Information processing system, control method for information processing system, program and storage medium

Abstract

To accurately detect falsification of vehicle data.SOLUTION: An information processing system for detecting tampering of vehicle data includes a vehicle data acquisition unit configured to acquire first vehicle data and second vehicle data, a first tampering detection unit configured to detect a possibility of tampering of the vehicle data based on the first vehicle data and the second vehicle data, and a second tampering detection unit configured to detect tampering of the first vehicle data based on first evaluation data for evaluating the first vehicle data and detect tampering of the second vehicle data based on second evaluation data for evaluating the second vehicle data when the first tampering detection unit detects the possibility of tampering.SELECTED DRAWING: Figure 6

Description

[Technical Field]

[0001] This invention relates to a technology for detecting tampering with vehicle data. [Background technology]

[0002] Patent Document 1 discloses calculating a first vehicle speed V1 in accordance with a pulse signal proportional to the rotational speed of the drive wheels 12 output from a vehicle speed sensor 14, calculating a second vehicle speed V2 from a change in the vehicle position measured by a GPS receiver 16 or from the output signal of the GPS receiver 16, and determining whether or not the vehicle speed signal (first vehicle speed V1) has been tampered with based on a comparison of the first vehicle speed V1 and the second vehicle speed V2. [Prior art documents] [Patent Documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2012-126273 [Overview of the project] [Problems that the invention aims to solve]

[0004] However, the technology described in Patent Document 1 assumes that the second vehicle speed V2 is a correct value, but if the second vehicle speed V2 has been tampered with, it is not possible to determine whether the first vehicle speed V1 is correct. Thus, Patent Document 1 has the problem that it is difficult to accurately determine which of the two signals being compared has been tampered with.

[0005] This invention has been made in view of the above-mentioned problems, and aims to provide a technology for accurately detecting tampering with vehicle data. Ultimately, it aims to improve occupant safety, further enhance traffic safety, and contribute to the development of a sustainable transportation system. [Means for solving the problem]

[0006] An information processing system according to one aspect of the present invention that achieves the above objective is: An information processing system for detecting tampering with vehicle data, A vehicle data acquisition means for acquiring first vehicle data and second vehicle data, The first vehicle data and the second vehicle data The relationship that must be physically or design-wise established Based on this, a first tampering detection means for detecting the possibility of tampering with vehicle data, If the first tampering detection means detects that there is a possibility of tampering, the first evaluation data for evaluating the first vehicle data is used. When the difference between the predicted value of the first vehicle data calculated by the prediction model and the measured value of the first vehicle data exceeds a predetermined threshold, The system detects the falsification of the first vehicle data and evaluates the second vehicle data based on the second evaluation data. When the difference between the predicted value of the second vehicle data calculated by the prediction model and the measured value of the second vehicle data exceeds a predetermined threshold, A second tamper detection means for detecting tampering with the aforementioned second vehicle data, It is characterized by being equipped with [the following features]. [Effects of the Invention]

[0007] According to the present invention, tampering with vehicle data can be detected with high accuracy. [Brief explanation of the drawing]

[0008] [Figure 1] A block diagram of a vehicle and control device according to one embodiment. [Figure 2] A diagram showing an example configuration of an information processing system according to one embodiment. [Figure 3] A diagram showing an example of the hardware configuration of an information processing device according to one embodiment. [Figure 4] A diagram showing an example of the functional configuration of a control device provided in a vehicle according to one embodiment. [Figure 5] A diagram showing an example of the functional configuration of an information processing device according to one embodiment. [Figure 6] A processing sequence diagram of an information processing system according to one embodiment. [Figure 7] An explanatory diagram illustrating the relationship between the turning radius, wheelbase, and tire steering angle of a vehicle according to one embodiment. [Figure 8]Explanatory diagram of the upper limit value of motor regenerative torque allocation and the motor regenerative torque allocation value according to an embodiment. [Figure 9] Explanatory diagram of the tampering pattern of the motor regenerative torque allocation value according to an embodiment. [Figure 10] Diagram showing an example of vehicle data and its evaluation data according to an embodiment. [Figure 11] Diagram showing an example of vehicle data and its evaluation data according to an embodiment. [Figure 12] Diagram showing an example of vehicle data and its evaluation data according to an embodiment. [Figure 13] Explanatory diagram of an example of simple tampering detection processing according to an embodiment. [Figure 14] Explanatory diagram of an example of detailed tampering detection processing according to an embodiment.

Mode for Carrying Out the Invention

[0009] Hereinafter, embodiments will be described in detail with reference to the accompanying drawings. Note that the following embodiments do not limit the invention according to the claims, and not all combinations of the features described in the embodiments are essential for the invention. Two or more of the plurality of features described in the embodiments may be arbitrarily combined. Also, the same or similar configurations are given the same reference numerals, and redundant descriptions are omitted.

[0010] (Embodiment) Devices equipped with sensors and actuators may have their measured values and command values tampered with by cyberattacks. However, when the values are tampered with and become values outside the design values, they can be discovered by normal fault detection processing. For example, when the vehicle speed indicates a value exceeding the maximum speed of the vehicle, it can be clearly determined that there is a fault.

[0011] However, if a large change in value occurs within the design range, it cannot be detected by normal fault detection. For example, if the actual vehicle speed is 50 km / h, but it is tampered with by adding +30 km / h to show 80 km / h, this is a tampering within the range that is possible for vehicle speed, and therefore it is difficult to detect with normal fault detection processing. Nevertheless, a large change in value within the design range can lead to serious incidents. Therefore, it is necessary to detect large changes in value within the design range. In this embodiment, we will explain an example of detecting tampering even when there is a large change in value within the design range.

[0012] <Control devices and their application examples> Figure 1 is a block diagram of a control device CNT according to one embodiment, and a schematic diagram of a vehicle V, which is an example of its application. In Figure 1, the schematic of vehicle V is shown in a plan view and a side view. In this embodiment, vehicle V is, for example, a sedan-type four-wheeled passenger car, and could be, for example, a parallel hybrid vehicle. Note that vehicle V is not limited to a four-wheeled passenger car, and may be a saddle-type vehicle (motorcycle, motorized tricycle), or a large vehicle such as a truck or bus.

[0013] The control device CNT includes a controller 1, which is an electronic circuit that performs control of the vehicle V, including driving assistance for the vehicle V. The controller 1 comprises multiple ECUs (Electronic Control Units). ECUs are provided, for example, for each function of the control device CNT. Each ECU includes a processor, such as a CPU (Central Processing Unit), a storage device such as semiconductor memory, and an interface with external devices. The storage device stores programs executed by the processor and data used by the processor for processing. Interfaces include input / output interfaces and communication interfaces. Each ECU may have multiple processors, multiple storage devices, and multiple interfaces. Programs stored in the storage device may be stored in the storage device by being installed on the control device CNT using a storage medium such as a CD-ROM.

[0014] Controller 1 controls the driving (acceleration) of vehicle V by controlling power unit (power plant) 2. Power unit 2 is a drive unit that outputs driving force to rotate the drive wheels of vehicle V, and may include an internal combustion engine, a motor, and an automatic transmission. The motor can be used as a drive source to accelerate vehicle V, and can also be used as a generator during deceleration, etc. (regenerative braking).

[0015] In this embodiment, the controller 1 controls the output of the internal combustion engine and motor, and switches the gear of the automatic transmission, in response to the driver's driving operations detected by the operation detection sensor 2a provided on the accelerator pedal AP and the operation detection sensor 2b provided on the brake pedal BP, as well as the vehicle speed of the vehicle V detected by the rotation speed sensor 2c. The automatic transmission is equipped with a rotation speed sensor 2c that detects the rotation speed of the output shaft of the automatic transmission as a sensor that detects the driving state of the vehicle V. The vehicle speed of the vehicle V can be calculated from the detection result of the rotation speed sensor 2c.

[0016] Controller 1 controls the braking (deceleration) of the vehicle V by controlling the hydraulic system 3. The driver's braking operation applied to the brake pedal BP is converted into hydraulic pressure in the brake master cylinder BM and transmitted to the hydraulic system 3. The hydraulic system 3 is an actuator capable of controlling the hydraulic pressure of the hydraulic fluid supplied to the brake systems 3a (e.g., disc brake systems) provided on each of the four wheels, based on the hydraulic pressure transmitted from the brake master cylinder BM.

[0017] Controller 1 can control the braking of the vehicle V by controlling the drive of solenoid valves and other components of the hydraulic system 3. Controller 1 can also configure an electric servo brake system by controlling the distribution of braking force from the brake system 3a and braking force from regenerative braking of the motor in the power unit 2. Controller 1 may also illuminate the brake lamp 3b during braking.

[0018] Controller 1 controls the steering of the vehicle V by controlling the electric power steering system 4. The electric power steering system 4 includes a mechanism that steers the front wheels in response to the driver's driving operation (steering operation) on the steering wheel ST. The electric power steering system 4 includes a drive unit 4a that provides driving force (sometimes referred to as steering assist torque) to assist the steering operation or to automatically steer the front wheels of the vehicle V. The drive unit 4a is equipped with a motor as a drive source. The electric power steering system 4 also includes a steering angle sensor 4b that detects the steering angle, and a torque sensor 4c that detects the steering torque borne by the driver (referred to as steering load torque and distinguished from steering assist torque).

[0019] Controller 1 controls the electric parking brake device 3c located on the rear wheels of vehicle V. The electric parking brake device 3c includes a mechanism for locking the rear wheels. Controller 1 can control the locking and unlocking of the rear wheels by the electric parking brake device 3c.

[0020] Controller 1 controls an information output device 5 that provides information to the vehicle. The information output device 5 includes, for example, a display device 5a that provides information to the driver by image, and / or an audio output device 5b that provides information to the driver by voice. The display device 5a includes, for example, a display device provided on the instrument panel or a display device provided on the steering wheel ST. The display device 5a may also include a head-up display. The information output device 5 may also provide information to the occupants by vibration or light.

[0021] Controller 1 receives instruction input from the occupant (e.g., the driver) via input device 6. Input device 6 is positioned in a location accessible to the driver and includes, for example, a group of switches 6a for the driver to give instructions to the vehicle V, and / or a turn signal lever 6b for activating the turn signals.

[0022] Controller 1 recognizes and determines the current position and course (attitude) of vehicle V. In this embodiment, vehicle V is equipped with a gyro sensor 7a, a GNSS (Global Navigation Satellite System) sensor 7b, and a communication device 7c. The gyro sensor 7a detects the rotational motion (yaw rate) of vehicle V. The GNSS sensor 7b detects the current position of vehicle V. The communication device 7c also communicates wirelessly with a server that provides map information and traffic information to acquire this information. In this embodiment, controller 1 determines the course of vehicle V based on the detection results of the gyro sensor 7a and the GNSS sensor 7b, and sequentially acquires map information related to the course from the server via the communication device 7c and stores it in the database 7d (storage device). Vehicle V may also be equipped with other sensors to detect the state of vehicle V, such as an acceleration sensor that detects the acceleration of vehicle V.

[0023] Controller 1 performs driving assistance for vehicle V based on the detection results of various detection units installed in vehicle V. Vehicle V is equipped with external sensors, which are ambient detection units 8a to 8b, that detect the outside of vehicle V (surrounding conditions), and internal sensors, which are internal detection units 9a to 9b, that detect the conditions inside the vehicle (the state of the occupants (especially the driver)). Controller 1 can grasp the surrounding conditions of vehicle V based on the detection results of ambient detection units 8a to 8b and perform driving assistance according to those surrounding conditions. In addition, Controller 1 can determine, based on the detection results of internal detection units 9a to 9b, whether the driver is performing the predetermined actions required of the driver when performing driving assistance.

[0024] The surrounding detection unit 8a is an imaging device that captures images of the area in front of the vehicle V (hereinafter sometimes referred to as the front camera 8a), and is mounted, for example, on the interior side of the front windshield at the front of the roof of the vehicle V. The controller 1 can extract the contours of objects and the lane markings (white lines, etc.) on the road by analyzing the images captured by the front camera 8a.

[0025] The surrounding detection unit 8b is a millimeter-wave radar (hereinafter sometimes referred to as radar 8b) that uses radio waves to detect targets around the vehicle V and detects (measures) the distance to the targets and the direction (azimuth) of the targets relative to the vehicle V. In the example shown in Figure 1, there are five radar 8b units: one in the center of the front of the vehicle V, one at each of the left and right corners of the front, and one at each of the left and right corners of the rear.

[0026] The surrounding detection unit installed in vehicle V is not limited to the above configuration; the number of cameras and radars may be changed, and a LiDAR (Light Detection and Ranging) for detecting targets around vehicle V may also be installed.

[0027] The in-vehicle detection unit 9a is an imaging device that captures images of the interior of the vehicle (hereinafter sometimes referred to as the in-vehicle camera 9a), and is installed, for example, on the interior side of the front part of the roof of the vehicle interior V. In this embodiment, the in-vehicle camera 9a is a driver monitor camera that captures images of the driver (for example, the driver's eyes and face). The controller 1 can determine the driver's gaze and the direction of their face by analyzing the image (driver's face image) captured by the in-vehicle camera 9a.

[0028] The in-vehicle detection unit 9b is a grip sensor (hereinafter sometimes referred to as grip sensor 9b) that detects the driver's grip on the steering wheel ST, and is provided, for example, on at least a part of the steering wheel ST. Alternatively, a torque sensor 4c that detects the driver's steering torque may be used as the in-vehicle detection unit.

[0029] <Configuration of the Information Processing System> Figure 2 shows an example configuration of an information processing system according to one embodiment. The information processing system 10 includes an information processing device 20 and a vehicle V, and detects tampering with vehicle data. The information processing device 20 and the vehicle V are connected via a network 30. The information processing device 20 is a server device located outside the vehicle V, and is composed of, for example, a PC. The information processing device 20 can perform various processes based on information acquired from the vehicle V. The network 30 is a network such as a WAN / LAN. The information processing device 20 and the vehicle V can communicate via the network 30 by wired and / or wireless means.

[0030] <Hardware configuration of the information processing device> Next, with reference to Figure 3, an example of the hardware configuration of an information processing device 20 according to one embodiment will be described. As shown in Figure 3, the information processing device 20 includes a CPU 201, a storage device 202, a communication unit 203, a display unit 204, and an operation input unit 205. The control operation of the information processing device 20 is realized by the CPU 201 reading and executing a computer program stored in the storage device 202.

[0031] The CPU 201 may consist of one or more CPUs. The storage device 202 is one or more memories that store various types of information. For example, it stores information received from other devices or computer programs that are read and executed by the CPU 201. The communication unit 203 has the function of communicating with other devices via wired and / or wireless connections through the network 30. The communication unit 203 may also be capable of communicating with nearby devices via proximity wireless communication. The display unit 204 is a liquid crystal display or the like, and displays various types of information. The operation input unit 205 is, for example, a mouse, keyboard, touch panel, switch, etc., and can accept input of various types of information from the user.

[0032] <Functional configuration of the vehicle's control system (CNT)> Referring to Figure 4, an example of the functional configuration of the control device CNT provided in a vehicle V according to one embodiment will be described. The control device CNT comprises a vehicle data acquisition unit 401, a first tamper detection unit 402, and a transmission unit 403. Each function of the control device CNT is performed by the ECU.

[0033] The vehicle data acquisition unit 401 acquires various vehicle data measured and / or calculated by various sensors of the vehicle V. Vehicle data includes, but is not limited to, transmission speed VT, wheel speed VW, YAW angular velocity, motor regenerative torque allocation value, and maximum possible motor regenerative torque allocation value. Details of each vehicle data will be described later.

[0034] The first tampering detection unit 402 uses the vehicle data acquired by the vehicle data acquisition unit 401 to detect whether the vehicle data may have been tampered with. The first tampering detection unit 402 detects the possibility of tampering using a relatively simpler method than the second tampering detection unit 502, which will be described later. In this embodiment, the possibility of tampering with the vehicle data is detected based on two vehicle data. The physical quantities of the two vehicle data may be of the same type. For example, they may be transmission speed VT and wheel speed VW. Alternatively, they may be YAW angular velocity and a comparison value derived from vehicle data different from the YAW angular velocity (a physical quantity the same as YAW angular velocity). Alternatively, they may be motor regenerative torque allocation value and the upper limit of the motor regenerative torque allocation.

[0035] When the first tampering detection unit 402 detects that there is a possibility of tampering, the transmission unit 403 transmits the vehicle V logging data, which includes vehicle data and evaluation data for evaluating the vehicle data, to the information processing device 20.

[0036] <First tampering detection process (simplified detection process)> Here, the transmission vehicle speed VT is the vehicle speed data of the vehicle V derived from measurement data related to the transmission, and is the vehicle speed calculated from the rotational speed of the motor shaft, the radius of motion of the tires, etc. The transmission vehicle speed VT can be calculated, for example, by the following equation (1).

[0037] VT = (2π × tire radius × 60 / 1000) × (FIN Dr / FIN Dn) × (MOT Dr / MOT Dn) × rotational speed …(1) Here, VT is the transmission speed [km / h], the tire radius [m], FIN Dr is the final drive gear [teeth], and FIN Dn is the final driven gear [teeth]. Also, MOT Dr is the motor drive gear [teeth], MOT Dn is the motor driven gear [teeth], and the rotational speed (communication value) [rpm]. Furthermore, the "final" gear means the gear that is ultimately connected to the wheel among multiple gears. According to equation (1), the transmission speed VT can be calculated using the rotational speed of the motor shaft as input.

[0038] Wheel speed is the vehicle speed calculated from the rotational speed of the wheels, the circumference of the wheels, etc. For example, the average value of the left and right front wheels may be used as the wheel speed. This reduces the influence of the speed difference between the left and right wheels. The rotational speed of the wheels may be obtained from sensor values ​​installed on each wheel.

[0039] If the vehicle data is transmission speed and wheel speed, the first tampering detection unit 402 determines whether the absolute value of the difference between the transmission speed and wheel speed is greater than or equal to a threshold (e.g., 20 km / h). If the absolute value of the difference is greater than or equal to the threshold, it determines that there is a possibility that either the transmission speed or the wheel speed has been tampered with. This makes it possible to detect the possibility of tampering even when a large change in value occurs within the design range, which would not be detected by normal fault detection.

[0040] Next, the YAW angular velocity ω indicates the change amount of the YAW angle per unit time. As shown in FIG. 7, since sin(θ) = L / R, the YAW angular velocity ω is calculated by, for example, the following formula (2).

[0041] ω = V / R = V × {sin(θ) / L} …(2) Here, YAW angular velocity: ω [rad], vehicle speed: V [m / s], lateral G: a [m / s 2 , radius of rotation of the vehicle: R (rad), wheelbase: L [m], tire steering angle: θ [rad]. Also, ω 2 is calculated by the following formula (3).

[0042] ω 2 = a / R = a × {sin(θ) / L} …(3) When the vehicle data is the YAW angular velocity ω and its comparison value, the first tampering detection unit 402 determines whether both conditions that the difference between the YAW angular velocity and the comparison value 1 is greater than or equal to a threshold value (for example, 5.5 deg / s) and the difference between the square of the YAW angular velocity and the comparison value 2 is greater than or equal to a threshold value (for example, 5.5 2 deg 2 / s 2 ) are satisfied.

[0043] When both conditions are satisfied, it is determined that the YAW angular velocity ω may be tampered with.

[0044] Here, the comparison value 1 and the comparison value 2 are calculated from the following formulas (4) and (5), respectively.

[0045] Comparison value 1 [deg / s] = driving motor rotation direction × {wheel speed [m / s] / radius of rotation [m]} × (180 / π) …(4) Comparison value 2 [deg / s] 2 = {left - right acceleration [m / s 2 / radius of rotation [m]} × (180 / π) 2 …(5) Also, the radius of rotation in formulas (4) and (5) is calculated by the following formula (6).

[0046] Turning radius [m] = Wheelbase [m] × sin{Ratio of steering angle to tire angle × (π / 180) × Steering angle [deg]) …(6) In equations (4) to (6), the wheel speed, lateral acceleration, and steering angle are the values ​​obtained as vehicle data, respectively.

[0047] Next, the motor regenerative torque allocation value is the torque used to subtract the braking torque from the brakes by the amount of motor regeneration. The maximum assignable motor regenerative torque is the torque that can be subtracted from the brakes, and usually satisfies the relationship "maximum assignable motor regenerative torque > motor regenerative torque allocation value". As shown in Figure 8, the maximum assignable motor regenerative torque is calculated from the vehicle's required braking torque. Then, the motor torque and the motor regenerative torque allocation value are calculated from the maximum performable motor regenerative torque and the maximum assignable motor regenerative torque. The brake torque is generated by subtracting the motor regenerative torque allocation value from the vehicle's required braking torque.

[0048] As shown in Figure 9, if the motor regenerative torque allocation value is tampered with as in Pattern 1, the torque indicated by "1" will be subtracted unnecessarily, resulting in reduced braking effectiveness. If the motor regenerative torque allocation value is tampered with as in Pattern 2, the torque indicated by "2" will be subtracted unnecessarily, resulting in slightly reduced braking effectiveness. If the motor regenerative torque allocation value is tampered with as in Pattern 3, the torque indicated by "3" will be added unnecessarily, resulting in slightly excessive braking effectiveness. Here, if "maximum possible motor regenerative torque allocation value < motor regenerative torque allocation value" is obtained, it is possible to detect that the tampering in Pattern 1 has occurred. On the other hand, although tampering in Patterns 2 and 3 cannot be detected, the impact on the vehicle is relatively small.

[0049] If the vehicle data is the motor regenerative torque allocation value and the maximum possible motor regenerative torque allocation value, the first tamper detection unit 402 determines whether "maximum possible motor regenerative torque allocation value < motor regenerative torque allocation value" is true. If "maximum possible motor regenerative torque allocation value < motor regenerative torque allocation value" is true, the unit determines that there is a possibility that the motor regenerative torque allocation value has been tampered with.

[0050] Here, Figure 13 is an explanatory diagram of an example of the first tamper detection process according to this embodiment. The first tamper detection unit 402 of the control device CNT of vehicle V acquires two vehicle data (vehicle data A and vehicle data B) and detects the possibility of tampering with the vehicle data from its changes. Here, vehicle data A is the motor regenerative torque allocation value, and vehicle data B is the upper limit of the motor regenerative torque that can be allocated. As mentioned above, if it has not been tampered with, the relationship "upper limit of motor regenerative torque that can be allocated (vehicle data B) > motor regenerative torque allocation value (vehicle data A)" holds true.

[0051] Prior to time T1, the relationship "Maximum assignable motor regenerative torque (Vehicle Data B) > Motor regenerative torque assigned value (Vehicle Data A)" is maintained and has not been tampered with. However, at time T1, "Maximum assignable motor regenerative torque (Vehicle Data B) < Motor regenerative torque assigned value (Vehicle Data A)" is detected, indicating a possible tampering (simplified tampering detection).

[0052] <Example of evaluation data> Next, an example of evaluation data will be explained. Evaluation data is data used to evaluate vehicle data, and the physical quantities of the vehicle data may be of a different type than the physical quantities of the evaluation data. By inputting one or more evaluation data into a pre-trained prediction model, predicted vehicle data (predicted values) is obtained.

[0053] When vehicle data includes transmission speed and wheel speed, the evaluation data for evaluating transmission speed may include engine torque, engine coolant temperature, and axle torque, as shown in Figure 10. The evaluation data for evaluating wheel speed may also include engine torque, engine coolant temperature, and accelerator pedal position.

[0054] When vehicle data consists of YAW angular velocity and its comparison value, the evaluation data used to assess the YAW angular velocity may include steering torque, steering angular velocity, and accelerator pedal position, as shown in Figure 11. As mentioned above, the YAW angular velocity is compared with comparison value 1 and comparison value 2. Wheel speed and steering angle are used to calculate comparison value 1, and lateral acceleration and steering angle are used to calculate comparison value 2.

[0055] The evaluation data for wheel speed may include engine torque, engine coolant temperature, and accelerator pedal position. The evaluation data for lateral acceleration may include steering torque, steering angular velocity, and axle torque. The evaluation data for steering angle may include engine speed, steering torque, and engine coolant temperature.

[0056] When the vehicle data is the motor regenerative torque allocation value and the maximum possible motor regenerative torque allocation value, the evaluation data used to evaluate the motor regenerative torque allocation value may include longitudinal acceleration, brake force, and engine speed, as shown in Figure 12. Furthermore, the evaluation data used to evaluate the maximum possible motor regenerative torque allocation value may include longitudinal acceleration, brake force, and engine water temperature.

[0057] In the example shown in Figure 13, since tampering was detected at time T1, data logging is performed for a certain period of time from time T1 to time T2. The logged data acquired here consists of vehicle data, namely the motor regenerative torque allocation value and the upper limit of the motor regenerative torque allocation. The logged data also includes evaluation data for evaluating the motor regenerative torque allocation value, namely longitudinal acceleration, brake force, and engine speed, and evaluation data for evaluating the upper limit of the motor regenerative torque allocation, namely longitudinal acceleration, brake force, and engine water temperature.

[0058] <Configuration of the information processing device> Next, with reference to Figure 5, an example of the functional configuration of an information processing device according to one embodiment will be described. The information processing device 20 includes a receiving unit 501, a second tamper detection unit 502, and a notification unit 503. Each function of the information processing device 20 is executed by the CPU 201.

[0059] The receiving unit 501 receives logging data transmitted from the transmitting unit 403 of the vehicle V's control device CNT. The logging data includes vehicle data and evaluation data for evaluating the vehicle data. When the receiving unit 501 receives the logging data, the second tamper detection unit 502 performs a detailed tamper detection process to detect tampering with the vehicle data based on the evaluation data, because there is a possibility that the vehicle data has been tampered with. Specifically, as shown in Figure 14, one or more evaluation data are input into a prediction model (e.g., a machine learning-prepared model) to output a predicted value for the corresponding vehicle data. Then, by comparing this predicted value with the actual measured vehicle data, it is determined whether or not the vehicle data has been tampered with. For example, if the actual value differs from the predicted value by a threshold or more, it may be determined that the vehicle data has been tampered with. Various prediction models are pre-trained and prepared for each set of evaluation data to be input.

[0060] The notification unit 503 notifies the system if tampering is detected by the second tampering detection unit 502. If the information processing device 20 is a PC, the notification may be made by displaying it on the display unit 204, or by outputting a warning sound from the speaker. Alternatively, a combination of these may be used. Alternatively, the notification unit 503 may send a warning to the vehicle V, and the vehicle V may notify the system of the tampering (by displaying and / or outputting a warning sound).

[0061] <Second tampering detection process (detailed detection process)> This section describes the case where the vehicle data consists of transmission speed and wheel speed. The second tamper detection unit 502 first inputs the values ​​of engine torque, engine water temperature, and axle torque, which are evaluation data for evaluating transmission speed, into a prediction model in advance, and obtains a predicted value of transmission speed. The second tamper detection unit 502 compares the obtained predicted value of transmission speed with the transmission speed (measured value) included in the logging data received by the receiving unit 501. It then determines whether the difference between the two is within a threshold range (for example, any numerical value between 5% and 10%). If the difference exceeds the threshold range, it is determined that the transmission speed (measured value) has been tampered with. At this time, it may also be determined that tampering has occurred if the difference has continuously exceeded the threshold range for a predetermined period of time or longer. If the difference exceeds the threshold range as an instantaneous value, there is a possibility of false detection. False detection can be suppressed by determining whether the difference has continuously exceeded the threshold range for a predetermined period of time or longer.

[0062] Furthermore, the second tampering detection unit 502 inputs evaluation data for evaluating wheel speed, such as engine torque, engine water temperature, and accelerator pedal position, into a prediction model in advance to obtain a predicted value of wheel speed. The second tampering detection unit 502 compares the obtained predicted value of wheel speed with the wheel speed (measured value) included in the logging data received by the receiving unit 501, and determines whether the difference between the two is within a threshold range (for example, any numerical value between 5% and 10%). If the difference exceeds the threshold range, it is determined that the wheel speed (measured value) has been tampered with. At this time, it may also be determined that tampering has occurred if the difference has continuously exceeded the threshold range for a predetermined period of time or longer. If the difference exceeds the threshold range as an instantaneous value, there is a possibility of false detection. False detection can be suppressed by determining whether the difference has continuously exceeded the threshold range for a predetermined period of time or longer.

[0063] The first tampering detection process (simplified detection process) only focused on the difference between transmission speed and wheel speed, so even though it could detect the possibility of tampering, it could not identify which vehicle data had been tampered with. In contrast, the second tampering detection process (detailed detection process) makes it possible to specifically identify which of the vehicle data—transmission speed or wheel speed—had been tampered with.

[0064] Next, we will explain the case where the vehicle data is YAW angular velocity and its comparison value. The second tamper detection unit 502 inputs the values ​​of steering torque, steering angular velocity, and accelerator pedal position, which are evaluation data for evaluating YAW angular velocity, into the prediction model in advance and obtains a predicted value of YAW angular velocity. The second tamper detection unit 502 compares the obtained predicted value of YAW angular velocity with the YAW angular velocity (measured value) included in the logging data received by the receiving unit 501. It then determines whether the difference between the two is within a threshold range (for example, any numerical value between 5% and 10%). If the difference exceeds the threshold range, it is determined that the YAW angular velocity (measured value) has been tampered with. At this time, it may also be determined that tampering has occurred if the difference has continuously exceeded the threshold range for a predetermined period of time or longer. If the difference exceeds the threshold range as an instantaneous value, there is a possibility of false detection. False detection can be suppressed by determining whether the difference has continuously exceeded the threshold range for a predetermined period of time or longer.

[0065] Furthermore, according to equations (4) and (6) described above, the vehicle data for calculating comparison value 1 includes wheel speed and steering angle. That is, the vehicle data for evaluating comparison value 1 includes vehicle data for evaluating wheel speed and vehicle data for evaluating steering angle. As shown in Figure 11, the vehicle data for evaluating wheel speed includes engine torque, engine water temperature, and accelerator pedal position. The vehicle data for evaluating steering angle includes engine speed, steering torque, and engine water temperature.

[0066] The second tamper detection unit 502 inputs vehicle data for evaluating wheel speed, including engine torque, engine water temperature, and accelerator pedal position, into a prediction model in advance to obtain a predicted value for wheel speed. The second tamper detection unit 502 compares the obtained predicted value for wheel speed with the actual wheel speed (measured value) included in the logging data received by the receiving unit 501, and determines whether the difference between the two is within a threshold range (for example, any numerical value between 5% and 10%).

[0067] Similarly, the second tamper detection unit 502 inputs vehicle data for evaluating the steering angle, such as engine speed, steering torque, and engine water temperature, into the prediction model in advance and obtains a predicted value for the steering angle. The second tamper detection unit 502 compares the obtained predicted value for the steering angle with the steering angle (measured value) included in the logging data received by the receiving unit 501. It then determines whether the difference between the two is within a threshold range (for example, any numerical value between 5% and 10%).

[0068] Furthermore, the second tampering detection unit 502 may determine that comparison value 1 has been tampered with if at least one of the wheel speed and steering angle exceeds a threshold range. Also, according to equations (5) and (6) described above, the vehicle data for calculating comparison value 2 includes lateral acceleration and steering angle. That is, the vehicle data for evaluating comparison value 2 includes vehicle data for evaluating the lateral acceleration of the vehicle V and vehicle data for evaluating the steering angle. As shown in Figure 11, the vehicle data for evaluating the lateral acceleration of the vehicle includes steering torque, steering angular velocity, and axle torque. The vehicle data for evaluating the steering angle includes engine speed, steering torque, and engine water temperature.

[0069] The second tamper detection unit 502 inputs the values ​​of steering torque, steering angular velocity, and axle torque, which are vehicle data for evaluating lateral acceleration, into a prediction model in advance and obtains predicted values ​​of lateral acceleration. The second tamper detection unit 502 compares the obtained predicted values ​​of lateral acceleration with the lateral acceleration (measured values) included in the logging data received by the receiving unit 501 and determines whether the difference between the two is within a threshold range (for example, any numerical value between 5% and 10%).

[0070] Similarly, the second tamper detection unit 502 inputs vehicle data for evaluating the steering angle, such as engine speed, steering torque, and engine water temperature, into the prediction model in advance and obtains a predicted value for the steering angle. The second tamper detection unit 502 compares the obtained predicted value for the steering angle with the steering angle (measured value) included in the logging data received by the receiving unit 501. It then determines whether the difference between the two is within a threshold range (for example, any numerical value between 5% and 10%).

[0071] Furthermore, the second tampering detection unit 502 may determine that comparison value 2 has been tampered with if at least one of the left-right acceleration and steering angle exceeds a threshold range. For example, if comparison value 1 and comparison value 2 have not been tampered with, but it is determined that the YAW angular velocity has been tampered with, the second tampering detection unit 502 may determine that the YAW angular velocity has been tampered with. Alternatively, regardless of the possibility of tampering with comparison value 1 and comparison value 2, if it is determined that the YAW angular velocity has been tampered with, the second tampering detection unit 502 may determine that the YAW angular velocity has been tampered with.

[0072] Furthermore, the case where the vehicle data is the motor regenerative torque allocation value and the upper limit of the motor regenerative torque allocation will be explained. The second tamper detection unit 502 inputs the values ​​of longitudinal acceleration, brake force, and engine speed, which are evaluation data for evaluating the motor regenerative torque allocation value, into a prediction model in advance and obtains a predicted value of the motor regenerative torque allocation value. The second tamper detection unit 502 compares the obtained predicted value of the motor regenerative torque allocation value with the motor regenerative torque allocation value (measured value) included in the logging data received by the receiving unit 501. It then determines whether the difference between the two is within a threshold range (for example, any numerical value between 5% and 10%). If the difference exceeds the threshold range, it is determined that the motor regenerative torque allocation value (measured value) has been tampered with. At this time, it may also be determined that tampering has occurred if the difference has continuously exceeded the threshold range for a predetermined period of time or longer. If the difference exceeds the threshold range as an instantaneous value, there is a possibility of false detection. By determining whether the difference has continuously exceeded a threshold range for a predetermined period of time or longer, false detections can be suppressed.

[0073] Similarly, the second tamper detection unit 502 inputs evaluation data for evaluating the upper limit of assignable motor regenerative torque—specifically, longitudinal acceleration, brake force, and engine water temperature—into a prediction model in advance to obtain a predicted value for the upper limit of assignable motor regenerative torque. The second tamper detection unit 502 compares the obtained predicted value for the upper limit of assignable motor regenerative torque with the actual upper limit of assignable motor regenerative torque included in the logging data received by the receiving unit 501. It then determines whether the difference between the two is within a threshold range (for example, any numerical value between 5% and 10%). If the difference exceeds the threshold range, it determines that the actual upper limit of assignable motor regenerative torque has been tampered with. In this case, it may also be determined that tampering has occurred if the difference has continuously exceeded the threshold range for a predetermined period of time or longer. If the difference exceeds the threshold range as an instantaneous value, there is a possibility of false detection. False detection can be suppressed by determining whether the difference has continuously exceeded the threshold range for a predetermined period of time or longer.

[0074] Each prediction model described above is a pre-prepared model for each combination of evaluation data used as input. For example, a machine learning-prepared model can be used for the prediction model.

[0075] <Processing Sequence of Information Processing System> Next, the processing of the information processing system according to one embodiment will be described with reference to the processing sequence in Figure 6. In F601, the vehicle data acquisition unit 401 of the vehicle control device CNT of the vehicle V acquires various vehicle data measured and / or calculated by the vehicle V. The acquisition of vehicle data is performed over time (for example, at predetermined time intervals). In F602, the first tamper detection unit 402 of the vehicle control device CNT of the vehicle V uses the vehicle data acquired by the vehicle data acquisition unit 401 in F601 to detect the possibility of tampering with the vehicle data based on the two sets of vehicle data (simplified detection).

[0076] In F603, the transmission unit 403 of the vehicle V control device CNT transmits the vehicle V logging data to the information processing device 20 when the first tamper detection unit 402 detects in F602 that there is a possibility of tampering. The logging data includes vehicle data and evaluation data for evaluating the vehicle data. The logging data may be data acquired over a certain time range from the time when the possibility of tampering was detected.

[0077] In F604, the second tamper detection unit 502 detects tampering with vehicle data (detailed detection) based on evaluation data included in the logging data received by the receiving unit 501 and a prediction model. It also identifies which vehicle data has been tampered with.

[0078] In F605, if tampering is detected, the notification unit 503 notifies the detection result of the second tampering detection unit 502. For example, it may notify the user of the occurrence of tampering or provide information regarding the tampered vehicle data. The notification unit 503 may notify via the display unit 204 of the information processing device 20, or in the form of an audible warning, or a combination of these. The notification unit 503 may also send a warning to the vehicle V, and the vehicle V may notify the occurrence of tampering (display and / or output a warning sound). Furthermore, the notification unit 503 may prompt the user to contact the dealer of the vehicle V. This completes the processing sequence shown in Figure 6.

[0079] As described above, in this embodiment, a simple detection process is performed to detect the possibility of tampering with vehicle data based on a comparison of two sets of vehicle data. If it is determined that there is a possibility of tampering, a detailed detection process is performed to detect tampering with the vehicle data based on evaluation data for evaluating the vehicle data.

[0080] In this way, by detecting the possibility of tampering with a simple, low-load process, and then performing detailed, high-load processing only when tampering is suspected, the processing load during normal times when the possibility of tampering is low can be reduced.

[0081] Furthermore, vehicle V performs a simplified tamper detection process, and if the possibility of tampering is detected, it acquires logging data and sends it to an external information processing device, which then performs a detailed tamper detection process. This reduces the processing load on vehicle V, allowing its resources to be effectively utilized for other processes.

[0082] Furthermore, it becomes possible to detect tampering even when significant changes occur within the design specifications, which would normally be undetectable by conventional fault detection methods.

[0083] [Differentiation] In the above embodiment, an example was described in which the control device CNT of the vehicle V performs a simple tampering detection process and the information processing device 20 performs a detailed tampering detection process, but the system is not limited to this example. The control device CNT of the vehicle V may be configured to perform both processes. Alternatively, data may be transmitted from the vehicle V to the information processing device 20 over time, and the information processing device 20 may be configured to perform both processes. In other words, the information processing system 10 can also operate with the vehicle V (or its control device CNT) alone, or with the information processing device 20 alone.

[0084] In the above embodiment, several examples of vehicle data and evaluation data for evaluating vehicle data were given, but the invention is not limited to these examples. Any vehicle data may be applied as long as the physical quantities of the two vehicle data are of the same type. Also, any evaluation data may be applied as long as it is possible to evaluate the vehicle data.

[0085] Furthermore, in the above embodiment, an example was described in which the notification unit 503 provides notification when tampering is detected by the second tampering detection unit 502. The vehicle V may also provide notification when the first tampering detection unit 402 detects the possibility of tampering. Information indicating that tampering is suspected may be displayed and / or provided by sound. In addition, the transmission of logging data to the information processing device 20 may also be provided as notification. This makes it possible for the user of the vehicle V to easily recognize the possibility of tampering while riding in the vehicle.

[0086] Furthermore, although the above embodiments mainly described a four-wheeled vehicle as an example, the invention can be applied to other mobile devices such as two-wheeled vehicles, bipedal robots, quadrupedal robots, and drones. Also, although the above embodiments mainly described a vehicle as an example, the term "vehicle" may include mobile devices in general, such as drones and robots.

[0087] <Summary of Embodiments> 1. The information processing system according to the above embodiment is: An information processing system (10) for detecting tampering with vehicle data, A vehicle data acquisition means (401) for acquiring first vehicle data and second vehicle data, A first tamper detection means (402) detects the possibility of tampering with the vehicle data based on the first vehicle data and the second vehicle data, If the first tampering detection means detects that there is a possibility of tampering, a second tampering detection means (502) detects tampering of the first vehicle data based on first evaluation data for evaluating the first vehicle data, and detects tampering of the second vehicle data based on second evaluation data for evaluating the second vehicle data, An information processing system characterized by comprising the following features.

[0088] In this way, by performing a simple tampering detection process based on basic data comparisons, and then performing a more detailed tampering detection process if tampering is suspected, it is possible to accurately detect tampering with vehicle data while reducing the processing load.

[0089] 2. In the information processing system according to the above embodiment, The physical quantities of the first vehicle data are of the same type as the physical quantities of the second vehicle data.

[0090] This makes it easy to compare data from two different vehicles.

[0091] 3. In the information processing system according to the above embodiment, The physical quantities of the first vehicle data are of a different type from the physical quantities of the first evaluation data.

[0092] In this way, by using physical quantities of a different type than vehicle data as evaluation data, it becomes possible to indirectly determine whether or not the vehicle data has been tampered with.

[0093] 4. In the information processing system according to the above embodiment, The physical quantities of the second vehicle data are of a different type from the physical quantities of the second evaluation data.

[0094] In this way, by using physical quantities of a different type than vehicle data as evaluation data, it becomes possible to indirectly determine whether or not the vehicle data has been tampered with.

[0095] 5. In the information processing system according to the above embodiment, The second tamper detection means is: Based on the first evaluation data and the first prediction model, the falsification of the first vehicle data is detected. Based on the second evaluation data and the second prediction model, the falsification of the second vehicle data is detected.

[0096] This makes it possible, for example, to input evaluation data into a predictive model to obtain predicted values ​​for vehicle data, and then compare these with actual measured values ​​of vehicle data to determine whether or not the vehicle data has been tampered with.

[0097] 6. In the information processing system according to the above embodiment, The aforementioned first vehicle data includes the transmission vehicle speed, The second vehicle data includes wheel speed.

[0098] This allows for the detection of potential tampering with vehicle speed data by acquiring two different types of vehicle speed data and comparing them.

[0099] 7. In the information processing system according to the above embodiment, The first evaluation data is vehicle data for evaluating the transmission vehicle speed.

[0100] This makes it possible to determine whether or not the transmission speed has been tampered with.

[0101] 8. In the information processing system according to the above embodiment, The vehicle data used to evaluate the transmission speed includes engine torque, engine water temperature, and axle torque.

[0102] This makes it possible to determine whether or not the transmission speed has been tampered with.

[0103] 9. In the information processing system according to the above embodiment, The second evaluation data is vehicle data for evaluating the wheel speed.

[0104] This makes it possible to determine whether or not the wheel speed has been tampered with.

[0105] 10. In the information processing system according to the above embodiment, The vehicle data used to evaluate the wheel speed includes engine torque, engine water temperature, and accelerator pedal position.

[0106] This makes it possible to determine whether or not the wheel speed has been tampered with.

[0107] 11. In the information processing system according to the above embodiment, The aforementioned first vehicle data includes YAW angular velocity, The second vehicle data includes a first comparative value of the YAW angular velocity based on wheel speed and steering angle, and a second comparative value of the YAW angular velocity based on the lateral acceleration of the vehicle and the steering angle.

[0108] This makes it possible to detect the possibility of tampering with the YAW angular velocity or each of the comparison values ​​by using pairs of YAW angular velocity and first comparison values, and pairs of YAW angular velocity and second comparison values.

[0109] 12. In the information processing system according to the above embodiment, The first evaluation data mentioned above is vehicle data for evaluating the YAW angular velocity.

[0110] This makes it possible to determine whether or not the YAW angular velocity has been tampered with.

[0111] 13. In the information processing system according to the above embodiment, The vehicle data used to evaluate the aforementioned YAW angular velocity includes steering torque, steering angular velocity, and accelerator pedal position.

[0112] This makes it possible to determine whether or not the YAW angular velocity has been tampered with.

[0113] 14. In the information processing system according to the above embodiment, The second evaluation data is vehicle data for evaluating the first and second comparative values.

[0114] This makes it possible to determine whether or not the comparison values ​​have been tampered with.

[0115] 15. In the information processing system according to the above embodiment, The vehicle data for evaluating the first comparative value includes vehicle data for evaluating the wheel speed and vehicle data for evaluating the steering angle.

[0116] This makes it possible to determine whether the comparison value of YAW angular velocity based on wheel speed and steering angle has been tampered with.

[0117] 16. In the information processing system according to the above embodiment, The vehicle data used to evaluate the wheel speed includes engine torque, engine water temperature, and accelerator pedal position.

[0118] This makes it possible to determine whether or not the wheel speed has been tampered with.

[0119] 17. In the information processing system according to the above embodiment, The vehicle data used to evaluate the steering angle includes engine speed, steering torque, and engine coolant temperature.

[0120] This makes it possible to determine whether or not the steering angle has been tampered with.

[0121] 18. In the information processing system according to the above embodiment, The vehicle data for evaluating the second comparative value includes vehicle data for evaluating the lateral acceleration of the vehicle and vehicle data for evaluating the steering angle.

[0122] This makes it possible to determine whether or not other comparison values ​​of YAW angular velocity based on lateral acceleration and steering angle have been tampered with.

[0123] 19. In the information processing system according to the above embodiment, Vehicle data for evaluating the lateral acceleration of the vehicle includes steering torque, steering angular velocity, and axle torque.

[0124] This makes it possible to determine whether or not the lateral acceleration data has been tampered with.

[0125] 20. In the information processing system according to the above embodiment, The vehicle data used to evaluate the steering angle includes engine speed, steering torque, and engine coolant temperature.

[0126] This makes it possible to determine whether or not the steering angle has been tampered with.

[0127] 21. In the information processing system according to the above embodiment, The first vehicle data includes the motor regenerative torque allocation value, The second vehicle data includes the upper limit of the motor regenerative torque that can be assigned, The motor regenerative torque allocation value is the torque used to subtract the motor regenerative torque from the brake. The aforementioned upper limit of the motor regenerative torque that can be allocated is the torque that can be subtracted from the brake torque.

[0128] This allows for the detection of the possibility of tampering with the motor regenerative torque allocation value by comparing it with the maximum possible allocation value for motor regenerative torque.

[0129] 22. In the information processing system according to the above embodiment, The vehicle data used to evaluate the motor regenerative torque allocation value includes the vehicle's longitudinal acceleration, brake force, and engine speed.

[0130] This makes it possible to determine whether or not the motor regenerative torque allocation value has been tampered with.

[0131] 23. In the information processing system according to the above embodiment, The vehicle data used to evaluate the upper limit of the motor regenerative torque that can be allocated includes the vehicle's longitudinal acceleration, brake force, and engine water temperature.

[0132] This makes it possible to determine whether or not the upper limit of the motor regenerative torque allocation has been tampered with.

[0133] 24. The information processing system according to the above embodiment is The system further includes a notification means that provides notification based on the detection result of the second tampering detection means.

[0134] This allows users (vehicle users and / or users of information processing devices) to recognize when vehicle data has been tampered with.

[0135] 25. The control method for the information processing system according to the above embodiment is: A control method for an information processing system (10) that detects tampering with vehicle data, The process of acquiring first vehicle data and second vehicle data (F601), A step (F602) to detect the possibility of tampering with the vehicle data based on the first vehicle data and the second vehicle data, If the possibility of tampering is detected, the process includes detecting tampering with the first vehicle data based on first evaluation data for evaluating the first vehicle data, and detecting tampering with the second vehicle data based on second evaluation data for evaluating the second vehicle data (F604), It has.

[0136] In this way, by performing a simple tampering detection process based on basic data comparisons, and then performing a more detailed tampering detection process if tampering is suspected, it is possible to accurately detect tampering with vehicle data while reducing the processing load.

[0137] 26. The information processing system according to the above embodiment is An information processing system (10) comprising a vehicle (V) and an information processing device (20), which detects tampering with vehicle data, The aforementioned vehicle is A vehicle data acquisition means (401) for acquiring first vehicle data and second vehicle data, A first tamper detection means (402) detects the possibility of tampering with the vehicle data based on the first vehicle data and the second vehicle data, If the possibility of tampering is detected, the transmission means (403) transmits the vehicle logging data, including the first vehicle data, the second vehicle data, the first evaluation data for evaluating the first vehicle data, and the second evaluation data for evaluating the second vehicle data, to the information processing device. Equipped with, The aforementioned information processing device is Receiving means (501) for receiving the logging data from the vehicle, When the logging data is received, a second tamper detection means (502) detects tampering with the first vehicle data based on the first evaluation data and detects tampering with the second vehicle data based on the second evaluation data, It is equipped with.

[0138] In this way, a simple data tampering detection process based on basic data comparison is performed in the vehicle, and if tampering is suspected, a more detailed tampering detection process is performed on an information processing device separate from the vehicle. This reduces the processing load on the vehicle while accurately detecting tampering with vehicle data.

[0139] 27. The control method for the information processing system according to the above embodiment is: A control method for an information processing system (10) comprising a vehicle (V) and an information processing device (20), which detects tampering with vehicle data, The vehicle performs the step (F601) of acquiring first vehicle data and second vehicle data, The vehicle performs a step (F602) of detecting the possibility of tampering with the vehicle data based on the first vehicle data and the second vehicle data, If the possibility of tampering is detected in the vehicle, the vehicle's logging data, including the first vehicle data, the second vehicle data, the first evaluation data for evaluating the first vehicle data, and the second evaluation data for evaluating the second vehicle data, is transmitted to the information processing device (F603). The information processing device performs the step of receiving the logging data from the vehicle (F603), When the information processing device receives the logging data, it performs the following steps (F604): detecting tampering with the first vehicle data based on the first evaluation data and detecting tampering with the second vehicle data based on the second evaluation data; It has.

[0140] In this way, a simple data tampering detection process based on basic data comparison is performed in the vehicle, and if tampering is suspected, a more detailed tampering detection process is performed on an information processing device separate from the vehicle. This reduces the processing load on the vehicle while accurately detecting tampering with vehicle data.

[0141] 28. The program according to the above embodiment is: This is a program for causing a computer to function as an information processing system according to the above embodiment.

[0142] This makes it possible to implement the processing according to the above embodiment in a program.

[0143] 29. The storage medium according to the above embodiment is This is a storage medium on which a program is stored that causes the computer to function as an information processing system according to the above embodiment.

[0144] This makes it possible to implement the processing according to the above embodiment on a storage medium.

[0145] <Other Embodiments> Furthermore, a program that implements one or more functions described in each embodiment is supplied to a system or device via a network or storage medium, and one or more processors in the computer of the system or device can read and execute this program. The present invention can also be realized in this manner.

[0146] The invention is not limited to the embodiments described above, and various modifications and changes are possible within the scope of the gist of the invention. [Explanation of Symbols]

[0147] CNT: Control device, V: Vehicle, 1: Controller, CNT: Control device, 10: Information processing system, 20: Information processing device, 401: Vehicle data acquisition unit, 402: First tamper detection unit, 403: Transmission unit, 501: Receiving unit, 502: Second tamper detection unit, 503: Notification unit

Claims

1. An information processing system for detecting tampering with vehicle data, A vehicle data acquisition means for acquiring first vehicle data and second vehicle data, A first tamper detection means for detecting the possibility of tampering with the vehicle data based on the physical or design-defined relationship between the first vehicle data and the second vehicle data, If the first tampering detection means detects the possibility of tampering, the second tampering detection means detects tampering of the first vehicle data if the difference between the predicted value of the first vehicle data calculated by a prediction model based on first evaluation data for evaluating the first vehicle data exceeds a predetermined threshold, and detects tampering of the second vehicle data if the difference between the predicted value of the second vehicle data calculated by a prediction model based on second evaluation data for evaluating the second vehicle data exceeds a predetermined threshold, An information processing system characterized by comprising the following features.

2. The information processing system according to Claim 1, characterized in that the first tampering detection means determines that there is a possibility of tampering when the relationship between the first vehicle data and the second vehicle data does not satisfy predetermined physical or design constraints.

3. The information processing system according to claim 1, characterized in that the physical quantities of the first vehicle data are of the same type as the physical quantities of the second vehicle data.

4. The information processing system according to claim 1, characterized in that the physical quantities of the first vehicle data are of a different type from the physical quantities of the first evaluation data.

5. The information processing system according to claim 1, characterized in that the physical quantities of the second vehicle data are of a different type from the physical quantities of the second evaluation data.

6. The second tamper detection means is: Based on the first evaluation data and the first prediction model, the falsification of the first vehicle data is detected. Based on the second evaluation data and the second prediction model, the tampering of the second vehicle data is detected. The information processing system according to feature 1.

7. The first vehicle data includes the transmission vehicle speed, The second vehicle data includes wheel speed. The information processing system according to feature 1.

8. The information processing system according to claim 7, characterized in that the first evaluation data is vehicle data for evaluating the transmission vehicle speed.

9. The information processing system according to claim 8, characterized in that the vehicle data for evaluating the transmission vehicle speed includes engine torque, engine water temperature, and axle torque.

10. The information processing system according to claim 7, characterized in that the second evaluation data is vehicle data for evaluating the wheel speed.

11. The information processing system according to claim 10, characterized in that the vehicle data for evaluating the wheel speed includes engine torque, engine water temperature, and accelerator pedal position.

12. The first vehicle data includes YAW angular velocity, The second vehicle data includes a first comparative value of the YAW angular velocity based on wheel speed and steering angle, and a second comparative value of the YAW angular velocity based on the vehicle's lateral acceleration and steering angle. The information processing system according to feature 1.

13. The information processing system according to claim 12, characterized in that the first evaluation data is vehicle data for evaluating the YAW angular velocity.

14. The information processing system according to claim 13, characterized in that the vehicle data for evaluating the YAW angular velocity includes steering torque, steering angular velocity, and accelerator pedal position.

15. The information processing system according to claim 12, characterized in that the second evaluation data is vehicle data for evaluating the first comparative value and the second comparative value.

16. The information processing system according to claim 15, characterized in that the vehicle data for evaluating the first comparison value includes vehicle data for evaluating the wheel speed and vehicle data for evaluating the steering angle.

17. The information processing system according to claim 16, characterized in that the vehicle data for evaluating the wheel speed includes engine torque, engine water temperature, and accelerator pedal position.

18. The information processing system according to claim 16, characterized in that the vehicle data for evaluating the steering angle includes engine speed, steering torque, and engine water temperature.

19. The information processing system according to claim 15, characterized in that the vehicle data for evaluating the second comparison value includes vehicle data for evaluating the acceleration of the vehicle in the left-right direction and vehicle data for evaluating the steering angle.

20. The information processing system according to claim 19, characterized in that the vehicle data for evaluating the lateral acceleration of the vehicle includes steering torque, steering angular velocity, and axle torque.

21. The information processing system according to claim 19, characterized in that the vehicle data for evaluating the steering angle includes engine speed, steering torque, and engine water temperature.

22. The first vehicle data includes the motor regenerative torque allocation value, The second vehicle data includes the upper limit of the motor regenerative torque that can be allocated, The motor regenerative torque allocation value is the torque used to subtract the motor regenerative torque from the brake. The information processing system according to claim 1, characterized in that the upper limit of the motor regenerative torque that can be assigned is a torque that can be subtracted from the brake as braking torque.

23. The information processing system according to claim 22, characterized in that the vehicle data for evaluating the motor regenerative torque allocation value includes the longitudinal acceleration of the vehicle, the brake force, and the engine speed.

24. The information processing system according to claim 22, characterized in that the vehicle data for evaluating the upper limit of the motor regenerative torque that can be allocated includes the longitudinal acceleration of the vehicle, the brake force, and the engine water temperature.

25. The information processing system according to claim 1, further comprising a notification means that provides notification based on the detection result of the second tampering detection means.

26. A control method for an information processing system that detects tampering with vehicle data, A process for acquiring first vehicle data and second vehicle data, A step of detecting the possibility of tampering with the vehicle data based on the physical or design-based relationship between the first vehicle data and the second vehicle data, If the possibility of tampering is detected, the process includes detecting tampering of the first vehicle data if the difference between the predicted value of the first vehicle data calculated by a prediction model based on first evaluation data for evaluating the first vehicle data exceeds a predetermined threshold, and detecting tampering of the second vehicle data if the difference between the predicted value of the second vehicle data calculated by a prediction model based on second evaluation data for evaluating the second vehicle data exceeds a predetermined threshold, A control method for an information processing system, characterized by having the following features.

27. An information processing system comprising a vehicle and an information processing device, which detects tampering with vehicle data, The aforementioned vehicle is A vehicle data acquisition means for acquiring first vehicle data and second vehicle data, A first tamper detection means for detecting the possibility of tampering with the vehicle data based on the physical or design-defined relationship between the first vehicle data and the second vehicle data, If the possibility of tampering is detected, a transmission means transmits the vehicle logging data, including the first vehicle data, the second vehicle data, the first evaluation data for evaluating the first vehicle data, and the second evaluation data for evaluating the second vehicle data, to the information processing device. Equipped with, The aforementioned information processing device is Receiving means for receiving the logging data from the vehicle, When the logging data is received, a second tampering detection means detects tampering with the first vehicle data if the difference between the predicted value of the first vehicle data calculated by the prediction model based on the first evaluation data and the actual measured value of the first vehicle data exceeds a predetermined threshold, and also detects tampering with the second vehicle data if the difference between the predicted value of the second vehicle data calculated by the prediction model based on the second evaluation data and the actual measured value of the second vehicle data exceeds a predetermined threshold, An information processing system characterized by comprising the following features.

28. A control method for an information processing system comprising a vehicle and an information processing device, which detects tampering with vehicle data, The process involves the vehicle acquiring first vehicle data and second vehicle data, The process involves detecting the possibility of tampering with the vehicle data based on the physically or design-wise established relationship between the first vehicle data and the second vehicle data. If the possibility of tampering is detected in the vehicle, the vehicle's logging data, including the first vehicle data, the second vehicle data, the first evaluation data for evaluating the first vehicle data, and the second evaluation data for evaluating the second vehicle data, is transmitted to the information processing device. The information processing device includes the step of receiving the logging data from the vehicle, When the information processing device receives the logging data, it detects tampering with the first vehicle data if the difference between the predicted value of the first vehicle data calculated by the prediction model based on the first evaluation data and the actual measured value of the first vehicle data exceeds a predetermined threshold, and it also detects tampering with the second vehicle data if the difference between the predicted value of the second vehicle data calculated by the prediction model based on the second evaluation data and the actual measured value of the second vehicle data exceeds a predetermined threshold, A control method for an information processing system, characterized by having the following features.

29. A program for causing a computer to function as an information processing system according to any one of claims 1 to 25.

30. A storage medium storing a program for causing a computer to function as an information processing system according to any one of claims 1 to 25.

Images