits an application for provision to the service management device 50. FIG. [Figure 16] 11 is a diagram showing a process flow when a person who wishes to use a vehicle 60 applies for use to the service management device 50. FIG. [Figure 17]11 is a diagram showing a process flow when a person who wishes to use a vehicle 60 applies for use to the service management device 50. FIG. [Figure 18] 13 is a diagram showing a process flow when a user who has already registered usage application information 522 uses a vehicle 60. FIG. [Figure 19] 13 is a diagram showing a specific example of a process flow when a user who has already registered usage application information 522 uses a vehicle 60. FIG. [Figure 20] FIG. 13 is a diagram showing another specific example of the flow of processing when an applicant whose application information 522 has already been registered uses the vehicle 60. [Figure 21] 11 is a diagram showing a process flow when a service provider wishing to provide a driving service registers with the service management device 50. FIG. [Figure 22] 11 is a diagram showing a process flow when a service provider wishing to provide a driving service registers with the service management device 50. FIG. [Figure 23] 13 is a diagram showing a process flow for a proxy requester who wishes to request a proxy driving service for a vehicle 60 to obtain a vehicle electronic certificate that is required when registering the vehicle in the service management device 50. FIG. [Figure 24] 11 is a diagram showing a process flow when a delegation requester who wishes to request a delegation driving service for a vehicle 60 registers with the service management device 50. FIG. [Diagram 25] 11 is a diagram showing a process flow when a delegation requester who wishes to request a delegation driving service for a vehicle 60 registers with the service management device 50. FIG. [Figure 26] 11 is a diagram showing a process flow when a deputy requester who wishes to request a driving service for a vehicle 60 submits a request to a service management device 50. FIG. [Figure 27] 11 is a diagram showing the flow of processing when a service provider wishing to provide designated driving for a vehicle 60 applies for the designated driving service to a service management device 50. FIG. [Figure 28] 11 is a diagram showing the flow of processing when a service provider wishing to provide designated driving for a vehicle 60 applies for the designated driving service to a service management device 50. FIG. [Figure 29]FIG. 13 is a diagram showing the flow of processing when a proxy provider, whose usage application information 522 has already been registered, uses a vehicle 60 (provides a driving service). [Diagram 30] 11 is a diagram showing a process flow when a driver who wishes to transport is registered in the service management device 50. FIG. [Diagram 31] 11 is a diagram showing a process flow when a driver who wishes to transport is registered in the service management device 50. FIG. [Diagram 32] 13 is a diagram showing a process flow for a transport requester who wishes to request driving of a vehicle 60 to obtain a vehicle electronic certificate that is required when registering in a service management device 50. FIG. [Diagram 33] 11 is a diagram showing a process flow when a transportation requester who wishes to request driving of a vehicle 60 registers in the service management device 50. FIG. [Diagram 34] 11 is a diagram showing a process flow when a transportation requester who wishes to request driving of a vehicle 60 registers in the service management device 50. FIG. [Diagram 35] 11 is a diagram showing a process flow when a transportation requester who wishes to request driving of a vehicle 60 submits a request to a service management device 50. FIG. [Diagram 36] 11 is a diagram showing a process flow when a driver who wishes to drive a vehicle 60 applies to drive to the service management device 50. FIG. [Figure 37] 11 is a diagram showing a process flow when a driver who wishes to drive a vehicle 60 applies to drive to the service management device 50. FIG. [Figure 38] 13 is a diagram showing the flow of processing when an applicant for driving, whose usage application information 522 has already been registered, uses (drives) a vehicle 60. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Hereinafter, specific configuration examples of the present invention will be described with reference to the drawings. FIG. 1 is a schematic block diagram showing a system configuration of a control system 100 of the present invention. The control system 100 includes a personal identification medium 10, a communication device 20, a personal authentication device 30, a vehicle authentication device 40, a service management device 50, a vehicle 60, and a vehicle identification medium 70. The personal identification medium 10 and the communication device 20 transmit and receive data by performing wired communication or wireless communication. The vehicle identification medium 70 and the communication device 20 transmit and receive data by performing wired communication or wireless communication. The vehicle identification medium 70 and the vehicle 60 transmit and receive data by performing wired communication or wireless communication. The communication device 20, the personal authentication device 30, the vehicle authentication device 40, the service management device 50, and the vehicle 60 are communicatively connected via a network. Some of the communication device 20, the personal authentication device 30, the vehicle authentication device 40, the service management device 50, and the vehicle 60 may be configured to communicate via a network different from the network to which the other devices are connected. For example, the communication device 20, the personal authentication device 30, the vehicle authentication device 40, the service management device 50, and the vehicle 60 may be configured to be able to communicate with each other via the Internet.

[0012] The personal authentication device 30 is operated by the personal authentication authority 300. The personal authentication authority 300 is an institution that can guarantee that the information indicating an individual recorded in the personal identification medium 10 is actual information beyond a predetermined level. For example, the personal authentication authority 300 is an institution that can perform a certain level of strict confirmation when issuing the personal identification medium 10 that the application is made by the individual and that the medium is handed over to the individual. The personal authentication authority 300 may be, for example, a government agency or an agency equivalent to a government agency (for example, the Local Government Information Systems Agency). The personal authentication authority 300 may be a private agency as long as it is an institution that can perform the above-mentioned certain level of strict confirmation. A specific example of the personal identification medium 10 is a medium for personal identification issued by the country or government agency to which the user belongs (for example, the My Number card in Japan).

[0013] The vehicle authentication device 40 is operated by a vehicle authentication authority 400. It is desirable that the vehicle authentication authority 400 is an institution that can guarantee that the information indicating the vehicle recorded in the vehicle identification medium 70 is actual information beyond a predetermined level. For example, it is desirable that the vehicle authentication authority 400 is an institution that can perform a certain level of strict confirmation when issuing the predetermined information recorded in the vehicle identification medium 70 that the application is made by the legitimate owner of the vehicle and that the information is handed over to the owner. The vehicle authentication authority 400 may be an institution operated by, for example, a corporation or individual involved in the provision of the control system 100. The vehicle authentication authority 400 may be an institution operated by, for example, a corporation or individual involved in the operation of the service management device 50. The vehicle authentication authority 400 may be a public institution as long as it is an institution that can perform the above-mentioned certain level of strict confirmation.

[0014] 2 is a diagram showing an example of the functional configuration of the personal identification medium 10. The personal identification medium 10 is, for example, a card-shaped medium equipped with an IC chip. However, the implementation form of the personal identification medium 10 is not limited to the card-shaped medium described above. For example, the personal identification medium 10 may be implemented using an information device such as a mobile phone, or may be implemented in a medium equipped with an RFID (for example, an object that can be worn on the human body or a portable object). The personal identification medium 10 includes a communication unit 11, a memory unit 12, and a control unit 13.

[0015] The communication unit 11 performs wired or wireless communication with other devices. A specific example of another device with which the communication unit 11 can communicate is the communication device 20. When the personal identification medium 10 is configured using a contact IC chip, the communication unit 11 performs wired communication (communication via a contact portion) with other devices in accordance with a predetermined protocol. When the personal identification medium 10 is configured using a non-contact IC chip such as an RFID, the communication unit 11 performs wireless communication with other devices in accordance with a predetermined protocol.

[0016] The storage unit 12 is configured using a storage device such as a semiconductor storage device. The storage unit 12 stores a first electronic certificate 121, a first secret key 122, a second electronic certificate 123, and a second secret key 124. The first electronic certificate 121 may be issued by, for example, a personal certificate authority 300. The first electronic certificate 121 includes, for example, personal information, first identification information, and a first public key. The personal information is information about a natural person to whom the personal identification medium 10 is issued. The personal information may be, for example, four basic pieces of information (name, date of birth, gender, and address). The first identification information is identification information uniquely assigned to the first electronic certificate. The first public key is a public key generated by public key cryptography. A specific example of the first electronic certificate 121 is a signature electronic certificate for the Japan My Number Card.

[0017] The first private key 122 is a private key generated by a public key cryptosystem. The first private key 122 is a key corresponding to the first public key included in the first electronic certificate 121. The first private key 122 is a private key used when digitally signing a random number or an electronic document (or its hash value). In other words, the first private key 122 is used to realize electronic authentication using a public key infrastructure (PKI). The electronic document may be, for example, data indicating information to be applied for or registered with the service management device 50.

[0018] The second electronic certificate 123 may be issued by, for example, the personal authentication authority 300. The second electronic certificate 123 is issued in association with the first electronic certificate 121. The second electronic certificate 123 may be configured not to include personal information, for example. The second electronic certificate 123 includes, for example, second identification information and a second public key. The second identification information is identification information uniquely assigned to the second electronic certificate. The first identification information and the second identification number do not need to be identical information, but it is preferable that they are stored in association with each other in the personal authentication device 30. The second public key is a public key generated by a public key cryptosystem. A specific example of the second electronic certificate 123 is a user authentication electronic certificate of the Japan My Number Card. In the following description, the first secret key and the second secret key are collectively referred to as a personal secret key, and the first public key and the second public key are collectively referred to as a personal public key. In the following description, when referring to a personal secret key, only one of the first secret key or the second secret key may be included, or both may be included. In the following description, when a personal public key is mentioned, it may include only one of the first public key or the second public key, or it may include both.

[0019] The second private key 124 is a private key generated by a public key cryptosystem. The second private key 124 is a key corresponding to the second public key included in the second electronic certificate 123. The second private key 124 is a private key used when digitally signing a random number or an electronic document (or its hash value). In other words, the second private key 124 is used to realize electronic authentication using a public key infrastructure (PKI). The electronic document may be data indicating information to be applied for or registered with the service management device 50, for example.

[0020] The control unit 13 is configured using a processor. The control unit 13 functions as a communication control unit 131 and an encryption unit 132 by the processor executing a program. All or part of the functions of the control unit 13 may be realized using hardware such as an ASIC (Application Specific Integrated Circuit), a PLD (Programmable Logic Device), or an FPGA (Field Programmable Gate Array). The program may be recorded on a computer-readable recording medium. The computer-readable recording medium is, for example, a portable medium such as a flexible disk, a magneto-optical disk, a ROM, a CD-ROM, or a semiconductor storage device (for example, an SSD: Solid State Drive), or a storage device such as a hard disk or a semiconductor storage device built into a computer system. The program may be transmitted via an electric communication line.

[0021] The communication control unit 131 performs an individual first authentication process based on the individual first authentication information received from the other device in response to a request received from the other device. When the other device is authenticated, the communication control unit 131 notifies the encryption unit 132 of the request from the other device. The communication control unit 131 transmits the information processed by the encryption unit 132 to the other device. The individual first authentication information is information for verifying that a person who is going to use the personal identification medium 10 is a legitimate user. The individual first authentication information may be any type of information, such as a code (e.g., a PIN code) notified in advance to a legitimate user, or biometric information such as a fingerprint. The individual first authentication process is an authentication process for verifying that a person who is going to use the personal identification medium 10 is a legitimate user based on the individual first authentication information.

[0022] When a digital signature is requested by another device, the encryption unit 132 digitally signs the random number or electronic document (or its hash value) using the first secret key 122. The encryption unit 132 transmits the digitally signed data (e.g., the signed electronic document) to the other device via the communication unit 11. When a digital signature is requested by the other device, the encryption unit 132 digitally signs the random number or electronic document (or its hash value) using the second secret key 124. Note that, when another secret key is recorded in the encryption unit 132's own device, the encryption unit 132 may digitally sign the random number or electronic document (or its hash value) using the other secret key. Note that, as described above, the electronic document may be data indicating information to be applied for or registered with the service management device 50, for example.

[0023] FIG. 3 is a diagram showing an example of a functional configuration of the communication device 20. The communication device 20 is, for example, an information processing device such as a personal computer, a smartphone, or a tablet. The communication device 20 may be an information device (dedicated device) configured to be usable only for the execution of a specific program. In this case, the specific program may be, for example, a program for making the vehicle 60 usable by using the personal identification medium 10, or a program for making the vehicle 60 available to others by using the vehicle identification medium 70. The communication device 20 includes a first communication unit 21, a second communication unit 22, an input unit 23, an output unit 24, a storage unit 25, and a control unit 26.

[0024] The first communication unit 21 performs wired or wireless communication with another device. The first communication unit 21 may employ short-range communication. Specific examples of other devices with which the first communication unit 21 can communicate include the personal identification medium 10 or the vehicle identification medium 70. The first communication unit 21 is equipped with a communication method adapted to the communication method installed in the personal identification medium 10 or the vehicle identification medium 70 that is the communication target. For example, the first communication unit 21 may be configured using a communication interface for communicating with a contact IC chip, or may be configured using a communication interface for communicating with a non-contact IC chip. The first communication unit 21 may be configured using, for example, a so-called reader / writer.

[0025] The second communication unit 22 communicates with other devices via a network. The second communication unit 22 may be configured using a so-called network interface. Specific examples of other devices with which the second communication unit 22 can communicate include a personal authentication device 30, a vehicle authentication device 40, a service management device 50, and a vehicle 60.

[0026] The input unit 23 is configured using an existing input device such as a keyboard, a pointing device (mouse, tablet, etc.), a button, a touch panel, etc. The input unit 23 may be configured using a device that acquires biometric information of a user and inputs it to the communication device 20. The input unit 23 is operated by a user when inputting an instruction from the user to the communication device 20. The input unit 23 may be an interface for connecting the input device to the communication device 20. In this case, the input unit 23 inputs an input signal generated in the input device in response to an input from the user to the communication device 20. The input unit 23 may be configured using a microphone and a voice recognition device. In this case, the input unit 23 performs voice recognition on a word spoken by the user, and inputs character string information of the recognition result to the communication device 20. The input unit 23 may be configured in any manner as long as it is configured to input an instruction from the user to the communication device 20.

[0027] The output unit 24 is configured using an output device and outputs data to the user of the communication device 20. The output device may be configured using, for example, a device that outputs images and characters to a screen. For example, the output device may be configured using a CRT (Cathode Ray Tube), a liquid crystal display, an organic EL (Electro-Luminescent) display, or the like. The output device may also be configured using a device that converts characters into voice and outputs the voice. In this case, the output device may be configured using a voice synthesizer and a voice output device (speaker). The output unit 24 may be an interface for connecting the output device to the communication device 20. The output unit 24 may output, for example, permission application information included in a usage permit read from the vehicle identification medium 70 by the communication control unit 261.

[0028] The storage unit 25 is configured using a storage device such as a magnetic hard disk device, a semiconductor storage device, etc. The storage unit 25 stores, for example, data and programs necessary for the communication device 20 to operate.

[0029] The control unit 26 is configured using a processor such as a CPU (Central Processing Unit). The control unit 26 functions as a communication control unit 261 by executing a program. All or part of the functions of the control unit 26 may be realized using hardware such as an ASIC, a PLD, or an FPGA. The program may be recorded on a computer-readable recording medium. The computer-readable recording medium is, for example, a portable medium such as a flexible disk, a magneto-optical disk, a ROM, a CD-ROM, or a semiconductor storage device (e.g., an SSD), or a storage device such as a hard disk or a semiconductor storage device built into a computer system. The program may be transmitted via an electric communication line.

[0030] The communication control unit 261 controls the first communication unit 21 or the second communication unit 22 to communicate with other devices in response to an instruction from the user inputted via the input unit 23. The communication control unit 261 outputs information to the user via the output unit 24 in response to information received from the other devices. For example, when the user is operating the communication device 20 for the purpose of making an application for use of the vehicle 60, the communication control unit 261 makes the above application to the service management device 50 by communicating with the other devices.

[0031] 4 is a diagram showing an example of a functional configuration of the personal authentication device 30. The personal authentication device 30 is an information processing device such as a personal computer or a server device. The hardware of the personal authentication device 30 may be physically protected with high security. The personal authentication device 30 includes a communication unit 31, a storage unit 32, and a control unit 33.

[0032] The communication unit 31 communicates with other devices via a network. The communication unit 31 may be configured using a so-called network interface. Specific examples of other devices with which the communication unit 31 can communicate include the communication device 20, the vehicle authentication device 40, the service management device 50, and the vehicle 60.

[0033] The storage unit 32 is configured using a storage device such as a magnetic hard disk device or a semiconductor storage device. The storage unit 32 stores, for example, personal electronic certificate information 321 and revocation information 322. The personal electronic certificate information 321 includes a first electronic certificate 121 and a second electronic certificate 123 issued in the past. The personal electronic certificate information 321 has the first electronic certificate 121 and the second electronic certificate 123 issued to the same person in association with each other. The personal electronic certificate information 321 may further include a first secret key 122 and a second secret key 124. The revocation information 322 is information regarding the revocation of the first electronic certificate 121 and the second electronic certificate 123 issued in the past to the personal identification medium 10.

[0034] The control unit 33 is configured using a processor such as a CPU. The control unit 33 functions as a certification control unit 331 and a revocation determination unit 332 by executing a program. All or part of the functions of the control unit 33 may be realized using hardware such as an ASIC, a PLD, or an FPGA. The program may be recorded on a computer-readable recording medium. The computer-readable recording medium is, for example, a portable medium such as a flexible disk, a magneto-optical disk, a ROM, a CD-ROM, or a semiconductor storage device (e.g., SSD), or a storage device such as a hard disk or a semiconductor storage device built into a computer system. The program may be transmitted via an electric communication line.

[0035] The certification control unit 331 performs processes related to issuance and revocation of personal electronic certificate information 321. The revocation determination unit 332 determines whether the first electronic certificate 121 or the second electronic certificate 123 to be processed has been revoked in response to a revocation determination request made from another device via the communication unit 31. The revocation determination unit 332 transmits the determination result to the other device that made the request.

[0036] 5 is a diagram showing an example of a functional configuration of the vehicle authentication device 40. The vehicle authentication device 40 is an information processing device such as a personal computer or a server device. The hardware of the vehicle authentication device 40 may be physically protected with high security. The vehicle authentication device 40 includes a communication unit 41, a storage unit 42, and a control unit 43.

[0037] The communication unit 41 communicates with other devices via a network. The communication unit 41 may be configured using a so-called network interface. Specific examples of other devices with which the communication unit 41 can communicate include the communication device 20, the personal authentication device 30, the service management device 50, and the vehicle 60.

[0038] The storage unit 42 is configured using a storage device such as a magnetic hard disk device or a semiconductor storage device. The storage unit 42 stores, for example, vehicle electronic certificate information 421 and revocation information 422. The vehicle electronic certificate information 421 includes information regarding a vehicle electronic certificate 724 that was previously issued. The vehicle electronic certificate information 421 may further include a vehicle private key 725. The revocation information 422 is information regarding the revocation of a vehicle electronic certificate 724 that was previously issued to the vehicle identification medium 70.

[0039] The control unit 43 is configured using a processor such as a CPU. The control unit 43 functions as a certification control unit 431 and a revocation determination unit 432 by executing a program. All or part of the functions of the control unit 43 may be realized using hardware such as an ASIC, a PLD, or an FPGA. The program may be recorded on a computer-readable recording medium. The computer-readable recording medium is, for example, a portable medium such as a flexible disk, a magneto-optical disk, a ROM, a CD-ROM, or a semiconductor storage device (e.g., SSD), or a storage device such as a hard disk or a semiconductor storage device built into a computer system. The program may be transmitted via an electric communication line.

[0040] The certification control unit 431 performs processing related to issuance and revocation of the vehicle electronic certificate information 421. The revocation determination unit 432 determines whether the vehicle electronic certificate information 421 to be processed has revoked or not in response to a revocation determination request made from another device via the communication unit 41. The revocation determination unit 432 transmits the determination result to the other device that has made the request.

[0041] 6 is a diagram showing an example of a functional configuration of the service management device 50. The service management device 50 is an information processing device such as a personal computer or a server device. The service management device 50 includes a communication unit 51, a storage unit 52, and a control unit 53.

[0042] The communication unit 51 communicates with other devices via a network. The communication unit 51 may be configured using a so-called network interface. Specific examples of other devices with which the communication unit 51 can communicate include the communication device 20, the personal authentication device 30, the vehicle authentication device 40, and the vehicle 60.

[0043] The storage unit 52 is configured using a storage device such as a magnetic hard disk device, a semiconductor storage device, etc. The storage unit 52 stores, for example, provision application information 521, use application information 522, performance information 523, and key information 524.

[0044] The provision application information 521 is information applied for regarding the provision of the vehicle 60. The provision application information 521 includes, for example, information on the vehicle 60 to be provided, information on the location where the vehicle 60 is to be provided, and information indicating the time of provision (for example, information indicating the date and time when the provision can be started and the date and time when the provision will end). In addition, the provision application information 521 may include information indicating restrictions on the use of the vehicle 60. For example, the provision application information 521 may include information on smoking in the vehicle 60, and information on the area and environment in which the vehicle 60 can be used (road surface condition, road type, weather, etc.). The provision of the vehicle 60 may be realized in any form. For example, the vehicle 60 may be provided by a person who owns the vehicle 60 to a person who wishes to rent and use the vehicle 60 (car sharing). For example, the vehicle 60 may be provided by a person who owns the vehicle 60 to a person who drives the vehicle 60 on behalf of the person who owns the vehicle 60 (driver substitution). For example, the vehicle 60 may be provided to a driver who undertakes to drive the vehicle 60 as a means of transportation from a first point to another second point (transfer transportation).

[0045] The usage application information 522 is information regarding applications for the use of the vehicle 60 that have confirmed the schedule for using the vehicle 60. The usage application information 522 includes, for example, information regarding the user, information regarding the vehicle 60 that is to be used, information regarding the location where the use will start, and information indicating the time of use (for example, information indicating the date and time of the start of use and the date and time of the end of use).

[0046] The performance information 523 is information related to the performance of the use of the vehicle 60. The performance information 523 includes, for example, information on the user who actually used the vehicle 60, information on the vehicle 60 that was actually used, information on the location where the use actually started, and information indicating the time of the actual use (for example, information indicating the date and time when the use actually started and the date and time when the use actually ended). The performance information 523 may further include the route taken by the used vehicle 60.

[0047] The key information 524 includes a public key (hereinafter referred to as the "service public key") and a private key (hereinafter referred to as the "service private key") used in the service management device 50. The service public key included in the key information 524 is included in the usage license. The service private key included in the key information 524 is used in a digital signature for the usage license. The service private key included in the key information 524 may also be recorded in the vehicle identification medium 70.

[0048] The control unit 53 is configured using a processor such as a CPU. The control unit 53 functions as an information acquisition unit 531, a decision unit 532, a license generation unit 533, and a record management unit 534 by executing a program. All or part of the functions of the control unit 53 may be realized using hardware such as an ASIC, a PLD, or an FPGA. The program may be recorded on a computer-readable recording medium. The computer-readable recording medium is, for example, a portable medium such as a flexible disk, a magneto-optical disk, a ROM, a CD-ROM, or a semiconductor storage device (e.g., SSD), or a storage device such as a hard disk or a semiconductor storage device built into a computer system. The program may be transmitted via an electric communication line.

[0049] The information acquisition unit 531 acquires the provision application information 521 or information related to an application for use based on an application for provision or an application for use received from a device such as the communication device 20. The information acquisition unit 531 may acquire the information necessary for the application by, for example, transmitting data of an application screen having input fields for information necessary for the application to a device such as the communication device 20 and receiving each value entered in the input field. The information acquisition unit 531 records the acquired information in the storage unit 52.

[0050] The determination unit 532 associates the provision application and the use application that satisfy a predetermined condition based on the provision application information 521 and the information on the application for use, and determines information on the use of the vehicle 60. The determination unit 532 generates the use application information 522 based on the determination. The determination unit 532 records the generated use application information 522 in the storage unit 52. For example, in the case of car sharing, the provision application information 521 corresponding to the application for use is searched for based on the information on the application for use acquired by the information acquisition unit 531. If there is provision application information 521 that satisfies the conditions of the requested use and has not been reserved, the determination unit 532 determines the provision application information 521 as information on the vehicle 60 to be provided to the applicant for use. The determination unit 532 generates the use application information 522 based on the determined provision application information 521 and the information acquired in the application for use. The determination unit 532 records the generated use application information 522 in the storage unit 52.

[0051] When the vehicle 60 to be provided is determined in the determination unit 532, the usage permit generation unit 533 generates a usage permit including information regarding the permitted use of the vehicle 60. The usage permit may include, for example, a part or all of the usage application information 522. That is, the usage permit may include, for example, information regarding the user, information regarding the target vehicle 60 to be used, information regarding the location where the use will start, and information indicating the time of use. For example, the usage permit may include a personal public key recorded in the personal identification medium 10 of the user. The usage permit may further include a service public key included in the key information 524. The usage permit generation unit 533 digitally signs the usage permit by using the service private key included in the key information 524. Then, the usage permit generation unit 533 transmits the digitally signed usage permit to the target vehicle 60 to be used by the usage permit.

[0052] The record management unit 534 acquires information regarding the record of use of the vehicle 60 to which the usage permit was transmitted, and records the information as record information 523 in the storage unit 52. The record management unit 534 may acquire information regarding the route taken by the used vehicle 60, for example, by periodically acquiring position information from the vehicle 60 being used. The record management unit 534 may further acquire the passing time of the vehicle 60 at each position on the route, and record the information as record information 523.

[0053] FIG. 7 is a diagram showing an example of a functional configuration of a vehicle 60. The vehicle 60 is a moving body that can be used by people as a means of transportation. The vehicle 60 may be a moving body equipped with one or more wheels, such as a motorcycle, a four-wheeled motor vehicle, or a bicycle. The vehicle 60 may be a moving body equipped with a means of transportation other than wheels (for example, a drivable sphere). Although not shown in FIG. 7, the vehicle 60 is equipped with various devices necessary for a moving body. These devices are controlled by a vehicle control unit 65, which will be described later. In addition to these devices, the vehicle 60 further includes a first communication unit 61, a second communication unit 62, a third communication unit 63, a memory unit 64, and a vehicle control unit 65.

[0054] The first communication unit 61 performs wired communication or wireless communication with another device. Short-range communication may be adopted for the first communication unit 61. A specific example of another device with which the first communication unit 61 can communicate is a vehicle identification medium 70. The first communication unit 61 may be configured similarly to the first communication unit 21 of the communication device 20.

[0055] The second communication unit 62 communicates with other devices via a network. The second communication unit 62 may be configured using a so-called network interface. Specific examples of other devices with which the second communication unit 62 can communicate include the communication device 20, the personal authentication device 30, the vehicle authentication device 40, and the service management device 50.

[0056] The third communication unit 63 performs wired or wireless communication with another device. Short-range communication may be adopted for the third communication unit 63. A specific example of another device with which the third communication unit 63 can communicate is the personal identification medium 10. The third communication unit 63 may be configured similarly to the first communication unit 21 of the communication device 20.

[0057] The storage unit 64 is configured using a storage device such as a magnetic hard disk device, a semiconductor storage device, etc. The storage unit 64 stores data and programs necessary for the vehicle control unit 65 to operate, for example.

[0058] The vehicle control unit 65 is configured using a processor such as a CPU. The vehicle control unit 65 functions as a main control unit 651 and a usage determination unit 652 by executing a program. All or part of the functions of the vehicle control unit 65 may be realized using hardware such as an ASIC, a PLD, or an FPGA. The program may be recorded on a computer-readable recording medium. The computer-readable recording medium is, for example, a portable medium such as a flexible disk, a magneto-optical disk, a ROM, a CD-ROM, or a semiconductor storage device (e.g., SSD), or a storage device such as a hard disk or a semiconductor storage device built into a computer system. The program may be transmitted via an electric communication line.

[0059] The main control unit 651 controls various general functions for the vehicle 60 to function as a mobile object. For example, the main control unit 651 controls the locking and unlocking of doors provided in the vehicle 60, turning the engine of the vehicle 60 on and off, the operation of the engine of the vehicle 60, the transmission, and the like.

[0060] The usage determination unit 652 determines whether or not a request to use the vehicle 60 is made by a person who should be permitted to use the vehicle. When the usage determination unit 652 determines that the request for use is made by a person who should be permitted to use the vehicle, it instructs the main control unit 651 to enable use of the vehicle 60. Upon receiving the instruction to enable use, the main control unit 651 performs control to enable use (operation) of the vehicle 60. For example, the main control unit 651 unlocks the doors that were locked and turns on the engine. Then, the main control unit 651 unlocks the steering wheel and controls each device so that the user can freely drive the vehicle 60.

[0061] FIG. 8 is a diagram showing an example of a functional configuration of the vehicle identification medium 70. The vehicle identification medium 70 is, for example, a card-shaped medium equipped with an IC chip. However, the implementation form of the vehicle identification medium 70 is not limited to the card-shaped medium described above. For example, the vehicle identification medium 70 may be implemented using an information device such as a mobile phone, or may be implemented in a medium equipped with an RFID (for example, an object that can be worn on a human body or a portable object). For example, the vehicle identification medium 70 may be incorporated in any part of the body of the vehicle 60, or may be incorporated in an on-board device mounted on the vehicle 60. The vehicle identification medium 70 may be, for example, a dedicated medium on which a vehicle inspection certificate is recorded. The vehicle identification medium 70 includes a communication unit 71, a storage unit 72, and a control unit 73.

[0062] The communication unit 71 performs wired or wireless communication with other devices. Specific examples of other devices with which the communication unit 71 can communicate include the communication device 20 and the vehicle 60. When the vehicle identification medium 70 is configured using a contact IC chip, the communication unit 71 performs wired communication (communication via a contact portion) with other devices in accordance with a predetermined protocol. When the vehicle identification medium 70 is configured using a non-contact IC chip such as an RFID, the communication unit 71 performs wireless communication with other devices in accordance with a predetermined protocol.

[0063] The storage unit 72 is configured using a storage device such as a semiconductor storage device, etc. The storage unit 72 stores vehicle identification information 721, vehicle attribute information 722, owner information 723, a vehicle digital certificate 724, a vehicle private key 725, usage permit information 726, a service AP 727, and a service private key 728.

[0064] The vehicle identification information 721 is identification information for uniquely identifying the vehicle 60. However, the vehicle identification information 721 does not need to be able to uniquely identify the vehicle 60 worldwide, but only needs to be able to uniquely identify the vehicle 60 in a specific region (for example, a specific administrative district, a specific country (for example, Japan) etc.). For example, the vehicle registration number or chassis number used on the vehicle inspection certificate may be used as the vehicle identification information.

[0065] The vehicle attribute information 722 indicates attribute information of the vehicle. The vehicle attribute information 722 does not necessarily have to be limited to one value. The vehicle attribute information 722 may be values ​​of items used in the vehicle inspection certificate, such as the shape of the vehicle body and the vehicle weight.

[0066] The owner information 723 is information indicating the owner of the vehicle. For example, the first identification information of the first electronic certificate 121 or the second identification information of the second electronic certificate 123 may be used as the owner information 723.

[0067] The vehicle electronic certificate 724 and the vehicle private key 725 are issued by the certification control unit 431. The vehicle private key 725 is a private key generated by public key cryptography. The vehicle private key 725 is a key corresponding to the vehicle public key included in the vehicle electronic certificate 724. The vehicle private key 725 is a private key used when placing a digital signature on a random number or an electronic document (or its hash value).

[0068] The license information 726 is issued by the license generating unit 533 of the service management device 50. The service AP 727 is an application program used for a service by the service management device 50. The service private key 728 is a private key issued by the service management device 50 and recorded in the vehicle identification medium 70.

[0069] The control unit 73 is configured using a processor. The control unit 73 functions as a communication control unit 731 and an encryption unit 732 by the processor executing a program. All or part of the functions of the control unit 73 may be realized using hardware such as an ASIC, a PLD, or an FPGA. The program may be recorded on a computer-readable recording medium. The computer-readable recording medium is, for example, a portable medium such as a flexible disk, a magneto-optical disk, a ROM, a CD-ROM, or a semiconductor storage device (e.g., SSD), or a storage device such as a hard disk or a semiconductor storage device built into a computer system. The program may be transmitted via an electric communication line.

[0070] The communication control unit 731 issues an authentication request to the other device in response to a request received from the other device. The communication control unit 731 performs authentication processing based on authentication information received from the other device. When the other device is authenticated, the communication control unit 731 notifies the encryption unit 732 of the request from the other device. The communication control unit 731 transmits information processed by the encryption unit 732 to the other device.

[0071] When a digital signature is requested by another device, the encryption unit 732 digitally signs the random number or the electronic document (or its hash value) using the vehicle private key 725. The encryption unit 732 transmits the digitally signed data to the other device via the communication unit 71. The control unit 73 may execute the service AP 727 to perform processing related to the use and provision of services.

[0072] [Basic operation] FIG. 9 is a sequence chart showing an example of a basic operation of the control system 100. The service management device 50 generates a usage permit (step S001) and digitally signs the usage permit (step S002). The service management device 50 transmits the signed usage permit to the communication device 20 or the vehicle 60 to which the vehicle identification medium 70 that is the subject of the usage permit is connected (step S003). In FIG. 9, the signed usage permit is transmitted to the vehicle 60. When the vehicle 60 receives the signed usage permit, the vehicle 60 determines whether the received signed usage permit has been tampered with by using the vehicle public key (step S004). If the usage permit has been tampered with, the vehicle 60 stops the process. On the other hand, if the usage permit has not been tampered with, the vehicle 60 performs an operation to write the usage permit to the vehicle identification medium 70 connected to the vehicle 60 (step S005). The control unit 73 of the vehicle identification medium 70 records the usage permit in the storage unit 72 in accordance with the control by the vehicle 60 (step S006).

[0073] Thereafter, when a user having a personal identification medium 10 storing user identification information (e.g., the second electronic certificate 123) included in the license attempts to use the vehicle 60, the vehicle 60 reads out the recorded license itself or the information included in the license from the vehicle identification medium 70 connected to the vehicle 60 (step S007). The personal identification medium 10 of the user transmits information used for authentication (authentication information) (step S008). Thereafter, if a predetermined condition indicating that the user is a valid user (a user to whom a license has been issued) is satisfied, the vehicle 60 judges to permit the use of the vehicle 60 (step S009). On the other hand, if the above-mentioned predetermined condition is not satisfied, the vehicle 60 judges not to permit the use of the vehicle. Depending on the result of this judgment, the main control unit 651 of the vehicle 60 performs an operation to permit the use of the vehicle 60 (step S010).

[0074] A specific example of the determination in the vehicle 60 will be described. The vehicle 60 obtains a personal public key from the usage permit obtained from the vehicle identification medium 70. The vehicle 60 generates basic information for authentication using a specific method. For example, the vehicle 60 may generate a random number as basic information for authentication. In this case, the vehicle 60 transmits the random number to the personal identification medium 10. The personal identification medium 10 generates authentication information by encrypting the random number using a personal private key, and outputs the generated information to the vehicle 60. The vehicle 60 decrypts the authentication information obtained from the personal identification medium 10 using the personal public key. The vehicle 60 determines whether the generated random number matches the decrypted value. If they match, the vehicle 60 determines to permit use of the vehicle 60. If they do not match, the vehicle 60 determines to not permit use of the vehicle 60. Note that the determination process in the vehicle 60 is not limited to the specific example described above.

[0075] [Car sharing] 10 to 18 are sequence charts showing a specific example of the operation flow when the control system 100 is applied to car sharing. First, a process flow when a person who wishes to use a vehicle 60 registers with the service management device 50 will be described with reference to FIGS. 10 and 11. The person who wishes to use a vehicle 60 is a person who wishes to rent and drive a vehicle 60 owned by another person in car sharing. The service management device 50 may be operated by an intermediary who mediates between the person who wishes to use the vehicle and a person who wishes to provide the vehicle, which will be described later, in car sharing. First, the person who wishes to use performs an operation for registration with the service management device 50 on the input unit 23 of the communication device 20 (step S101). In response to the operation by the person who wishes to use the vehicle, the communication device 20 transmits a registration request to the service management device 50 (step S102). When the service management device 50 receives the registration request, it transmits a user information request to the communication device 20 in response to the received registration request (step S103). The user information request is a request for information (user information) specific to the person who wishes to use the vehicle. The user information may be, for example, the first digital certificate 121 .

[0076] When the communication device 20 receives the user information request, it causes the output unit 24 to output a display prompting input of personal first authentication information. The person who wishes to use inputs the personal first authentication information by operating the input unit 23 (step S104). The personal first authentication information may be, for example, a preset PIN code. The communication device 20 transmits the personal first authentication information input via the input unit 23 to the personal identification medium 10 (step S105). The personal identification medium 10 executes an authentication process based on the received personal first authentication information (step S106). The communication device 20 requests the personal identification medium 10 to provide a digital signature regarding the user information to be registered (step S107). The user information to be registered is information regarding the person who wishes to use. The user information may include user information (for example, name, age, address, gender, etc.) input by the user in the communication device 20. The user information may include personal information included in the first electronic certificate 121.

[0077] If the user is authenticated as a result of the personal first authentication process in step S106, the personal identification medium 10 digitally signs the user information to be registered using the first private key 122 in response to the request in step S107 (step S108). The digital signature may be realized, for example, by encrypting a hash value obtained from the user information using the first private key. The personal identification medium 10 transmits the user information with the digital signature (signed user information) to the communication device 20 (step S109). The communication device 20 transmits the user information received from the personal identification medium 10 to the service management device 50 (step S110). The service management device 50 executes a second authentication process on the received user information (step S111). In the second authentication process, the service management device 50 determines whether the user information has been tampered with.

[0078] If it is determined that there has been tampering, the service management device 50 does not proceed any further and ends the process. In this case, the service management device 50 may notify the communication device 20 of an error. On the other hand, if it is determined that there has been no tampering, the service management device 50 transmits a revocation determination request for the first electronic certificate included in the received user information to the personal authentication device 30 (step S112). Upon receiving the revocation determination request, the personal authentication device 30 performs a revocation determination for the first electronic certificate that is the subject of the process (step S113). The personal authentication device 30 transmits a revocation determination response including the result of the revocation determination to the service management device 50 (step S114).

[0079] If the revocation determination result indicates revocation, the service management device 50 ends the process without proceeding any further. In this case, the service management device 50 may notify the communication device 20 of an error. On the other hand, if the revocation determination result does not indicate revocation, the service management device 50 registers information such as the name and address included in the user information received in step S110, and the personal information and first identification information included in the first electronic certificate as user member information in the storage unit 52 (step S115). The service management device 50 notifies the communication device 20 that the registration of the user member information has been completed (step S116). When the communication device 20 receives a notification that the registration of the user member information has been completed, it outputs information indicating that the registration has been completed via the output unit 24. For example, the communication device 20 displays a screen indicating that the registration has been completed on the output unit 24 (step S117).

[0080] Next, a process flow for a provider who wishes to provide a vehicle 60 to obtain a vehicle electronic certificate required for registration in the service management device 50 will be described with reference to FIG. 12. The provider is a person who wishes to lend his / her vehicle 60 to another person in car sharing. First, the provider operates the input unit 23 of the communication device 20 for registration in the vehicle authentication device 40 (step S201). In response to the operation by the provider, the communication device 20 transmits a new registration request to the vehicle authentication device 40 (step S202). The new registration request includes the vehicle identification information recorded in the vehicle identification medium 70. Upon receiving the new registration request, the vehicle authentication device 40 generates a vehicle key pair (vehicle private key and vehicle public key) corresponding to the vehicle identification information included in the received new registration request (step S203). The vehicle authentication device 40 generates a vehicle electronic certificate using the generated vehicle private key and vehicle public key (step S204). The vehicle electronic certificate includes information such as the vehicle identification information and the vehicle public key. The vehicle authentication device 40 newly registers the generated vehicle digital certificate in the storage unit 42 (step S205).

[0081] The vehicle authentication device 40 generates a new registration response indicating that the new registration has been completed. The new registration response includes the generated vehicle electronic certificate and vehicle private key. The vehicle authentication device 40 transmits the new registration response to the operator of the communication device 20 (the owner of the vehicle identification medium 70) by a means that ensures security (step S206). The transmission of the new registration response may be realized by any method that can ensure security. Upon receiving the new registration response, the communication device 20 transmits the vehicle electronic certificate and vehicle private key included in the received new registration response to the vehicle identification medium 70 (step S207). The control unit 73 of the vehicle identification medium 70 records the received new registration information in the memory unit 72 (step S208).

[0082] Next, a process flow when a provider wishing to provide a vehicle 60 registers with the service management device 50 will be described with reference to Figures 13 and 14. First, the provider operates the input unit 23 of the communication device 20 for registration with the service management device 50 (step S301). In response to the operation by the provider, the communication device 20 transmits a registration request to the service management device 50 (step S302). Upon receiving the registration request, the service management device 50 transmits a provider / vehicle information request to the communication device 20 in response to the received registration request (step S303). The provider / vehicle information request is a request for identification information indicating the provider and identification information indicating the vehicle to be provided.

[0083] When the communication device 20 receives the provider / vehicle information request, it executes an information acquisition process to acquire signed provider information using the personal identification medium 10 of the provider. The signed provider information is provider information to which a digital signature using a first private key has been applied. The process of acquiring signed provider information is similar to the process of acquiring signed user information in steps S104 to S109 of FIG. 10. Therefore, a detailed description will be omitted. The provider information is information related to the provider. The provider information may include user information (e.g., name, age, address, gender, etc.) input by the user in the communication device 20. The provider information may include personal information included in the first electronic certificate 121.

[0084] The communication device 20 also causes the output unit 24 to output a display prompting the input of the vehicle first authentication information. The provider inputs the vehicle first authentication information by operating the input unit 23 (step S304). The vehicle first authentication information may be, for example, a preset PIN code. The communication device 20 transmits the vehicle first authentication information input via the input unit 23 to the vehicle identification medium 70 (step S305). The vehicle identification medium 70 executes a vehicle first authentication process based on the received vehicle first authentication information (step S306). The communication device 20 requests a digital signature from the vehicle identification medium 70 (step S307). At this time, the communication device 20 generates, for example, a random number or an electronic document (or a hash value thereof) used for the digital signature and transmits it to the vehicle identification medium 70.

[0085] If the requesting provider is authenticated as a result of the authentication process in step S306, the vehicle identification medium 70, in response to the request in step S307, digitally signs the data (random number, electronic document, hash value, etc.) transmitted from the communication device 20 using the vehicle private key 725 (step S308). The vehicle identification medium 70 transmits a digital signature response including the digitally signed data and the vehicle electronic certificate to the communication device 20 (step S309). The communication device 20 transmits the digital signature response received from the vehicle identification medium 70 and the provider information of the requesting provider acquired in the information acquisition process to the service management device 50 (step S310). The service management device 50 determines whether the first electronic certificate of the received provider information and the vehicle electronic certificate have been tampered with (step S311).

[0086] If it is determined that there is tampering, the service management device 50 does not proceed further and ends the process. In this case, the service management device 50 may notify the communication device 20 of an error. On the other hand, if it is determined that there is no tampering, the service management device 50 performs a revocation determination for the received first electronic certificate and vehicle electronic certificate. For the first electronic certificate, a personal revocation determination process is executed for the personal authentication device 30. The personal revocation determination process is the same as the process described in steps S112 to S114, so a description is omitted. For the vehicle electronic certificate, a revocation determination request is transmitted to the vehicle authentication device 40 (step S312). When the vehicle authentication device 40 receives the revocation determination request, it performs a revocation determination for the vehicle electronic certificate being processed (step S313). The vehicle authentication device 40 transmits a revocation determination response including the result of the revocation determination to the service management device 50 (step S314).

[0087] If any of the revocation determination results indicates revocation, the service management device 50 ends the process without proceeding any further. In this case, the service management device 50 may notify the communication device 20 of an error. On the other hand, if none of the revocation determination results indicates revocation, the service management device 50 registers the provider information received in step S310 and the vehicle identification information included in the vehicle electronic certificate as providing member information in the storage unit 52 (step S315). The service management device 50 notifies the communication device 20 that the registration of the providing member information has been completed (step S316). When the communication device 20 receives the notification of the completion of the registration of the providing member information, it outputs information indicating that the registration has been completed via the output unit 24. For example, the communication device 20 displays a screen indicating that the registration has been completed on the output unit 24 (step S317). In addition, the service management device 50 registers the providing initial information in the storage unit 52 (step S318). The providing initial information includes the key information 524. For example, at the timing of step S318, the service management device 50 may generate key information 524 for the provider and store it in association with the provider's first electronic certificate 121 and the vehicle electronic certificate. The service management device 50 records the initial provision information in the vehicle identification medium 70 (step S319). At this time, for example, a service AP 727, a service private key 728, and the public key of the service management device 50 may be recorded in the vehicle identification medium 70. In particular, it is desirable to record the service private key 728 in the vehicle identification medium 70 using secure means.

[0088] Next, a process flow when a provider who wishes to provide a vehicle 60 applies for provision to the service management device 50 will be described with reference to FIG. 15. First, the provider operates the input unit 23 of the communication device 20 to apply for provision to the service management device 50 (step S401). In response to the operation by the provider, the communication device 20 transmits a provision application request to the service management device 50 (step S402). Upon receiving the provision application request, the service management device 50 transmits a provider information request to the communication device 20 in response to the received provision application request (step S403). The provider information request is a request for identification information indicating the provider who is the provider of the vehicle 60 to be provided.

[0089] Next, an information acquisition process (steps S104 to S109) is executed between the communication device 20 and the personal identification medium 10. By executing the information acquisition process, the provider information is acquired from the provider's personal identification medium 10. The communication device 20 transmits the provider information to the service management device 50 (step S404). The service management device 50 judges whether the first certificate of the received provider information has been tampered with (step S405). If it is judged that there has been tampering, the service management device 50 does not proceed further and ends the process. In this case, the service management device 50 may notify the communication device 20 of an error. On the other hand, if it is judged that there has been no tampering, the service management device 50 performs a revocation judgment on the received first electronic certificate. For the first electronic certificate, an individual revocation judgment process is executed on the personal authentication device 30. The individual revocation judgment process is the same as the process described in steps S112 to S114, and therefore a description thereof will be omitted.

[0090] If the revocation determination result indicates revocation, the service management device 50 ends the process without proceeding any further. In this case, the service management device 50 may notify the communication device 20 of an error. On the other hand, if the revocation determination result does not indicate revocation, the service management device 50 transmits a provision conditions request to the communication device 20 (step S406). The provision conditions request is a request for information indicating conditions related to the provision of the vehicle to be provided.

[0091] When the communication device 20 receives the request for providing conditions, the communication device 20 performs output to prompt the offer applicant to input conditions regarding the provision of the vehicle to be provided. For example, the communication device 20 displays a screen for inputting conditions on the output unit 24. The offer applicant inputs the conditions of provision to the communication device 20 by operating the input unit 23 (step S407). The communication device 20 transmits a providing conditions response indicating the input conditions of provision to the service management device 50 (step S408).

[0092] When the service management device 50 receives the provision condition response, it executes a presence determination process for the vehicle identification medium 70 related to the vehicle 60 registered as a provision target (step S409). The presence determination process is a process for confirming that the vehicle identification medium 70 related to the vehicle 60 to be provided is in a usable state, for example, by transmitting a specific signal to the vehicle identification medium 70. If it is confirmed in the presence determination process that the vehicle 60 to be provided is in a usable state, the service management device 50 registers information indicating the received provision conditions in the storage unit 52 as provision application information 521 (step S410). On the other hand, if it is not confirmed in the presence determination process that the vehicle 60 to be provided is in a usable state, the service management device 50 ends the process without proceeding any further. In this case, the service management device 50 may notify the communication device 20 of an error. When the registration is completed, the service management device 50 notifies the communication device 20 that the registration of the provision conditions is completed (step S411). When the communication device 20 receives the notification of registration of the provision conditions, the communication device 20 outputs information indicating that the registration has been completed via the output unit 24. For example, the communication device 20 displays a screen indicating that the registration has been completed on the output unit 24 (step S412).

[0093] Next, a process flow when a user who wishes to use the vehicle 60 applies for use to the service management device 50 will be described with reference to FIG. 16 and FIG. 17. In FIG. 16 and FIG. 17, the vehicle identification medium 70 is communicably connected to the first communication unit 61 of the vehicle 60. For example, when the first communication unit 61 is configured using an in-vehicle device, the vehicle identification medium 70 may remain inserted in a physical interface such as an outlet provided in the in-vehicle device. First, the user performs an operation on the input unit 23 of the communication device 20 to apply for use to the service management device 50 (step S501). In response to the operation by the user, the communication device 20 transmits a use application request to the service management device 50 (step S502). When the service management device 50 receives the use application request, it transmits a user information request to the communication device 20 in response to the received use application request (step S503). The user information request is a request for identification information indicating the user.

[0094] When the communication device 20 receives the user information request, the communication device 20 executes an information acquisition process to acquire the signed user information using the personal identification medium 10 of the user who wishes to use the service. The process of acquiring the signed user information is the same as steps S104 to S109 in FIG. 10. Therefore, detailed description will be omitted. The communication device 20 transmits the signed user information to the service management device 50 (step S504). The service management device 50 judges whether the received signed user information has been tampered with (step S505). If it is judged that the information has been tampered with, the service management device 50 does not proceed further and ends the process. In this case, the service management device 50 may notify the communication device 20 of an error. On the other hand, if it is judged that the information has not been tampered with, the service management device 50 performs a revocation judgment on the first electronic certificate included in the received signed usage permit. For the first electronic certificate, a personal revocation judgment process is executed on the personal authentication device 30. Since the personal revocation judgment process is the same as the process described in steps S112 to S114, a description will be omitted.

[0095] If the revocation determination result indicates revocation, the service management device 50 ends the process without proceeding any further. In this case, the service management device 50 may notify the communication device 20 of an error. On the other hand, if the revocation determination result does not indicate revocation, the service management device 50 transmits a usage conditions request to the communication device 20 (step S506). The usage conditions request is a request for information indicating conditions related to the use of the vehicle. The usage conditions include, for example, information related to the vehicle 60 (such as the vehicle type), information related to the location of use, and information indicating the time of use (for example, information indicating the start date and time of use and the end date and time of use). The usage conditions may further include other conditions.

[0096] When the communication device 20 receives the usage conditions request, it performs output to prompt the intended user to input conditions regarding the use of the vehicle. For example, the communication device 20 displays a screen for inputting the conditions on the output unit 24. The intended user inputs the usage conditions into the communication device 20 by operating the input unit 23 (step S507). The communication device 20 transmits a usage conditions response indicating the input usage conditions to the service management device 50 (step S508).

[0097] When the service management device 50 receives the use condition response, it searches for the provision application information 521 registered in the storage unit 52 that satisfies the received use conditions. Then, the service management device 50 selects one provision application information 521 from the provision application information 521 that satisfies the use conditions, and determines the vehicle corresponding to the selected provision application information 521 as a vehicle to be used (step S509). The service management device 50 generates use application information 522 based on the selected provision application information 521 and information on the user who wishes to use the service, and registers the information in the storage unit 52. Then, the service management device 50 notifies the communication device 20 of information indicating the determined vehicle to be used (step S510). When the communication device 20 receives the information notification of the vehicle to be used, it outputs the information indicating the vehicle to be used via the output unit 24. For example, the communication device 20 displays a screen indicating a part or all of the use application information 522 on the output unit 24 (step S511).

[0098] The service management device 50 generates a usage permit based on the usage application information 522 (step S512). The service management device 50 digitally signs the generated usage permit (step S513). The service management device 50 transmits the signed usage permit to the vehicle 60 that is the subject of the usage permit (step S514). Thereafter, the service management device 50 determines whether the received signed usage permit has been tampered with by using the public key and digital signature of the service management device 50 (step S515). This determination process may be performed in the vehicle 60 or in the vehicle identification medium 70. If the usage permit has been tampered with, the vehicle 60 stops the process. On the other hand, if the usage permit has not been tampered with, the vehicle 60 performs an operation to write the usage permit to the vehicle identification medium 70 connected to the vehicle 60 (step S516). The control unit 73 of the vehicle identification medium 70 records the usage permit in the storage unit 72 according to the control by the vehicle 60 (step S517).

[0099] Next, the flow of processing when an applicant whose usage application information 522 has already been registered uses the vehicle 60 will be described with reference to Fig. 18. First, the applicant connects the personal identification medium 10 used in the usage application to the vehicle 60 that the applicant wishes to use so that the personal identification medium 10 can communicate with the vehicle 60 that the applicant wishes to use. When the vehicle 60 detects that the personal identification medium 10 has been connected to the vehicle 60, the vehicle 60 reads the recorded usage permit itself or information contained in the usage permit from the vehicle identification medium 70 connected to the vehicle 60 (step S601). The vehicle 60 also reads information used for authentication (authentication information) from the user's personal identification medium 10 (step S602).

[0100] If the vehicle 60 satisfies a predetermined condition indicating that the user is a valid user (a user to whom a usage permit has been issued), the vehicle 60 judges that the use of the vehicle 60 is permitted (step S603). On the other hand, if the above-mentioned predetermined condition is not satisfied, the vehicle 60 judges that the use of the vehicle is not permitted. In response to the judgment result, the main control unit 651 of the vehicle 60 performs an operation to enable the use of the vehicle 60 (step S604). When the operation of the vehicle 60 is permitted, the vehicle 60 records a history of the operation of the vehicle 60 by the user until the user's use ends (step S605). When the user's use ends, the vehicle 60 transmits the operation history recorded up to that point to the service management device 50. When the service management device 50 receives the operation history, it records the received history information in the storage unit 52 as performance information 523.

[0101] Next, a specific example of a process flow when a user who has already registered the use application information 522 uses the vehicle 60 will be described with reference to FIG. 19. In the specific example of FIG. 19, a challenge response is adopted. First, the user connects the personal identification medium 10 used in the use application to the vehicle 60 that the user wishes to use so that the personal identification medium 10 can communicate with the vehicle 60 that the user wishes to use. When the vehicle 60 detects that the personal identification medium 10 has been connected to the vehicle 60, the vehicle 60 acquires a random number generated in the vehicle identification medium 70 from the vehicle identification medium 70 connected to the vehicle 60 (step S701). The vehicle 60 transmits the acquired random number to the personal identification medium 10 and requests a digital signature (step S702). When the personal identification medium 10 receives the random number from the vehicle 60, the personal identification medium 10 digitally signs the random number using a private key recorded in the vehicle 60 (step S703). The private key used at this time may be the first private key or the second private key. However, which private key is used is determined in advance between the vehicle 60 and the vehicle 60.

[0102] The vehicle 60 obtains a usage permit from the vehicle identification medium 70 (step S704). The personal identification medium 10 transmits the signed random number as the signature result to the vehicle 60 (step S705). The signature result transmitted at this time corresponds to the authentication information in step S008 of FIG. 9. The vehicle 60 uses the public key included in the electronic certificate of the usage permit and the signature result to determine whether or not the user of the vehicle 60 is a legitimate user (step S706). The public key used at this time is the public key corresponding to the private key used in the processing of step S703.

[0103] If the vehicle 60 satisfies a predetermined condition indicating that the user is a legitimate user (a user to whom a license has been issued), the vehicle 60 determines to permit use of the vehicle 60. On the other hand, if the predetermined condition is not satisfied, the vehicle 60 determines not to permit use of the vehicle. Depending on the result of the determination, the main control unit 651 of the vehicle 60 performs an operation to permit use of the vehicle 60 (step S707). When operation is permitted, the vehicle 60 records a history of the operation of the vehicle 60 by the user until the user's use is terminated (step S708).

[0104] Next, with reference to FIG. 20, another specific example of the process flow when a user who has already registered the use application information 522 uses the vehicle 60 will be described. The specific example of FIG. 20 also employs a challenge response. First, the user connects the personal identification medium 10 used in the use application to the vehicle 60 that the user wishes to use so that the personal identification medium 10 can communicate with the vehicle 60 that the user wishes to use. When the vehicle 60 detects that the personal identification medium 10 has been connected to the vehicle 60, the vehicle 60 acquires a random number generated in the vehicle identification medium 70 from the vehicle identification medium 70 connected to the vehicle 60 (step S801). The vehicle 60 transmits the acquired random number to the personal identification medium 10 and requests a digital signature (step S802). When the personal identification medium 10 receives the random number from the vehicle 60, the personal identification medium 10 digitally signs the random number using a private key recorded in the vehicle 60 (step S803). The private key used at this time may be the first private key or the second private key. However, which private key is used is determined in advance between the vehicle 60 and the other device.

[0105] The personal identification medium 10 transmits the signed random number as the signature result to the vehicle 60 (step S805). The signature result transmitted at this time corresponds to the authentication information in step S008 of FIG. 9. When the vehicle 60 receives the signature result from the personal identification medium 10, it transmits the received signature result to the vehicle identification medium 70 (step S805). The vehicle identification medium 70 uses the public key included in the electronic certificate of the usage permit and the signature result to determine whether the user of the vehicle 60 is a legitimate user (step S806). The public key used at this time is the public key corresponding to the private key used in the processing of step S803.

[0106] The vehicle identification medium 70 transmits the determination result to the vehicle 60 (step S807). If the determination result indicates that the user is a valid user (a user to whom a usage permit has been issued), the vehicle 60 determines to permit use of the vehicle 60. On the other hand, if the determination result indicates that the above-mentioned predetermined conditions are not satisfied, the vehicle 60 determines not to permit use of the vehicle. In response to the determination result, the main control unit 651 of the vehicle 60 performs an operation to permit use of the vehicle 60 (step S808). When operation is permitted, the vehicle 60 records the history of the operation of the vehicle 60 by the user until the user's use is terminated (step S809).

[0107] 19 and 20 are merely specific examples of the process of FIG. 18. Other processes may be applied as specific examples of FIG. 18. For example, in step S602 of FIG. 18, first identification information or second identification information (hereinafter simply referred to as "identification information") may be transmitted from the personal identification medium 10 to the vehicle 60 as authentication information. In this case, in the judgment process (step S603), the vehicle 60 may determine to permit use when the identification information included in the usage permit acquired from the vehicle identification medium 70 and the identification information acquired from the personal identification medium 10 indicate the same person (for example, when they match).

[0108] In the control system 100 configured in this manner, a usage permit including information recorded in the personal identification medium 10 is generated in the service management device 50. The usage permit generated in the service management device 50 is recorded in the vehicle identification medium 70 connected to the vehicle 60 to be provided. Then, when a user uses the vehicle 60, the information recorded in the user's personal identification medium 10 is used to determine whether the user is a legitimate user permitted to use the vehicle 60 according to the usage permit. Therefore, it is possible to easily provide the vehicle 60 to a legitimate user while preventing the vehicle 60 from being provided to an unauthorized user.

[0109] Moreover, the personal identification medium 10 stores information issued by the personal authentication authority 300, which is a strict authority. Using the information issued by the personal authentication authority 300, it is determined whether the user of the vehicle 60 is a legitimate user. This makes it possible to more strictly prevent the vehicle 60 from being provided to an unauthorized user. Furthermore, this mechanism makes it possible to guarantee the identity of a "legitimate user," and to prevent the vehicle 60 from being provided to a person whose identity is unknown but who has simply registered as a user in the service management device 50. For example, in Japan, such strict prevention may be realized by using a signature electronic certificate or a user authentication electronic certificate of a My Number card.

[0110] Furthermore, when the vehicle 60 determines whether the user is a legitimate user, the vehicle 60 may provide specific information (e.g., a random number) to the personal identification medium 10, and the vehicle 60 may perform the determination using information obtained by encrypting the random number with a personal private key. In this case, the vehicle 60 may decrypt the encrypted random number using a personal public key included in the usage permit recorded in the vehicle identification medium 70, and determine that the user is a legitimate user if the value obtained by decryption matches the random number provided to the personal identification medium 10. This configuration makes it possible to more reliably prevent the vehicle 60 from being provided to an unauthorized user.

[0111] Furthermore, the vehicle identification medium 70 stores information issued by the vehicle authentication authority 400, which is a strict institution. The information issued by the vehicle authentication authority 400 is used to register the applicant in the service management device 50. The vehicle 60 provided by the applicant registered in this manner is then provided to the user. This makes it possible to prevent a vehicle 60 that has some kind of fraudulent circumstances from being provided to the user.

[0112] Furthermore, when a provider wishes to register with the service management device 50, the provider's personal identification medium 10 is required. As described above, the personal identification medium 10 stores information issued by the personal authentication authority 300, which is a strict institution. This makes it possible to guarantee the identity of the "provider of the vehicle 60," and prevents the vehicle 60 from being provided by an unknown person who has merely registered as a user with the service management device 50. From this perspective, for example, in Japan, such an effect may be achieved by using a signature electronic certificate or a user authentication electronic certificate of a My Number card.

[0113] In addition, by executing the presence determination process in step S409, it is ensured that the vehicle 60 registered as a vehicle to be provided is in a usable state, which prevents a situation from occurring in which a user who has subsequently decided to use the vehicle 60 based on the provision conditions is unable to use the vehicle 60.

[0114] (Modification) In the presence determination process (step S409) shown in FIG. 15, the service management device 50 may determine whether the vehicle state information recorded in the vehicle identification medium 70 satisfies a predetermined condition. The vehicle state information is information on the state of the vehicle 60 to be provided. For example, the vehicle state information may be information indicating the registration status of the vehicle 60 in the automobile inspection and registration system, or information on the maintenance that the vehicle 60 has undergone. The vehicle state information may be recorded individually in the storage unit 72, may be included in the vehicle attribute information 722, or may be included in the vehicle electronic certificate 724. The predetermined condition of the vehicle state information is a condition indicating that no malfunction, legal problem, or safety problem will occur when the vehicle 60 is used. The predetermined condition of the vehicle state information may be, for example, that the registration in the automobile inspection and registration system has not expired, that the vehicle has undergone specific maintenance, or that the automobile liability insurance has not expired (is valid). In this case, the service management device 50 determines in the presence determination process that the vehicle state information satisfies a predetermined condition as one of the conditions for confirming that the vehicle 60 to be provided is in a usable state.

[0115] The service management device 50 may determine that the personal information of the person who wishes to use the vehicle satisfies a predetermined condition as a condition for executing the registration of the user member information in step S115 or as a condition for generating the license in step S512. A specific example of the personal information satisfying the predetermined condition is that the person who wishes to use the vehicle 60 does not have any safety or legal problems. More specifically, the predetermined condition of the personal information may be that the person who wishes to use the vehicle 60 is under a predetermined age (e.g., under 75 years old, under 80 years old, etc.) or has a valid driver's license. By determining such conditions, it is possible to prevent the vehicle 60 from being used by a person who has legal or safety problems when driving the vehicle 60.

[0116] The service management device 50 may obtain information about a specific driver, and may search for and output a user that matches the information. The specific driver is, for example, a driver who has committed a traffic violation. The information about the specific driver is known information about the vehicle that committed the traffic violation, and may be, for example, information about the license plate of the vehicle, information about the characteristics of the vehicle body, or information about the date, time, and place of the traffic violation. The service management device 50 searches for and outputs a user that matches the information about the specific driver as described above by referring to the performance information 523 and the provision application information 521. With this configuration, it is possible to know who was driving, when, and in which section, so that the driver who committed the violation can be identified.

[0117] [Driver service] Next, a specific example of the flow of operations when the control system 100 is applied to a driving agency service will be described. In a driving agency service, the person providing the vehicle 60 is a client (a proxy requester) who requests to receive the driving agency service. In a driving agency service, the person using the vehicle 60 is a person who drives the vehicle 60 in order to provide the driving agency service. Thus, in a driving agency service, the provision of the vehicle 60 corresponds to a request for a driving agency service, and the use of the vehicle 60 corresponds to the provision of the driving agency service.

[0118] 21 to 29 are sequence charts showing a specific example of the flow of operations when the control system 100 is applied to a driving service. First, a process flow when an agent provider who wishes to provide a driving service registers in the service management device 50 will be described with reference to FIGS. 21 and 22. The agent provider is a person who wishes to perform driving service for a vehicle 60 owned by another person in the driving service. The service management device 50 may be operated by an intermediary who mediates between the agent provider and the agent requester described later in the driving service. First, the agent provider performs an operation for registration in the service management device 50 on the input unit 23 of the communication device 20 (step S1101). In response to the operation by the agent provider, the communication device 20 transmits a registration request to the service management device 50 (step S1102). When the service management device 50 receives the registration request, it transmits an agent information request to the communication device 20 in response to the received registration request (step S1103). In the driving service, the request for agent information is a request for identification information (agent information) that indicates the agent provider. The agent information may be, for example, the first electronic certificate 121.

[0119] When the communication device 20 receives the proxy information request, it causes the output unit 24 to output a display prompting the input of personal first authentication information. The proxy provider inputs the personal first authentication information by operating the input unit 23 (step S1104). The personal first authentication information may be, for example, a preset PIN code. The communication device 20 transmits the personal first authentication information input via the input unit 23 to the personal identification medium 10 (step S1105). The personal identification medium 10 executes authentication processing based on the received personal first authentication information (step S1106). The communication device 20 requests the personal identification medium 10 to provide a digital signature regarding the proxy information to be registered (step S1107). The proxy information to be registered is information regarding the proxy provider. The proxy information may include user information (e.g., name, age, address, gender, etc.) input by the user in the communication device 20. The proxy information may include personal information included in the first electronic certificate 121.

[0120] If the proxy provider is authenticated as a result of the personal first authentication process in step S1106, the personal identification medium 10 digitally signs the proxy information to be registered using the first private key 122 in response to the request in step S1107 (step S1108). The digital signature may be realized, for example, by performing encryption processing using the first private key on a hash value obtained from the proxy information. The personal identification medium 10 transmits the proxy information with the digital signature (signed proxy information) to the communication device 20 (step S1109). The communication device 20 transmits the proxy information received from the personal identification medium 10 to the service management device 50 (step S1110). The service management device 50 executes a second authentication process on the received proxy information (step S1111). In the second authentication process, the service management device 50 determines whether the proxy information has been tampered with.

[0121] If it is determined that there has been tampering, the service management device 50 does not proceed any further and ends the process. In this case, the service management device 50 may notify the communication device 20 of an error. On the other hand, if it is determined that there has been no tampering, the service management device 50 transmits a revocation determination request for the first electronic certificate included in the received agent information to the personal authentication device 30 (step S1112). Upon receiving the revocation determination request, the personal authentication device 30 performs a revocation determination for the first electronic certificate that is the subject of the process (step S1113). The personal authentication device 30 transmits a revocation determination response including the result of the revocation determination to the service management device 50 (step S1114).

[0122] If the revocation determination result indicates revocation, the service management device 50 ends the process without proceeding any further. In this case, the service management device 50 may notify the communication device 20 of an error. On the other hand, if the revocation determination result does not indicate revocation, the service management device 50 registers information such as the name and address included in the agent information received in step S1110, and the personal information and first identification information included in the first electronic certificate, as agent member information in the storage unit 52 (step S1115). The service management device 50 notifies the communication device 20 that the registration of the agent member information has been completed (step S1116). When the communication device 20 receives the notification of completion of the registration of the agent member information, it outputs information indicating that the registration has been completed via the output unit 24. For example, the communication device 20 displays a screen indicating that the registration has been completed on the output unit 24 (step S1117).

[0123] Next, a process flow for a proxy requester who wishes to request proxy driving of a vehicle 60 to obtain a vehicle electronic certificate required for registration in the service management device 50 will be described with reference to FIG. 23. A proxy requester is a person who wishes to request a proxy driving service to drive the vehicle 60 owned by the proxy requester from another person (proxy provider). First, the proxy requester performs an operation for registration in the vehicle authentication device 40 on the input unit 23 of the communication device 20 (step S1201). In response to the operation by the proxy requester, the communication device 20 transmits a new registration request to the vehicle authentication device 40 (step S1202). The process from step S1202 onwards is the same as the process from step S202 onwards in FIG. 12. Therefore, the description will be omitted.

[0124] Next, a process flow when a proxy requester who wishes to request a proxy driving service for a vehicle 60 registers with the service management device 50 will be described with reference to Figs. 24 and 25. First, the proxy requester operates the input unit 23 of the communication device 20 for registration with the service management device 50 (step S1301). In response to the operation by the proxy requester, the communication device 20 transmits a registration request to the service management device 50 (step S1302). Upon receiving the registration request, the service management device 50 transmits a requester / vehicle information request to the communication device 20 in response to the received registration request (step S1303). The requester / vehicle information request is a request for identification information indicating the proxy requester and identification information indicating the vehicle that is the subject of the proxy driving service.

[0125] When the communication device 20 receives the requester / vehicle information request, it executes an information acquisition process to acquire signed requester information using the personal identification medium 10 of the proxy requester. The signed requester information is requester information to which a digital signature using a first private key has been applied. The process of acquiring signed requester information is similar to the process of acquiring signed proxy information in steps S1104 to S1109 in FIG. 21. Therefore, a detailed description will be omitted. The requester information is information about the proxy requester. The requester information may include user information (e.g., name, age, address, gender, etc.) input by the user in the communication device 20. The requester information may include personal information included in the first electronic certificate 121.

[0126] The communication device 20 also causes the output unit 24 to output a display prompting the input of the vehicle first authentication information. The agent requester inputs the vehicle first authentication information by operating the input unit 23 (step S1304). The vehicle first authentication information may be, for example, a preset PIN code. The communication device 20 transmits the vehicle first authentication information input via the input unit 23 to the vehicle identification medium 70 (step S1305). The vehicle identification medium 70 executes the vehicle first authentication process based on the received vehicle first authentication information (step S1306). The communication device 20 requests a digital signature from the vehicle identification medium 70 (step S1307). At this time, the communication device 20 generates, for example, a random number or an electronic document (or a hash value thereof) used for the digital signature and transmits it to the vehicle identification medium 70.

[0127] If the result of the authentication process in step S1306 is that the proxy requester is authenticated, the vehicle identification medium 70, in response to the request in step S1307, digitally signs the data (random number, electronic document, hash value, etc.) transmitted from the communication device 20 using the vehicle private key 725 (step S1308). The vehicle identification medium 70 transmits a digital signature response including the digitally signed data and the vehicle electronic certificate to the communication device 20 (step S1309). The communication device 20 transmits the digital signature response received from the vehicle identification medium 70 and the requester information of the proxy requester acquired in the information acquisition process to the service management device 50 (step S1310). The service management device 50 determines whether the first electronic certificate and the vehicle electronic certificate of the received requester information have been tampered with (step S1311).

[0128] If it is determined that there is tampering, the service management device 50 does not proceed further and ends the process. In this case, the service management device 50 may notify the communication device 20 of an error. On the other hand, if it is determined that there is no tampering, the service management device 50 performs a revocation determination for the received first electronic certificate and vehicle electronic certificate. For the first electronic certificate, a personal revocation determination process is executed for the personal authentication device 30. The personal revocation determination process is the same process as the process described in steps S1112 to S1114, so a description is omitted. For the vehicle electronic certificate, a revocation determination request is transmitted to the vehicle authentication device 40 (step S1312). When the vehicle authentication device 40 receives the revocation determination request, it performs a revocation determination for the vehicle electronic certificate that is the subject of the process (step S1313). The vehicle authentication device 40 transmits a revocation determination response including the result of the revocation determination to the service management device 50 (step S1314).

[0129] If any of the revocation determination results indicates revocation, the service management device 50 ends the process without proceeding any further. In this case, the service management device 50 may notify the communication device 20 of an error. On the other hand, if none of the revocation determination results indicates revocation, the service management device 50 registers the requester information received in step S1310 and the vehicle identification information included in the vehicle electronic certificate as request member information in the storage unit 52 (step S1315). The service management device 50 notifies the communication device 20 that the registration of the request member information has been completed (step S1316). When the communication device 20 receives the registration completion notification of the request member information, it outputs information indicating that the registration has been completed via the output unit 24. For example, the communication device 20 displays a screen indicating that the registration has been completed on the output unit 24 (step S1317). In addition, the service management device 50 registers the request initial information in the storage unit 52 (step S1318). The request initial information includes the key information 524. For example, at the timing of step S1318, the service management device 50 may generate key information 524 for the agent requester and store it in association with the agent requester's first electronic certificate 121 and the vehicle electronic certificate. The service management device 50 records the request initial information in the vehicle identification medium 70 (step S1319). At this time, for example, a service AP 727, a service private key 728, and the public key of the service management device 50 may be recorded in the vehicle identification medium 70. In particular, it is desirable that the service private key 728 be recorded in the vehicle identification medium 70 using a secure means.

[0130] Next, a process flow when a proxy requester who wishes to request a proxy driving service for a vehicle 60 submits a request to the service management device 50 will be described with reference to FIG. 26. First, the proxy requester operates the input unit 23 of the communication device 20 to submit a request to the service management device 50 (step S1401). In response to the operation by the proxy requester, the communication device 20 transmits a request application request to the service management device 50 (step S1402). Upon receiving the request application request, the service management device 50 transmits a requester information request to the communication device 20 in response to the received request application request (step S1403). The requester information request is a request for identification information indicating the requester who is the requester of the vehicle 60 that is the subject of proxy driving service.

[0131] Next, an information acquisition process (steps S1104 to S1109) is executed between the communication device 20 and the personal identification medium 10. By executing the information acquisition process, requester information is acquired from the personal identification medium 10 of the requester. The communication device 20 transmits the requester information to the service management device 50 (step S1404). The service management device 50 judges whether the first certificate of the received requester information has been tampered with (step S1405). If it is judged that there has been tampering, the service management device 50 does not proceed further and ends the process. In this case, the service management device 50 may notify the communication device 20 of an error. On the other hand, if it is judged that there has been no tampering, the service management device 50 performs a revocation judgment on the received first electronic certificate. For the first electronic certificate, an individual revocation judgment process is executed on the personal authentication device 30. The individual revocation judgment process is the same as the process described in steps S1112 to S1114, and therefore a description thereof will be omitted.

[0132] If the revocation determination result indicates revocation, the service management device 50 does not proceed any further and ends the process. In this case, the service management device 50 may notify the communication device 20 of an error. On the other hand, if the revocation determination result does not indicate revocation, the service management device 50 transmits a request condition request to the communication device 20 (step S1406). The request condition request is a request for information indicating conditions related to a request for a designated driving service.

[0133] When the communication device 20 receives the request condition request, it performs output to prompt the agent requester to input conditions related to the request for the driving service service. For example, the communication device 20 displays a screen for inputting conditions on the output unit 24. The agent requester inputs the request conditions into the communication device 20 by operating the input unit 23 (step S1407). The communication device 20 transmits a request condition response indicating the input request conditions to the service management device 50 (step S1408).

[0134] When the service management device 50 receives the request condition response, it executes a presence determination process for the vehicle identification medium 70 related to the vehicle 60 registered as a target of the driving service (step S1409). The presence determination process is a process for confirming that the vehicle identification medium 70 related to the target vehicle 60 of the driving service is in a usable state, for example, by transmitting a specific signal to the vehicle identification medium 70. When it is confirmed in the presence determination process that the target vehicle 60 of the driving service is in a usable state, the service management device 50 registers information indicating the received request condition in the storage unit 52 as the provision application information 521 (step S1410). On the other hand, when it is not confirmed in the presence determination process that the target vehicle 60 of the driving service is in a usable state, the service management device 50 ends the process without proceeding any further. In this case, the service management device 50 may notify the communication device 20 of an error. When the registration is completed, the service management device 50 notifies the communication device 20 that the registration of the request condition is completed (step S1411). When the communication device 20 receives the registration notification of the request conditions, the communication device 20 outputs information indicating that the registration has been completed via the output unit 24. For example, the communication device 20 displays a screen indicating that the registration has been completed on the output unit 24 (step S1412).

[0135] Next, a process flow when a proxy provider who wishes to drive a vehicle 60 applies for a proxy service to the service management device 50 will be described with reference to FIG. 27 and FIG. 28. In FIG. 27 and FIG. 28, the vehicle identification medium 70 is communicably connected to the first communication unit 61 of the vehicle 60. For example, when the first communication unit 61 is configured using an in-vehicle device, the vehicle identification medium 70 may remain inserted in a physical interface such as an outlet provided in the in-vehicle device. First, the proxy provider performs an operation for applying for a proxy service to the service management device 50 on the input unit 23 of the communication device 20 (step S1501). In response to the operation by the proxy provider, the communication device 20 transmits a proxy application request to the service management device 50 (step S1502). When the service management device 50 receives the proxy application request, it transmits a proxy information request to the communication device 20 in response to the received proxy application request (step S1503). The proxy information request is a request for identification information indicating the proxy provider.

[0136] When the communication device 20 receives the agent information request, the communication device 20 executes an information acquisition process to acquire the signed agent information using the personal identification medium 10 of the agent provider. The process of acquiring the signed agent information is the same as steps S104 to S109 in FIG. 10. Therefore, detailed description will be omitted. The communication device 20 transmits the signed agent information to the service management device 50 (step S1504). The service management device 50 judges whether the received signed agent information has been tampered with (step S1505). If it is judged that the signed agent information has been tampered with, the service management device 50 does not proceed further and ends the process. In this case, the service management device 50 may notify the communication device 20 of an error. On the other hand, if it is judged that the signed agent information has not been tampered with, the service management device 50 performs a revocation judgment on the first electronic certificate included in the received signed agent information. For the first electronic certificate, a personal revocation judgment process is executed on the personal authentication device 30. The individual revocation determination process is similar to the processes described in steps S1112 to S1114, and therefore a description thereof will be omitted.

[0137] If the revocation determination result indicates revocation, the service management device 50 ends the process without proceeding any further. In this case, the service management device 50 may notify the communication device 20 of an error. On the other hand, if the revocation determination result does not indicate revocation, the service management device 50 transmits a proxy condition request to the communication device 20 (step S1506). The proxy condition request is a request for information indicating conditions related to the proxy driving of a vehicle. The conditions related to the proxy driving include, for example, information related to the vehicle 60 (such as the type of vehicle and size), information related to the location of the proxy driving, and information indicating the timing of the proxy driving (for example, information indicating the start date and time of use and the end date and time of use). The conditions related to the proxy driving may further include other conditions.

[0138] When the communication device 20 receives the proxy condition request, it performs output to prompt the proxy provider to input conditions related to the proxy driving of the vehicle. For example, the communication device 20 displays a screen for inputting conditions on the output unit 24. The proxy provider inputs the conditions of the proxy driving to the communication device 20 by operating the input unit 23 (step S1507). The communication device 20 transmits a proxy condition response indicating the input conditions of the proxy driving to the service management device 50 (step S1508).

[0139] When the service management device 50 receives the proxy condition response, it searches for the provision application information 521 registered in the storage unit 52 that satisfies the received proxy condition. Then, the service management device 50 selects one provision application information 521 from the provision application information 521 that satisfies the proxy condition, and determines the vehicle corresponding to the selected provision application information 521 as a vehicle to be substituted (step S1509). The service management device 50 generates the use application information 522 based on the selected provision application information 521 and information on the proxy provider, and registers it in the storage unit 52. Then, the service management device 50 notifies the communication device 20 of information indicating the determined vehicle to be substituted (step S1510). When the communication device 20 receives the information notification of the vehicle to be substituted, it outputs the information indicating the vehicle to be substituted via the output unit 24. For example, the communication device 20 displays a screen indicating a part or all of the use application information 522 on the output unit 24 (step S1511).

[0140] The service management device 50 generates a usage permit based on the use application information 522 (step S1512). The service management device 50 digitally signs the generated usage permit (step S1513). The service management device 50 transmits the signed usage permit to the vehicle 60 that is the subject of the usage permit (step S1514). Thereafter, the service management device 50 determines whether the signed usage permit has been tampered with by using the public key and digital signature of the service management device 50 (step S1515). As described above, this determination process may be performed in the vehicle 60 or in the vehicle identification medium 70. If the usage permit has been tampered with, the vehicle 60 stops the process. On the other hand, if the usage permit has not been tampered with, the vehicle 60 performs an operation to write the usage permit to the vehicle identification medium 70 connected to the vehicle 60 (step S1516). The control unit 73 of the vehicle identification medium 70 records the usage permit in the storage unit 72 according to the control by the vehicle 60 (step S1517).

[0141] Next, the flow of processing when an agency provider, whose usage application information 522 has already been registered, uses a vehicle 60 (drives on behalf of another agency provider) will be described with reference to FIG. 29. First, the agency provider connects the personal identification medium 10 used in the agency application to the agency-provided vehicle 60 so that the personal identification medium 10 can communicate with the agency-provided vehicle 60. When the vehicle 60 detects that the personal identification medium 10 has been connected to the vehicle 60, the vehicle 60 reads the recorded usage permit itself or information contained in the usage permit from the vehicle identification medium 70 connected to the vehicle 60 (step S1601). The vehicle 60 also reads information used for authentication (authentication information) from the personal identification medium 10 of the user (agency provider) (step S1602).

[0142] When the vehicle 60 satisfies a predetermined condition indicating that the user (agent provider) is a legitimate user (agent provider to which a usage permit has been issued), the vehicle 60 judges that the use of the vehicle 60 is permitted (step S1603). On the other hand, when the above-mentioned predetermined condition is not satisfied, the vehicle 60 judges that the use of the vehicle is not permitted. In response to the judgment result, the main control unit 651 of the vehicle 60 performs an operation to enable the use of the vehicle 60 (step S1604). When the operation of the vehicle 60 is permitted, the vehicle 60 records the operation history of the vehicle 60 by the agent provider until the use by the agent provider ends (step S1605). When the use by the agent provider ends, the vehicle 60 transmits the operation history recorded up to that time to the service management device 50. When the service management device 50 receives the operation history, it records the received history information in the storage unit 52 as the performance information 523. Note that the processing shown in FIG. 19 or FIG. 20 may be applied as a specific example of the processing shown in FIG. 29.

[0143] In this way, the control system 100 applied to the driving service can achieve the same effect as the control system 100 applied to car sharing. Moreover, the control system 100 applied to the driving service can be modified in the same manner as the control system 100 applied to car sharing. In this case, the presence determination process (step S409) shown in FIG. 15 corresponds to the presence determination process (step S1409) shown in FIG. 26. Moreover, the conditions for registering the user member information in step S115 and the conditions for generating the usage license in step S512 correspond to the conditions for registering the agent member information in step S1115 and the conditions for generating the usage license in step S1512, respectively.

[0144] [Transfer transportation] Next, a specific example of the flow of operations when the control system 100 is applied to connecting transportation will be described. Connecting transportation is when multiple drivers make connections when driving at least one vehicle 60 from one point (starting point) to another point (end point). In connecting transportation, the person providing the vehicle 60 is the requester (transportation requester) who requests the connecting transportation. In connecting transportation, the person using the vehicle 60 is the person who drives the vehicle 60. Thus, in connecting transportation, the provision of the vehicle 60 corresponds to a request for transportation, and the use of the vehicle 60 corresponds to driving the vehicle 60.

[0145] In the transit transportation, the service management device 50 sets a plurality of relay points between the starting point and the end point registered by the transportation requester. The setting of the plurality of relay points may be performed by the transportation requester or may be performed by the service management device 50. When the relay points are set by the service management device 50, the relay points may be set from among points registered in advance in the service management device 50 as points where parking is easy, such as service areas. In this case, for example, the intervals between the starting point, each relay point, and the end point may be automatically set so as to satisfy a predetermined condition. The predetermined condition may be, for example, a condition that the time required when moving at a predetermined general speed satisfies a condition based on a reference value (for example, within 10 minutes around the reference value), or a condition that satisfies a condition based on a predetermined distance (for example, within 10 kilometers around the above distance). In addition, the relay points may be set by dividing the starting point to the end point at approximately equal intervals so that the number set by the transportation requester divides the distance.

[0146] FIG. 30 to FIG. 38 are sequence charts showing a specific example of the flow of operations when the control system 100 is applied to transit transportation. First, a process flow when a driver who desires transportation registers in the service management device 50 will be described with reference to FIG. 30 and FIG. 31. The driver who desires transportation is a person who desires to drive a vehicle 60 owned by another person in transit transportation, if there is a transfer with another person. The service management device 50 may be operated by an intermediary who mediates between the driver who desires transportation and a transportation requester described later in transit transportation. First, the driver who desires to drive performs an operation for registration in the service management device 50 on the input unit 23 of the communication device 20 (step S2101). In response to the operation by the driver who desires to drive, the communication device 20 transmits a registration request to the service management device 50 (step S2102). When the service management device 50 receives the registration request, it transmits a driver information request to the communication device 20 in response to the received registration request (step S2103). In a connecting transportation, a driver information request is a request for identification information (driver information) indicating a person who wishes to drive. The driver information may be, for example, the first electronic certificate 121.

[0147] When the communication device 20 receives the driver information request, it causes the output unit 24 to output a display prompting the input of personal first authentication information. The driver aspirant inputs the personal first authentication information by operating the input unit 23 (step 2104). The personal first authentication information may be, for example, a preset PIN code. The communication device 20 transmits the personal first authentication information input via the input unit 23 to the personal identification medium 10 (step S2105). The personal identification medium 10 executes authentication processing based on the received personal first authentication information (step S2106). The communication device 20 requests the personal identification medium 10 for a digital signature regarding the driver information to be registered (step S2107). The driver information to be registered is information regarding the driver aspirant. The driver information may include user information (for example, name, age, address, gender, etc.) input by the user in the communication device 20. The driver information may include personal information included in the first electronic certificate 121.

[0148] If the driver applicant is authenticated as a result of the personal first authentication process in step S2106, the personal identification medium 10, in response to the request in step S2107, digitally signs the driver information to be registered using the first private key 122 (step S2108). The digital signature may be realized, for example, by encrypting a hash value obtained from the driver information using the first private key. The personal identification medium 10 transmits the driver information with the digital signature (signed driver information) to the communication device 20 (step S2109). The communication device 20 transmits the driver information received from the personal identification medium 10 to the service management device 50 (step S2110). The service management device 50 executes a second authentication process on the received driver information (step S2111). In the second authentication process, the service management device 50 determines whether the driver information has been tampered with.

[0149] If it is determined that there has been tampering, the service management device 50 does not proceed any further and ends the process. In this case, the service management device 50 may notify the communication device 20 of an error. On the other hand, if it is determined that there has been no tampering, the service management device 50 transmits a revocation determination request for the first electronic certificate included in the received driver information to the personal authentication device 30 (step S2112). Upon receiving the revocation determination request, the personal authentication device 30 performs a revocation determination for the first electronic certificate that is the subject of processing (step S2113). The personal authentication device 30 transmits a revocation determination response including the result of the revocation determination to the service management device 50 (step S2114).

[0150] If the revocation determination result indicates revocation, the service management device 50 ends the process without proceeding any further. In this case, the service management device 50 may notify the communication device 20 of an error. On the other hand, if the revocation determination result does not indicate revocation, the service management device 50 registers information such as the name and address included in the driver information received in step S2110, and the personal information and first identification information included in the first electronic certificate as driver member information in the storage unit 52 (step S2115). The service management device 50 notifies the communication device 20 that the registration of the driver member information has been completed (step S2116). When the communication device 20 receives the notification of the completion of the registration of the driver member information, it outputs information indicating that the registration has been completed via the output unit 24. For example, the communication device 20 displays a screen indicating that the registration has been completed on the output unit 24 (step S2117).

[0151] Next, referring to FIG. 32, a process flow for a transportation requester who wishes to request driving of a vehicle 60 to obtain a vehicle electronic certificate required for registration in the service management device 50 will be described. A transportation requester is a person who wishes to request another person (desiring driver) to drive the vehicle 60 owned by the transportation requester in a connecting transportation. First, the transportation requester performs an operation for registration in the vehicle authentication device 40 on the input unit 23 of the communication device 20 (step S2201). In response to the operation by the transportation requester, the communication device 20 transmits a new registration request to the vehicle authentication device 40 (step S2202). The process from step S2202 onwards is the same as the process from step S202 onwards in FIG. 12. Therefore, the description will be omitted.

[0152] Next, a process flow when a transport requester who wishes to request driving of a vehicle 60 registers with the service management device 50 will be described with reference to Figs. 33 and 34. First, the transport requester operates the input unit 23 of the communication device 20 for registration with the service management device 50 (step S2301). In response to the operation by the transport requester, the communication device 20 transmits a registration request to the service management device 50 (step S2302). Upon receiving the registration request, the service management device 50 transmits a requester / vehicle information request to the communication device 20 in response to the received registration request (step S2303). The requester / vehicle information request is a request for identification information indicating the transport requester and identification information indicating the vehicle to be driven.

[0153] When the communication device 20 receives the requester / vehicle information request, it executes an information acquisition process to acquire signed requester information using the personal identification medium 10 of the transportation requester. The signed requester information is requester information to which a digital signature using a first private key has been applied. The process of acquiring signed requester information is similar to the process of acquiring signed driver information in steps S2104 to S2109 of FIG. 30. Therefore, a detailed description will be omitted. The requester information is information related to the agent requester. The requester information may include user information (e.g., name, age, address, gender, etc.) input by the user in the communication device 20. The requester information may include personal information included in the first electronic certificate 121.

[0154] The communication device 20 also outputs a display on the output unit 24 to prompt the user to input the vehicle first authentication information. The transport requester inputs the vehicle first authentication information by operating the input unit 23 (step S2304). The vehicle first authentication information may be, for example, a preset PIN code. The communication device 20 transmits the vehicle first authentication information input via the input unit 23 to the vehicle identification medium 70 (step S2305). The vehicle identification medium 70 executes a vehicle first authentication process based on the received vehicle first authentication information (step S2306). The communication device 20 requests a digital signature from the vehicle identification medium 70 (step S2307). At this time, the communication device 20 generates, for example, a random number or an electronic document (or a hash value thereof) used in the digital signature and transmits it to the vehicle identification medium 70.

[0155] If the transport requester is authenticated as a result of the authentication process in step S2306, the vehicle identification medium 70, in response to the request in step S2307, digitally signs the data (random number, electronic document, hash value, etc.) transmitted from the communication device 20 using the vehicle private key 725 (step S2308). The vehicle identification medium 70 transmits a digital signature response including the digitally signed data and the vehicle electronic certificate to the communication device 20 (step S2309). The communication device 20 transmits the digital signature response received from the vehicle identification medium 70 and the requester information of the transport requester acquired in the information acquisition process to the service management device 50 (step S2310). The service management device 50 determines whether the first electronic certificate and the vehicle electronic certificate of the received requester information have been tampered with (step S2311).

[0156] If it is determined that there is tampering, the service management device 50 does not proceed any further and ends the process. In this case, the service management device 50 may notify the communication device 20 of an error. On the other hand, if it is determined that there is no tampering, the service management device 50 performs a revocation determination for the received first electronic certificate and vehicle electronic certificate. For the first electronic certificate, a personal revocation determination process is executed for the personal authentication device 30. The personal revocation determination process is the same as the process described in steps S2112 to S2114, so a description is omitted. For the vehicle electronic certificate, a revocation determination request is transmitted to the vehicle authentication device 40 (step S2312). When the vehicle authentication device 40 receives the revocation determination request, it performs a revocation determination for the vehicle electronic certificate that is the subject of the process (step S2313). The vehicle authentication device 40 transmits a revocation determination response including the result of the revocation determination to the service management device 50 (step S2314).

[0157] If any of the revocation determination results indicates revocation, the service management device 50 ends the process without proceeding any further. In this case, the service management device 50 may notify the communication device 20 of an error. On the other hand, if none of the revocation determination results indicates revocation, the service management device 50 registers the requester information received in step S2310 and the vehicle identification information included in the vehicle electronic certificate as request member information in the storage unit 52 (step S2315). The service management device 50 notifies the communication device 20 that the registration of the request member information has been completed (step S2316). When the communication device 20 receives the registration completion notification of the request member information, it outputs information indicating that the registration has been completed via the output unit 24. For example, the communication device 20 displays a screen indicating that the registration has been completed on the output unit 24 (step S2317). In addition, the service management device 50 registers the request initial information in the storage unit 52 (step S2318). The request initial information includes the key information 524. For example, at the timing of step S2318, the service management device 50 may generate key information 524 for the transport requester and store it in association with the first electronic certificate 121 of the transport requester and the vehicle electronic certificate. The service management device 50 records the request initial information in the vehicle identification medium 70 (step S2319). At this time, for example, a service AP 727, a service private key 728, and the public key of the service management device 50 may be recorded in the vehicle identification medium 70. In particular, it is desirable that the service private key 728 be recorded in the vehicle identification medium 70 using a secure means.

[0158] Next, a process flow when a transportation requester who wishes to request driving of a vehicle 60 submits a request to the service management device 50 will be described with reference to FIG. 35. First, the transportation requester operates the input unit 23 of the communication device 20 to submit a request to the service management device 50 (step S2401). In response to the operation by the transportation requester, the communication device 20 transmits a request application request to the service management device 50 (step S2402). Upon receiving the request application request, the service management device 50 transmits a requester information request to the communication device 20 in response to the received request application request (step S2403). The requester information request is a request for identification information indicating the requester who requested the vehicle 60 to be driven.

[0159] Next, an information acquisition process (steps S2104 to S2109) is executed between the communication device 20 and the personal identification medium 10. By executing the information acquisition process, requester information is acquired from the personal identification medium 10 of the requester. The communication device 20 transmits the requester information to the service management device 50 (step S2404). The service management device 50 judges whether the first certificate of the received requester information has been tampered with (step S2405). If it is judged that there has been tampering, the service management device 50 does not proceed further and ends the process. In this case, the service management device 50 may notify the communication device 20 of an error. On the other hand, if it is judged that there has been no tampering, the service management device 50 performs a revocation judgment on the received first electronic certificate. For the first electronic certificate, an individual revocation judgment process is executed on the personal authentication device 30. The individual revocation judgment process is the same as the process described in steps S2112 to S2114, and therefore a description thereof will be omitted.

[0160] If the revocation determination result indicates revocation, the service management device 50 ends the process without proceeding any further. In this case, the service management device 50 may notify the communication device 20 of an error. On the other hand, if the revocation determination result does not indicate revocation, the service management device 50 transmits a requested conditions request to the communication device 20 (step S2406). The requested conditions request is a request for information indicating conditions related to the driving request.

[0161] When the communication device 20 receives the request condition request, it performs output to prompt the transportation requester to input conditions related to the driving request. For example, the communication device 20 displays a screen for inputting conditions on the output unit 24. The transportation requester inputs the request conditions into the communication device 20 by operating the input unit 23 (step S2407). The communication device 20 transmits a request condition response indicating the input request conditions to the service management device 50 (step S2408).

[0162] When the service management device 50 receives the request condition response, it executes a presence determination process for the vehicle identification medium 70 related to the vehicle 60 registered as the target of driving (step S2409). The presence determination process is a process for confirming that the vehicle identification medium 70 related to the target vehicle 60 is in a usable state, for example, by transmitting a specific signal to the vehicle identification medium 70. If it is confirmed in the presence determination process that the target vehicle 60 is in a usable state, the service management device 50 registers information indicating the received request condition in the storage unit 52 as the provision application information 521 (step S2410). On the other hand, if it is not confirmed in the presence determination process that the target vehicle 60 is in a usable state, the service management device 50 ends the process without proceeding any further. In this case, the service management device 50 may notify the communication device 20 of an error. When the registration is completed, the service management device 50 notifies the communication device 20 that the registration of the request condition is completed (step S2411). When the communication device 20 receives the registration notification of the request conditions, the communication device 20 outputs information indicating that the registration has been completed via the output unit 24. For example, the communication device 20 displays a screen indicating that the registration has been completed on the output unit 24 (step S2412).

[0163] Next, a process flow when a driver who wishes to drive the vehicle 60 applies for driving to the service management device 50 will be described with reference to FIG. 36 and FIG. 37. In FIG. 36 and FIG. 37, the vehicle identification medium 70 is communicably connected to the first communication unit 61 of the vehicle 60. For example, when the first communication unit 61 is configured using an in-vehicle device, the vehicle identification medium 70 may remain inserted in a physical interface such as an outlet provided in the in-vehicle device. First, the driver who wishes to drive performs an operation on the input unit 23 of the communication device 20 to apply for driving to the service management device 50 (step S2501). In response to the operation by the driver who wishes to drive, the communication device 20 transmits a driving application request to the service management device 50 (step S2502). When the service management device 50 receives the driving application request, it transmits a driver information request to the communication device 20 in response to the received driving application request (step S2503). The driver information request is a request for identification information indicating the driver who wishes to drive.

[0164] When the communication device 20 receives the driver information request, it executes an information acquisition process to acquire the signed driver information using the personal identification medium 10 of the driver applicant. The process of acquiring the signed driver information is the same as steps S104 to S109 in FIG. 10. Therefore, detailed description will be omitted. The communication device 20 transmits the signed driver information to the service management device 50 (step S2504). The service management device 50 judges whether the received signed driver information has been tampered with (step S2505). If it is judged that the signed driver information has been tampered with, the service management device 50 does not proceed further and ends the process. In this case, the service management device 50 may notify the communication device 20 of an error. On the other hand, if it is judged that the signed driver information has not been tampered with, the service management device 50 performs a revocation judgment on the first electronic certificate included in the received signed driver information. For the first electronic certificate, a personal revocation judgment process is executed on the personal authentication device 30. The individual revocation determination process is similar to the processes described in steps S2112 to S2114, and therefore a description thereof will be omitted.

[0165] If the revocation determination result indicates revocation, the service management device 50 ends the process without proceeding any further. In this case, the service management device 50 may notify the communication device 20 of an error. On the other hand, if the revocation determination result does not indicate revocation, the service management device 50 transmits a driving condition request to the communication device 20 (step S2506). The driving condition request is a request for information indicating conditions related to vehicle driving. The driving conditions include, for example, information related to the vehicle 60 (such as the type of vehicle and size), information related to the driving location, and information indicating the time of driving (for example, information indicating the start date and time of use and the end date and time of use). The driving conditions may further include other conditions.

[0166] When the communication device 20 receives the driving condition request, it performs output to prompt the aspiring driver to input conditions related to driving the vehicle. For example, the communication device 20 displays a screen for inputting conditions on the output unit 24. The aspiring driver inputs the driving conditions to the communication device 20 by operating the input unit 23 (step S2507). The communication device 20 transmits a driving condition response indicating the input driving conditions to the service management device 50 (step S2508).

[0167] When the service management device 50 receives the driving condition response, it searches for the provision application information 521 registered in the storage unit 52 that satisfies the received driving condition. Then, the service management device 50 selects one of the provision application information 521 that satisfies the driving condition, and determines the vehicle corresponding to the selected provision application information 521 as the driving planned vehicle (step S2509). The service management device 50 generates the usage application information 522 based on the selected provision application information 521 and information on the driver, and registers it in the storage unit 52. Then, the service management device 50 notifies the communication device 20 of information indicating the determined driving planned vehicle (step S2510). When the communication device 20 receives the information notification of the driving planned vehicle, it outputs the information indicating the driving planned vehicle via the output unit 24. For example, the communication device 20 displays a screen indicating a part or all of the usage application information 522 on the output unit 24 (step S2511).

[0168] The service management device 50 generates a usage permit based on the use application information 522 (step S2512). The service management device 50 digitally signs the generated usage permit (step S2513). The service management device 50 transmits the signed usage permit to the vehicle 60 that is the subject of the usage permit (step S2514). Thereafter, the service management device 50 determines whether the received signed usage permit has been tampered with by using the public key and digital signature of the service management device 50 (step S2515). As described above, this determination process may be performed in the vehicle 60 or in the vehicle identification medium 70. If the usage permit has been tampered with, the vehicle 60 stops the process. On the other hand, if the usage permit has not been tampered with, the vehicle 60 performs an operation to write the usage permit to the vehicle identification medium 70 connected to the vehicle 60 (step S2516). The control unit 73 of the vehicle identification medium 70 records the usage permit in the storage unit 72 according to the control by the vehicle 60 (step S2517).

[0169] Next, referring to FIG. 38, a process flow will be described when an applicant for driving, whose usage application information 522 has already been registered, uses (drives) the vehicle 60. First, the applicant for driving connects the personal identification medium 10 used in the application for driving to the provided vehicle 60 so that it can communicate with the vehicle. When the vehicle 60 detects that the personal identification medium 10 has been connected to the vehicle 60, the vehicle 60 reads the recorded usage permit itself or information contained in the usage permit from the vehicle identification medium 70 connected to the vehicle 60 (step S2601). The vehicle 60 also reads information used for authentication (authentication information) from the personal identification medium 10 of the user (applicant for driving) (step S2602).

[0170] When the vehicle 60 satisfies a predetermined condition indicating that the user (driver applicant) is a legitimate user (driver applicant who has been issued a usage permit), the vehicle 60 judges that the use of the vehicle 60 is permitted (step S2603). On the other hand, when the above-mentioned predetermined condition is not satisfied, the vehicle 60 judges that the use of the vehicle is not permitted. In response to the judgment result, the main control unit 651 of the vehicle 60 performs an operation to enable the use of the vehicle 60 (step S2604). When the operation of the vehicle 60 is permitted, the vehicle 60 records the operation history of the vehicle 60 by the driver until the driver's use ends (step S2605). When the driver's use ends, the vehicle 60 transmits the operation history recorded up to that point to the service management device 50. When the service management device 50 receives the operation history, the service management device 50 records the received history information as the performance information 523 in the storage unit 52. Note that the processing shown in FIG. 19 or FIG. 20 may be applied as a specific example of the processing shown in FIG. 38.

[0171] The control system 100 thus applied to transit transportation can also achieve the same effects as the control system 100 applied to car sharing. Moreover, the control system 100 thus applied to transit transportation may be modified in the same manner as the control system 100 applied to car sharing. In this case, the presence determination process (step S409) shown in FIG. 15 corresponds to the presence determination process (step S2409) shown in FIG. 35. Moreover, the conditions for registering the user member information in step S115 and the conditions for generating the usage permit in step S512 correspond to the conditions for registering the driving member information in step S2115 and the conditions for generating the usage permit in step S2512, respectively. Although an embodiment of the present invention has been described in detail above with reference to the drawings, the specific configuration is not limited to this embodiment, and designs that do not deviate from the gist of the present invention are also included. [Industrial Applicability]

[0172] The present invention is applicable to vehicle utilization control technology. [Explanation of symbols]

[0173] 100...control system, 10...personal identification medium, 121...first electronic certificate, 122...first private key, 123...second electronic certificate, 124...second private key, 131...communication control unit, 132...encryption unit, 20...communication device, 300...personal authentication authority, 30...personal authentication device, 321...personal electronic certificate information, 322...revocation information, 331...certification control unit, 332...revocation determination unit, 400...vehicle authentication authority, 40...vehicle authentication device, 421...vehicle electronic certificate information, 422...revocation information, 431...certification control unit, 432...revocation determination unit, 50...service management device, 521...provision application information, 522...use application information, 523...performance information, 524...key information, 531...information acquisition unit, 532...determination unit, 533... license generation unit, 534... performance management unit, 60... vehicle, 70... vehicle identification medium, 721... vehicle identification information, 722... vehicle attribute information, 723... owner information, 724... vehicle electronic certificate, 725... vehicle private key, 726... license information, 727... service AP, 728... service private key

Claims

[Claim 1] a determination unit that, in response to a request from a transportation requester for moving a specific vehicle from a certain point to another point by multiple users transferring, determines a user who will use the vehicle to move the vehicle in response to the request and the vehicle that will be used; a usage permit generating unit that generates a usage permit including user information that is information unique to a user of a vehicle and permission application information that indicates the content of permission for an application for use of the planned use vehicle determined by the determination unit; an encryption unit that affixes a digital signature to the license by using a predetermined private key; a storage medium for storing the license when it is determined that the license to which the electronic signature is attached satisfies a predetermined condition indicating that the license is a valid license using a public key corresponding to the private key; a vehicle control unit that performs an operation to enable a user who wishes to use the vehicle determined by the determination unit to operate the vehicle based on the permission application information when the user information of the user who wishes to use the vehicle determined by the determination unit or information paired with the user information stored in a personal identification medium that stores the user information and the user information included in the usage permit stored in the storage medium satisfy a predetermined condition; Equipped with The determination unit, in response to a request from a transportation requester to move a specified vehicle from a certain point to another point by multiple users transferring from the certain point to the other point, determines a user who wishes to use the vehicle and the vehicle that will be used in response to the request to move the vehicle from the certain point to the other point by using the vehicle.

Images