Fraud detection device, fraud detection system, fraud detection method, and program

Abstract

This fraud detection device (20) is provided with: a first recording unit that receives, from a portable information terminal (30) installed on a vehicle (V), and records, first probe information including a plurality of time-series sets of first position information that is position information for the vehicle and first time information indicating the time at which the first position information was acquired, and first identification information that is identification information for the vehicle; a second recording unit that receives, from an onboard device (10) installed on a vehicle, and records, second probe information including a plurality of time-series sets of second position information that is position information for the vehicle and second time information indicating the time at which the second position information was acquired, and second identification information that is identification information for the vehicle; a comparison unit that compares the first probe information and the second probe information for which the first identification information and the second identification information correspond to each other; and a determination unit that determines whether there is suspicion that the first probe information may be fraudulent on the basis of the result of the comparison by the comparison unit.

Description

Fraud detection device, fraud detection system, fraud detection method, and program

[0001] The present disclosure relates to a fraud detection device, a fraud detection system, a fraud detection method, and a program.

[0002] In recent years, the Global Navigation Satellite System (GNSS), which determines the position of a vehicle or the like based on signals received from satellites, has been widely used. The GNSS is used, for example, for toll processing for vehicles passing through expressways. In toll processing using the GNSS, if the signals received from the satellite are spoofed, the toll processing cannot be performed correctly. As a countermeasure against spoofing, for example, Patent Document 1 discloses a technology in which vehicle-to-vehicle communication is performed between on-board devices (on-board units) mounted on two traveling vehicles, and signal spoofing is detected based on the results of the vehicle-to-vehicle communication.

[0003] Patent No. 6942414

[0004] Incidentally, mobile information terminals such as smartphones generally acquire location information using GNSS. Therefore, using a mobile information terminal in a billing system does not pose any major hardware problems. However, even when a mobile information terminal is used, measures against the above-mentioned problem of spoofing are necessary. In contrast, the technology described in Patent Document 1 detects spoofing using vehicle-to-vehicle communication, which has the problem of not being compatible with mobile information terminals.

[0005] The present disclosure has been made to solve the above-mentioned problems, and aims to provide a fraud detection device, a fraud detection system, a fraud detection method, and a program that can detect impersonation when using a mobile information terminal.

[0006] In order to solve the above problem, the fraud detection device disclosed herein includes a first recording unit that receives and records first probe information from a mobile information terminal installed in the vehicle, the first probe information including multiple time series sets of first location information, which is the location information of the vehicle, and first time information, which indicates the time at which the first location information was acquired, and first identification information, which is identification information of the vehicle; a second recording unit that receives and records second probe information from an on-board device installed in the vehicle, the second probe information including multiple time series sets of second location information, which is the location information of the vehicle, and second time information, which indicates the time at which the second location information was acquired, and second identification information, which is identification information of the vehicle; a comparison unit that compares the first probe information and the second probe information, where the first identification information and the second identification information correspond to each other; and a determination unit that determines whether the first probe information is suspected of being falsified based on the comparison result by the comparison unit.

[0007] In addition, the fraud detection system of the present disclosure includes a first recording unit that receives and records first probe information from a mobile information terminal installed in the vehicle, the first probe information including multiple time series sets of first location information, which is the location information of the vehicle, and first time information, which indicates the time at which the first location information was acquired, and first identification information, which is identification information of the vehicle; a second recording unit that receives and records second probe information from an on-board device installed in the vehicle, the second probe information including multiple time series sets of second location information, which is the location information of the vehicle, and second time information, which indicates the time at which the second location information was acquired, and second identification information, which is identification information of the vehicle; a comparison unit that compares the first probe information and the second probe information, where the first identification information and the second identification information correspond to each other; and a determination unit that determines whether the first probe information is suspected of being falsified based on the comparison result by the comparison unit; and the on-board device.

[0008] The fraud detection method disclosed herein includes the steps of receiving and recording first probe information from a mobile information terminal installed in the vehicle, the first probe information including multiple time series sets of first location information, which is the location information of the vehicle, and first time information, which indicates the time at which the first location information was acquired, and first identification information, which is identification information of the vehicle; receiving and recording second probe information from an on-board device installed in the vehicle, the second probe information including multiple time series sets of second location information, which is the location information of the vehicle, and second time information, which indicates the time at which the second location information was acquired, and second identification information, which is identification information of the vehicle; comparing the first probe information and the second probe information, where the first identification information and the second identification information correspond to each other; and determining whether the first probe information is suspected of being falsified based on the comparison result.

[0009] The program of the present disclosure causes a computer to execute the following steps: receiving and recording first probe information from a mobile information terminal installed in the vehicle, the first probe information including multiple time series pairs of first location information, which is the location information of the vehicle, and first time information, which indicates the time at which the first location information was acquired, and first identification information, which is identification information of the vehicle; receiving and recording second probe information from an on-board device installed in the vehicle, the second probe information including multiple time series pairs of second location information, which is the location information of the vehicle, and second time information, which indicates the time at which the second location information was acquired, and second identification information, which is identification information of the vehicle; comparing the first probe information and the second probe information, where the first identification information and the second identification information correspond to each other; and determining whether the first probe information is suspected of being falsified based on the comparison result.

[0010] According to the fraud detection device, fraud detection system, fraud detection method, and program of the present disclosure, it is possible to detect impersonation when using a mobile information terminal.

[0011] FIG. 1 is a diagram illustrating an overall configuration of a fraud detection system according to an embodiment of the present disclosure. FIG. 2 is a diagram illustrating an example of mobile information terminal information according to an embodiment of the present disclosure. FIG. 3 is a diagram illustrating an example of vehicle-mounted device information according to an embodiment of the present disclosure. FIG. 4 is a diagram illustrating an overall configuration of a fraud detection system according to an embodiment of the present disclosure and a functional configuration of a fraud detection device. FIG. 5 is a first flowchart illustrating an example of processing of a fraud detection device according to an embodiment of the present disclosure. FIG. 6 is a second flowchart illustrating an example of processing of a fraud detection device according to an embodiment of the present disclosure. FIG. 7 is a fourth flowchart illustrating an example of processing of a fraud detection device according to an embodiment of the present disclosure.

[0012] A fraud detection system 1 and a fraud detection device 20 according to an embodiment of the present disclosure will be described below with reference to the drawings. FIG. 1 is a diagram showing the overall configuration of a fraud detection system according to an embodiment of the present disclosure. As shown in FIG. 1, the fraud detection system 1 includes an in-vehicle device 10 for an electronic toll collection system mounted on a vehicle V, a mobile information terminal 30 such as a smartphone mounted on the vehicle V, a roadside antenna device 11 installed on the roadside of a road R on which the vehicle V travels, and a fraud detection device 20 independent of the vehicle V and the roadside antenna device 11. The in-vehicle device 10 is an example of an "in-vehicle device" according to the present disclosure. Although FIG. 1 shows one vehicle V and one roadside antenna device 11, multiple devices may be provided.

[0013] The fraud detection system 1 and the fraud detection device 20 determine whether the location information and time information contained in the mobile information terminal information D1 received from the mobile information terminal 30 are suspected of being falsified by comparing the information with the vehicle-mounted device information D2 and the roadside antenna information D3. The fraud detection system 1 and the fraud detection device 20 are used in billing systems for toll roads, toll areas, etc., and are also installed on public roads, etc. for daily enforcement. In this embodiment, an example will be described in which the fraud detection system 1 and the fraud detection device 20 are used in a billing system 50 for toll roads, toll areas, etc. The roadside antenna device 11 of this embodiment is installed, for example, at the entrances and exits of toll roads and toll areas, or at junctions with multiple roads.

[0014] As described above, the mobile information terminal 30 is, for example, a smartphone having a positioning function using GNSS. The mobile information terminal 30 is a terminal carried by a user who has previously registered with the billing system 50 by executing application software (hereinafter simply referred to as an app) for the billing system 50. In this case, the registered user is assigned an account ID (identification information). In this disclosure, the state in which the mobile information terminal 30 is loaded on the vehicle V refers to a state in which the mobile information terminal 30 is mounted on the vehicle V and moves as the vehicle V moves. The mobile information terminal 30 repeatedly acquires position information at predetermined time intervals using the positioning function using GNSS, and periodically transmits multiple pieces of position information for a predetermined period of time together with time information indicating the times at which each piece of position information was acquired to the fraud detection device 20 via a base station B of the mobile communication network, a wide-area communication network 41, etc. Note that the transmission of the mobile information terminal information D1 to the fraud detection device 20 may be performed via a communication means including local 5G, Wi-Fi (registered trademark), Bluetooth (registered trademark), etc. in addition to the base station B of the mobile communication network and the wide area communication network 41. Figure 2 is a diagram showing an example of the mobile information terminal information D1 according to an embodiment of the present disclosure.

[0015] The mobile information terminal information D1 shown in FIG. 2 includes an account ID (D11), an in-vehicle device ID (D12), and multiple pieces of time-series information D10. Each piece of information D10 includes location information D13, data creation time D14, and acceleration data D15. The account ID (D11) is an ID registered in the billing system 50 described above. The in-vehicle device ID (D12) is identification information for the in-vehicle device 10. Note that if the in-vehicle device ID is recorded in association with the account when the user registers with the billing system 50, the mobile information terminal information D1 does not need to include either the account ID (D11) or the in-vehicle device ID (D12). The in-vehicle device ID (D12) can be manually entered by the user into the app, or can be automatically acquired by the app through short-range wireless communication or wired communication between the mobile information terminal 30 and the in-vehicle device 10. The position information D13 is position information of the vehicle V (more precisely, the mobile information terminal 30) calculated based on the GNSS information D4 acquired by the mobile information terminal 30 using the GNSS, and includes information representing latitude, longitude, etc. The GNSS information D4 is a GNSS signal for positioning transmitted by the satellite S, and includes time data, orbit data of the satellite S, etc. The data creation time D14 is the time when the position information D13 was created (or the time when the position information D13 was acquired). The acceleration data D15 is data representing acceleration calculated based on multiple pieces of position information D13 in time series.

[0016] In this embodiment, the mobile information terminal information D1 is an example of "first probe information" in the present disclosure. Furthermore, in this embodiment, "probe information" refers to information including a time series of position information acquired at predetermined intervals by the mobile information terminal 30, the vehicle-mounted device 10, etc. using a positioning function that utilizes GNSS. Alternatively, in this embodiment, "probe information" refers to information including position information created by the roadside antenna device 11 based on information received from the vehicle-mounted device 10, etc. Furthermore, the vehicle-mounted device ID (D12) is an example of "first identification information" that is identification information for the vehicle V. If the vehicle-mounted device ID (D12) is omitted, the account ID (D11) is an example of "first identification information" that is identification information for the vehicle V. The mobile information terminal information D1 may include identification information displayed on the license plate of the vehicle V instead of or in addition to the vehicle-mounted device ID (D12). In this case, the identification information displayed on the license plate is also an example of "first identification information." Furthermore, the location information D13 is an example of "first location information," the data creation time D14 is an example of "first time information," the acceleration data D15 is an example of "first acceleration information," and the plurality of pieces of information D10 are an example of "plural sets of time series." Note that the acceleration data D15 does not have to be included in the mobile information terminal information D1.

[0017] The in-vehicle device 10 has a function of acquiring position information of the vehicle V (more precisely, an antenna for receiving GNSS information D4 of the in-vehicle device 10) using GNSS, and acquires the position information repeatedly, for example, at a predetermined period. The in-vehicle device 10 repeatedly acquires the position information at predetermined time intervals using a positioning function using GNSS, thins out the position information, for example, to create a time series of pairs of position information and time information for each predetermined distance, and transmits the time series as in-vehicle device information D2 to the roadside antenna device 11. Figure 3 is a diagram showing an example of the in-vehicle device information D2 according to an embodiment of the present disclosure.

[0018] The vehicle-mounted device information D2 shown in FIG. 3 includes a vehicle-mounted device ID (D22) and multiple pieces of time-series information D20. Each piece of information D20 includes location information D23, data creation time D24, and acceleration data D25. The vehicle-mounted device ID (D22) is identification information for the vehicle-mounted device 10 and is information preset for each vehicle-mounted device 10. The location information D23 is location information calculated based on GNSS information D4 acquired by the vehicle-mounted device 10 using GNSS, and includes information representing latitude, longitude, etc. The data creation time D24 is the time when the location information D23 was created (or the time when the location information D23 was acquired). The acceleration data D25 is data representing acceleration calculated based on multiple pieces of time-series location information D23. Note that the acceleration data D25 does not have to be included in the vehicle-mounted device information D2.

[0019] In this embodiment, the vehicle-mounted device information D2 is an example of "second probe information" in the present disclosure. Furthermore, the vehicle-mounted device ID (D22) is an example of "second identification information" that is identification information of the vehicle V. The vehicle-mounted device information D2 may include identification information included in the license plate of the vehicle V in addition to the vehicle-mounted device ID (D22). In this case, the identification information included in the license plate is also an example of "second identification information." Furthermore, the vehicle-mounted device ID (D12) included in the mobile information terminal information D1 and the vehicle-mounted device ID (D22) included in the vehicle-mounted device information D2 are the same. In this case, the "first identification information" and the "second identification information" are the same. However, as described above, if the mobile information terminal information D1 includes identification information displayed on the license plate as identification information of the vehicle V instead of the vehicle-mounted device ID (D12), the "first identification information" and the "second identification information" in the present disclosure will be different information. In this case, however, the fraud detection device 20 is configured to be able to associate the "first identification information" with the "second identification information" using information that associates the "first identification information" with the "second identification information." Furthermore, the location information D23 is an example of "second location information," the data creation time D24 is an example of "second time information," the acceleration data D25 is an example of "second acceleration information," and the plurality of pieces of information D20 are an example of "plurality of sets in a time series."

[0020] The roadside antenna device 11 transmits and receives predetermined information to and from the vehicle-mounted device 10 using DSRC (Dedicated Short Range Communications) technology. The roadside antenna device 11 receives vehicle-mounted device information D2 from the vehicle-mounted device 10. The roadside antenna device 11 also transmits the vehicle-mounted device information D2 received from the vehicle-mounted device 10 to the fraud detection device 20 via the wide area communication network 42. The roadside antenna device 11 also creates roadside antenna information D3 based on the vehicle-mounted device information D2 received from the vehicle-mounted device 10, and transmits the created roadside antenna information D3 to the fraud detection device 20 via the wide area communication network 42. When the billing system 50 is used without using the mobile information terminal 30, the roadside antenna device 11 transmits and receives predetermined information used for billing to and from the vehicle-mounted device 10, and transmits and receives predetermined information based on the transmitted and received information to and from the billing system 50.

[0021] FIG. 4 is a diagram illustrating an example of roadside antenna information D3 according to an embodiment of the present disclosure. The roadside antenna information D3 illustrated in FIG. 4 includes an identification ID (D31), installation location information D32, an on-board device ID (D33), a communication result D34, and a data creation time D35. The identification ID (D31) is identification information of the roadside antenna device 11. The installation location information D32 is location information of the installation location of the roadside antenna device 11. The on-board device ID (D22) is identification information of the on-board device 10 that transmitted the on-board device information D2. The communication result D34 is information indicating whether communication with the on-board device 10 was normal or abnormal. The data creation time D35 is the time when the roadside antenna information D3 was created (or the time when the on-board device information D2 was received).

[0022] In this embodiment, the roadside antenna information D3 is an example of "third probe information" in the present disclosure. The identification ID (D31) is an example of "identification information of the roadside antenna device." The vehicle-mounted device ID (D33) is an example of "second identification information" that is identification information of the vehicle V. The installation location information D32 is an example of "location information of the roadside antenna device." The roadside antenna information D3 does not have to include either the identification ID (D31) or the installation location information D32. In this case, the fraud detection device 20 is configured to be able to associate the "identification information of the roadside antenna device" with the "location information of the roadside antenna device" using information that associates the "identification information of the roadside antenna device" with the "location information of the roadside antenna device."

[0023] The fraud detection device 20 is a so-called center server (computer). The fraud detection device 20 compares mobile information terminal information D1 received from a mobile information terminal 30 installed in the vehicle V with in-vehicle device information D2 received from an in-vehicle device 10 installed in the vehicle V via a roadside antenna device 11, and determines whether the mobile information terminal information D1 is suspected of being falsified. Alternatively, the fraud detection device 20 compares the received mobile information terminal information D1 with roadside antenna information D3 received from the roadside antenna device 11, and determines whether the mobile information terminal information D1 is suspected of being falsified. Here, the in-vehicle device information D2 and the mobile information terminal information D1 differ in the ease of information tampering. Specifically, the in-vehicle device 10 is mainly installed and set up in the vehicle by a qualified contractor, and it is difficult for a user to intervene in the process from when the received data, such as location information, is used to complete necessary processing, such as billing. Furthermore, the in-vehicle device 10 is designed as a device limited to the purpose of obtaining and utilizing traffic information such as location information, and obtains location information that is optimal for obtaining and utilizing traffic information. On the other hand, the mobile information terminal 30 (smartphone) is designed to allow users to add various applications at their discretion and to be used for purposes other than obtaining and utilizing traffic information. Therefore, while the mobile information terminal 30 can accommodate more flexible payment methods than the in-vehicle device 10, it is also easier to install malicious apps (e.g., location information spoofing apps), making it difficult to guarantee the accuracy of the obtained location information.

[0024] (Functional Configuration of Fraud Detection Device) The functional configuration of the fraud detection device 20 will be described with reference to Fig. 5. Fig. 5 is a diagram showing the overall configuration of the fraud detection system 1 according to an embodiment of the present disclosure and the functional configuration of the fraud detection device 20. As shown in Fig. 2, the fraud detection device 20 includes a processor 21, a main memory 22, a storage 23, and a communication interface 24.

[0025] The processor 21 is, for example, a CPU (Central Processing Unit) and executes each process of the fraud detection device 20. The function of the processor 21 will be described later.

[0026] The main memory 22 has a memory area necessary for the operation of the processor 21 .

[0027] The storage 23 is a so-called auxiliary storage device. Examples of the storage 23 include a magnetic disk, a magneto-optical disk, and a semiconductor memory. The storage 23 may be an internal medium directly connected to the computer bus, or an external medium connected to the fraud detection device 20 (computer) via the communication interface 24 or a communication line.

[0028] The communication interface 24 is an interface for transmitting and receiving information to and from external devices (the portable information terminal 30 and the roadside antenna device 11).

[0029] Next, we will explain the functions of the processor 21. The processor 21 operates in accordance with a predetermined program to function as a recording unit 210, a comparison unit 214, and a determination unit 215. The recording unit 210 includes a first recording unit 211, a second recording unit 212, and a third recording unit 213.

[0030] The first recording unit 211 receives mobile information terminal information D1, which includes multiple time series sets D10 of the vehicle V's location information D13 and the data creation time D14 representing the time when the location information D13 was acquired, and an on-board device ID (D12), which is identification information for the vehicle V, from the mobile information terminal 30 installed in the vehicle V, and records it in storage 23.

[0031] The second recording unit 212 receives from the in-vehicle device 10 installed in the vehicle V in the storage 23 the in-vehicle device information D2, which includes a plurality of time-series sets D20 of the position information D23 of the vehicle V and the data creation time D24 indicating the time when the position information D23 was acquired, and an in-vehicle device ID (D22) that is identification information of the vehicle V. At this time, the second recording unit 212 receives and records the in-vehicle device information D2 from the in-vehicle device 10 via the roadside antenna device 11.

[0032] The third recording unit 213 receives roadside antenna information D3 from the roadside antenna device 11, and records it in the storage 23. The roadside antenna information D3 includes installation location information D32 and / or an identification ID (D31) of the roadside antenna device 11 that received the vehicle-mounted device information D2, the vehicle-mounted device ID (D33) corresponding to the vehicle-mounted device 10 that sent the vehicle-mounted device information D2, and the data creation time D35 corresponding to the time when the vehicle-mounted device information D2 was received.

[0033] The comparison unit 214 compares the mobile information terminal information D1 and the vehicle-mounted device information D2, in which the vehicle-mounted device ID (D12) and the vehicle-mounted device ID (D22) correspond to each other. In this case, the comparison unit 214 compares, for example, the position information D13 and the position information D23, in which the data creation time D14 and the data creation time D24 are within a predetermined time difference, and / or compares the data creation time D14 and the data creation time D24, in which the position information D13 and the position information D23 are within a predetermined distance. Furthermore, the comparison unit 214 compares, for example, the acceleration data D15 and the acceleration data D25, in which the data creation time D14 and the data creation time D24 are within a predetermined time difference, and / or compares the acceleration data D15 and the acceleration data D25, in which the position information D13 and the position information D23 are within a predetermined distance. The comparison unit 214 also compares the mobile information terminal information D1 and the roadside antenna information D3, for example, where the vehicle-mounted device ID (D12) corresponds to the vehicle-mounted device ID (D33) included in the roadside antenna information D3.

[0034] Furthermore, the determination unit 215 determines whether the mobile information terminal information D1 is suspected of being counterfeit based on the comparison result by the comparison unit 214. In this case, the determination unit 215 determines that the mobile information terminal information D1 is suspected of being counterfeit, for example, if the distance between the compared position information D13 and position information D23 is greater than a predetermined position threshold (also referred to as a first threshold), or if the time difference between the compared data creation times D14 and D24 is greater than a predetermined time threshold (also referred to as a second threshold). Alternatively, the determination unit 215 determines that the mobile information terminal information D1 is suspected of being counterfeit, if the difference between the compared acceleration data D15 and acceleration data D25 is greater than a predetermined acceleration threshold (also referred to as a third threshold). Alternatively, the judgment unit 215 judges that the mobile information terminal information D1 is suspected of being counterfeit if the distance between the location information D13 and the installation location information D32 is greater than a predetermined threshold (this threshold is also called the fourth threshold), or if the time difference between the data creation time D14 and the data creation time D35 is greater than a predetermined threshold (this threshold is also called the fifth threshold).

[0035] For each piece of data for which the judgment process has been completed, the judgment unit 215 records the fact that the judgment process has been completed in the storage 23, for example, in association with each piece of mobile information terminal information D1, and if it is determined that there is a suspicion of counterfeiting, it further records the fact that there is a suspicion of counterfeiting in association with the data (for example, the vehicle device ID) in the storage 23.

[0036] The comparison unit 214 and the determination unit 215 may perform the comparison and determination process repeatedly at a predetermined cycle, for example, or may perform the comparison and determination process only when the vehicle V enters or passes through a specific determination area. A specific determination area is, for example, an area corresponding to an entrance or exit of a toll road or toll area, an intermediate route such as a junction to multiple roads, etc. The comparison and determination process can be performed when the mobile information terminal information D1 having location information within these areas is received, or when the roadside antenna device 11 within these areas communicates with the in-vehicle device 10 and roadside antenna information D3 is received.

[0037] (Regarding Each Threshold) Each threshold depends on the location information acquisition cycle of the vehicle-mounted device 10 and the mobile information terminal 30. For example, if the vehicle-mounted device 10 acquires location information at 200 m intervals, the passing time will be 4 seconds if the vehicle V is traveling at a speed of 180 km / h. If the mobile information terminal 30 secures at least two positioning points at 200 m intervals, positioning every 2 seconds is required. Assuming that even if there is a positioning deviation or missing points, one of the two points will fall within the 200 m interval, and that the positioning points will always fall within three sections including the front and rear, each threshold can be set, for example, as follows:

[0038] The position threshold (first threshold) and the fourth threshold may be, for example, 200 m, and the time threshold (second threshold) and the fifth threshold may be, for example, 4 seconds.

[0039] The acceleration depends on the time difference, road structure, traffic congestion, etc. On a highway, the acceleration threshold (third threshold) can be set to, for example, 40 km / (h*h).

[0040] In this embodiment, since tampering with data from the vehicle-mounted device 10 is more difficult than tampering with data from the mobile information terminal 30, the presence or absence of falsification is determined by basically assuming that the data (location information and time information) from the vehicle-mounted device 10 is correct.

[0041] Furthermore, the operations of the above-described recording unit 210 (first recording unit 211, second recording unit 212, and third recording unit 213), comparison unit 214, and determination unit 215 are stored in the form of a program in storage 23. Processor 21 reads the program from storage 23, loads it into main memory 22, and executes the above-described processing in accordance with the program. Furthermore, processor 21 allocates storage areas in main memory 22 corresponding to the above-described recording unit 210 (first recording unit 211, second recording unit 212, and third recording unit 213), comparison unit 214, and determination unit 215 in accordance with the program.

[0042] The program may be for realizing part of the functions to be performed by the computer. For example, the program may be for performing the functions in combination with other programs already stored in the storage 23 or in combination with other programs installed in other devices.

[0043] The program may also be a program for realizing some of the above-described functions. Furthermore, the program may be a so-called differential file (differential program) that realizes the above-described functions in combination with another program already stored in the storage 23.

[0044] Furthermore, when this program is distributed to a computer via a communication line, the computer that receives the program may load the program into the main memory 22 and execute the above processing.

[0045] The fraud detection device 20 may include a custom large-scale integrated circuit (LSI) such as a programmable logic device (PLD) in addition to or instead of the above configuration. Examples of PLDs include programmable array logic (PAL), generic array logic (GAL), complex programmable logic device (CPLD), and field programmable gate array (FPGA). In this case, some or all of the functions implemented by the processor 21 may be implemented by the integrated circuit.

[0046] (Processing Flow of Fraud Detection Device) The processing flow of the fraud detection device 20 will be described below with reference to Figures 6 to 9. The processing flow of the fraud detection device 20 will be described in terms of a flow that does not use roadside antenna information D3 (Figure 6) and a flow that uses a roadside antenna (Figures 7 to 9).

[0047] 6 is a first flowchart illustrating an example of processing performed by a fraud detection device according to an embodiment of the present disclosure. Fig. 6 illustrates a processing flow when roadside antenna information D3 is not used. The processing illustrated in Fig. 6 may be executed repeatedly at a predetermined interval, or when location information within a specific determination area is received.

[0048] 6, the comparison unit 214 searches for data to be subjected to enforcement judgment from the storage 23 (step S101). In step S101, the comparison unit 214 searches for data of a vehicle V for which comparison and judgment processing has not yet been performed, or searches for data of a vehicle V for which comparison and judgment processing has not yet been performed and which has location information within a specific judgment area.

[0049] Next, the comparison unit 214 determines whether the retrieved data contains data of the same vehicle-mounted device ID for the mobile information terminal information D1 and the vehicle-mounted device information D2 (step S102). If there is no data containing the same vehicle-mounted device ID in the mobile information terminal information D1 and the vehicle-mounted device information D2 (step S102; NO), the comparison unit 214 determines that there is no data to be determined (step S103) and ends the enforcement determination process shown in FIG.

[0050] On the other hand, if the mobile information terminal information D1 and the vehicle-mounted device information D2 contain data that includes the same vehicle-mounted device ID (step S102; YES), the comparison unit 214 compares the data of the mobile information terminal information D1 with the data of the vehicle-mounted device information D2 to determine whether the target data is falsified (step S104).

[0051] Next, the determination unit 215 determines whether the location information (distance between location information) is within a location threshold and whether the time (time difference between times) is within a time threshold (step S105). If the location information is greater than the location threshold or the time is greater than the time threshold (step S105; NO), the determination unit 215 determines that the mobile information terminal information D1 that exceeds the threshold is suspected of being forged (step S106). If the location information is within the location threshold and the time is within the time threshold (step S105; YES), the determination unit 215 determines that the mobile information terminal information D1 is not suspected of being forged (step S107).

[0052] 7 and 8 are second and third flowcharts illustrating an example of processing by the fraud detection device according to an embodiment of the present disclosure. The flows illustrated in FIGS. 7 and 8 are processing flows when roadside antenna information D3 is used. The flows illustrated in FIGS. 7 and 8 are executed repeatedly, for example, at a predetermined cycle. The flow illustrated in FIG. 7 and the flow illustrated in FIG. 8 are connected to each other by a connector C1. The processing from step S101 to step S106 illustrated in FIG. 7 is the same as the processing from step S101 to step S106 described with reference to FIG. 6. However, in step S101 illustrated in FIG. 7, the comparison unit 214 searches for data of a vehicle V for which, for example, comparison and determination processing has not yet been performed.

[0053] In FIG. 7, if the location information is within the location threshold and the time is within the time threshold (step S105; YES), the comparison unit 214 searches the storage 23 for roadside antenna information D3 corresponding to the enforcement judgment (step S201).

[0054] Next, the comparison unit 214 determines whether the retrieved data contains data of the same vehicle-mounted device ID for the mobile information terminal information D1 and the roadside antenna information D3 (step S202 in FIG. 8). If there is no data containing the same vehicle-mounted device ID in the mobile information terminal information D1 and the roadside antenna information D3 (step S202; NO), the comparison unit 214 determines that there is no data to be determined (step S203) and ends the enforcement determination process shown in FIGS. 7 and 8.

[0055] On the other hand, if the mobile information terminal information D1 and the roadside antenna information D3 contain data that includes the same vehicle-mounted device ID (step S202; YES), the comparison unit 214 compares the data of the mobile information terminal information D1 with the data of the roadside antenna information D3 to determine whether the target data is falsified (step S204).

[0056] Next, the determination unit 215 determines whether the location information (distance between location information) is within a fourth threshold and whether the time (time difference between times) is within a fifth threshold (step S205). If the location information is greater than the fourth threshold or the time is greater than the fifth threshold (step S205; NO), the determination unit 215 determines that the mobile information terminal information D1 that exceeds the threshold is suspected of being forged (step S206). If the location information is within the fourth threshold and the time is within the fifth threshold (step S205; YES), the determination unit 215 determines that the mobile information terminal information D1 is not suspected of being forged (step S207).

[0057] FIG. 9 is a fourth flowchart illustrating an example of processing by the fraud detection device according to an embodiment of the present disclosure. The connector C1 illustrated in FIG. 9 is connected to the connector C1 illustrated in FIG. 8 . The flows illustrated in FIGS. 9 and 8 are processing flows when roadside antenna information D3 is used. The flows illustrated in FIGS. 9 and 8 are executed, for example, when location information within a specific judgment area is received. Note that the processing from steps S101 to S102 and steps S104 to S106 illustrated in FIG. 9 is the same as the processing from steps S101 to S102 and steps S104 to S106 described with reference to FIG. 6 . However, in step S101 illustrated in FIG. 9 , the comparison unit 214 searches for data on a vehicle V for which the comparison and judgment processing has not yet been performed and which has location information within a specific judgment area. 9, if there is no data including the same vehicle-mounted device ID in the mobile information terminal information D1 and the vehicle-mounted device information D2 (step S102; NO), the comparison unit 214 searches the storage 23 for roadside antenna information D3 corresponding to the enforcement determination (step S201). The processing from step S201 onwards is the same as the processing described above with reference to FIG.

[0058] As described above, according to this embodiment, if the mobile information terminal information D1 contains data (location information or time information) that is suspected of being falsified, the suspicion of falsification can be detected based on the vehicle-mounted device information D2 or the vehicle-mounted device information D2 and the roadside antenna information D3.

[0059] If it is determined that there is a suspicion of counterfeiting, the fraud detection system 1 may perform the following subsequent processing. For example, it may search for past driving history as a suspected fraudulent vehicle (determine past suspicions of counterfeiting with the same in-vehicle device ID). Alternatively, if there is a strong suspicion of counterfeiting, such as multiple repetitions, it may support the process of reporting to the relevant government agencies (for example, by providing information encouraging reporting). Alternatively, it may support the process of suspending cards or credit cards for electronic toll collection systems. It may also support the process of collecting tolls at a later date from personal information that can be obtained from in-vehicle device information.

[0060] Furthermore, according to this embodiment, the fraud detection device 20 can collect location information acquired by the mobile information terminal 30 via the wide area communication network 42, so data on any area or route throughout the country can be utilized using probe information without blank information. For example, possible uses of the data include congestion countermeasures through early detection of congestion occurrence, traffic safety measures through early detection of traffic abnormalities, fee policies such as dynamic pricing, area charging, and mileage tax, logistics support such as monitoring the operation of large vehicles and vehicles transporting hazardous materials, and public transportation support such as providing on-time operation information.

[0061] Furthermore, according to this embodiment, payment methods can be easily diversified by linking with other application software such as electronic payment using two-dimensional codes running on the mobile information terminal 30, or by enabling payment by carrier billing.

[0062] (Effects) According to this embodiment, if the mobile information terminal information D1 obtained from the mobile information terminal 30 contains data that is suspected of being falsified (location information or time information or both), the suspicion of falsification can be detected based on the vehicle-mounted device information D2 or the vehicle-mounted device information D2 and the roadside antenna information D3.

[0063] As described above, the embodiments of the present disclosure have been described, but these embodiments are presented as examples and are not intended to limit the scope of the invention. These embodiments can be implemented in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their modifications are included in the scope of the invention and its equivalents as defined in the claims, as well as in the scope and spirit of the invention.

[0064] (Other Embodiments) For example, in the above embodiment, the in-vehicle device information D2 and the roadside antenna information D3 were used as the information to be compared with the mobile information terminal information D1, but this is not limited thereto. For example, if the vehicle V is an autonomous vehicle or the like and has a function for performing driving assistance or autonomous driving using GNSS, probe information including position information and time information may be acquired from a control device of the vehicle V. In this case, the fraud detection device 20 receives the probe information including position information and time information from the control device of the vehicle V, for example, via a wide area communication network 42. Furthermore, the probe information including position information and time information from the control device of the vehicle V can be compared with the mobile information terminal information D1 acquired from the mobile information terminal 30 to detect suspicion of counterfeiting. In this case, the control device of the vehicle V is an example of an "in-vehicle device" in the present disclosure.

[0065] In addition, an additional photographing device may be installed around the roadside antenna device 11 or regardless of the installation location of the roadside antenna device 11, and, for example, the license plate information or external appearance information of the vehicle V may be recognized and compared with pre-registered information to detect suspected counterfeiting.

[0066] <Additional Notes> The fraud detection device described in the above embodiment can be understood, for example, as follows.

[0067] (1) The fraud detection device 20 relating to the first aspect includes a first recording unit 211 that receives and records first probe information (mobile information terminal information D1) including multiple time series pairs of first location information, which is the location information of the vehicle V, and first time information indicating the time at which the first location information was acquired, and first identification information, which is identification information of the vehicle, from a mobile information terminal 30 installed in the vehicle V; a second recording unit 212 that receives and records second probe information (vehicle-mounted device information D2) including multiple time series pairs of second location information, which is the location information of the vehicle V, and second time information indicating the time at which the second location information was acquired, and second identification information, which is identification information of the vehicle, from an on-board device (on-board device 10) installed in the vehicle V; a comparison unit 214 that compares the first probe information and the second probe information, where the first identification information and the second identification information correspond to each other; and a determination unit 215 that determines whether the first probe information is suspected of being counterfeit based on the comparison result by the comparison unit 214. According to this aspect and each of the following aspects, if the probe information (mobile information terminal information D1) obtained from the mobile information terminal 30 includes data (location information or time information or both) that is suspected of being falsified, the suspicion of falsification can be detected based on the vehicle-mounted device information D2.

[0068] (2) A fraud detection device 20 according to a second aspect is the fraud detection device 20 of (1), in which the comparison unit compares the first location information and the second location information when the first time information and the second time information are within a predetermined time difference, and / or compares the first time information and the second time information when the first location information and the second location information are within a predetermined distance, and the determination unit determines that the first probe information is suspected of being faked when the distance between the compared first location information and the second location information is greater than a first threshold value or the time difference between the compared first time information and the second time information is greater than a second threshold value. According to this aspect, it is possible to determine that there is a suspicion of faked information when the location information or the time information is greater than a predetermined threshold value.

[0069] (3) A third aspect of the fraud detection device 20 is the fraud detection device 20 of (1) or (2), wherein the first probe information includes first acceleration information representing an acceleration of the vehicle, and the second probe information includes second acceleration information representing an acceleration of the vehicle, and the comparison unit compares the first acceleration information and the second acceleration information when the first time information and the second time information are within a predetermined time difference, and / or compares the first acceleration information and the second acceleration information when the first position information and the second position information are within a predetermined distance, and the determination unit determines that the first probe information is suspected of being faked when a difference between the compared first acceleration information and the compared second acceleration information is greater than a third threshold. According to this aspect, it is possible to determine that the first probe information is suspected of being faked when the difference in acceleration is greater than a predetermined threshold.

[0070] (4) A fraud detection device 20 according to a fourth aspect is the fraud detection device 20 of any one of (1) to (3), wherein the on-board device transmits the second probe information to a roadside antenna device provided on the side of a road on which the vehicle travels, and the second recording unit receives and records the second probe information from the on-board device via the roadside antenna device, and stores location information and / or identification information of the roadside antenna device that received the second probe information, the second identification information corresponding to the on-board device that transmitted the second probe information, and a time stamp corresponding to the time when the second probe information was received. The present invention further includes a third recording unit that receives and records third probe information (roadside antenna information D3) including third time information from the roadside antenna device, the comparing unit compares the first probe information with the third probe information, where the first identification information and the second identification information included in the third probe information correspond to each other, and the determining unit determines that the first probe information is suspected of being falsified when a distance between the first position information and position information of the roadside antenna device is greater than a fourth threshold value or a time difference between the first time information and the third time information is greater than a fifth threshold value. According to this aspect, when the probe information (mobile information terminal information D1) acquired from the mobile information terminal 30 includes data (position information or time information, or both) that is suspected of being falsified, the suspicion of falsification can be detected based on the in-vehicle device information D2 and the roadside antenna information D3.

[0071] According to the fraud detection device, fraud detection system, fraud detection method, and program of the present disclosure, it is possible to detect impersonation when using a mobile information terminal.

[0072] REFERENCE SIGNS LIST 1 Fraud detection system 10 Vehicle-mounted device 11 Roadside antenna device 20 Fraud detection device 21 Processor 30 Portable information terminal 210 Recording unit 211 First recording unit 212 Second recording unit 213 Third recording unit 214 Comparison unit 215 Determination unit 22 Main memory 23 Storage 24 Communication interface

Claims

1. a first recording unit that receives and records first probe information from a mobile information terminal mounted on the vehicle, the first probe information including a plurality of time series sets of first location information, which is location information of the vehicle, and first time information, which indicates the time at which the first location information was acquired, and first identification information, which is identification information of the vehicle; a second recording unit that receives and records second probe information from an on-board device installed in the vehicle, the second probe information including a plurality of time series sets of second position information, which is position information of the vehicle, and second time information, which indicates the time at which the second position information was acquired, and second identification information, which is identification information of the vehicle; a comparison unit that compares the first probe information and the second probe information, in which the first identification information and the second identification information correspond to each other; a determination unit that determines whether the first probe information is suspected of being forged based on a comparison result by the comparison unit; Equipped with the comparison unit compares the first location information with the second location information when the first time information and the second time information are within a predetermined time difference; The determination unit determines that the first probe information is suspected of being forged when a distance between the compared first location information and the second location information is greater than a first threshold. Fraud detection device.

2. a first recording unit that receives and records first probe information from a mobile information terminal mounted on the vehicle, the first probe information including a plurality of time series sets of first location information, which is location information of the vehicle, and first time information, which indicates the time at which the first location information was acquired, and first identification information, which is identification information of the vehicle; a second recording unit that receives and records second probe information from an on-board device installed in the vehicle, the second probe information including a plurality of time series sets of second position information, which is position information of the vehicle, and second time information, which indicates the time at which the second position information was acquired, and second identification information, which is identification information of the vehicle; a comparison unit that compares the first probe information and the second probe information, in which the first identification information and the second identification information correspond to each other; a determination unit that determines whether the first probe information is suspected of being forged based on a comparison result by the comparison unit; Equipped with the comparison unit compares the first time information with the second time information when the first location information and the second location information are within a predetermined distance; The determination unit determines that the first probe information is suspected of being forged when a time difference between the compared first time information and the second time information is greater than a second threshold value. Fraud detection device.

3. the first probe information includes first acceleration information representing an acceleration of the vehicle; the second probe information includes second acceleration information representing an acceleration of the vehicle; the comparison unit compares the first acceleration information with the second acceleration information when the first time information and the second time information are within a predetermined time difference, and / or compares the first acceleration information with the second acceleration information when the first position information and the second position information are within a predetermined distance, The determination unit determines that the first probe information is suspected of being forged when a difference between the compared first acceleration information and the second acceleration information is greater than a third threshold. The fraud detection device according to claim 1 or 2.

4. the on-vehicle device transmits the second probe information to a roadside antenna device provided on a roadside of a road on which the vehicle travels; the second recording unit receives the second probe information from the in-vehicle device via the roadside antenna device and records it; a third recording unit that receives and records third probe information from the roadside antenna device, the third probe information including position information and / or identification information of the roadside antenna device that has received the second probe information, the second identification information corresponding to the on-board device that has transmitted the second probe information, and third time information corresponding to a time when the second probe information has been received, the comparison unit compares the first probe information and the third probe information in which the first identification information and the second identification information included in the third probe information correspond to each other; The determination unit determines that the first probe information is suspected of being falsified when a distance between the first location information and the location information of the roadside antenna device is greater than a fourth threshold value or a time difference between the first time information and the third time information is greater than a fifth threshold value. The fraud detection device according to claim 1 or 2.

5. a first recording unit that receives and records first probe information from a mobile information terminal mounted on the vehicle, the first probe information including a plurality of time series sets of first location information, which is location information of the vehicle, and first time information, which indicates the time at which the first location information was acquired, and first identification information, which is identification information of the vehicle; a second recording unit that receives and records second probe information from an on-board device installed in the vehicle, the second probe information including a plurality of time series sets of second position information, which is position information of the vehicle, and second time information, which indicates the time at which the second position information was acquired, and second identification information, which is identification information of the vehicle; a comparison unit that compares the first probe information and the second probe information, in which the first identification information and the second identification information correspond to each other; a determination unit that determines whether the first probe information is suspected of being forged based on a comparison result by the comparison unit; a fraud detection device comprising: the in-vehicle device; Equipped with the comparison unit compares the first location information with the second location information when the first time information and the second time information are within a predetermined time difference; The determination unit determines that the first probe information is suspected of being forged when a distance between the compared first location information and the second location information is greater than a first threshold. Fraud detection system.

6. receiving and recording first probe information from a mobile information terminal mounted on the vehicle, the first probe information including a plurality of time series pairs of first location information, which is location information of the vehicle, and first time information, which indicates the time at which the first location information was acquired, and first identification information, which is identification information of the vehicle; receiving and recording second probe information from an on-board device installed in the vehicle, the second probe information including a plurality of time series pairs of second position information, which is position information of the vehicle, and second time information, which indicates the time at which the second position information was acquired, and second identification information, which is identification information of the vehicle; comparing the first probe information and the second probe information, in which the first identification information and the second identification information correspond to each other; determining whether the first probe information is suspected of being forged based on the comparison result; Including, In the comparing step, the first location information and the second location information are compared when the first time information and the second time information are within a predetermined time difference, In the determining step, when a distance between the compared first location information and the second location information is greater than a first threshold, it is determined that the first probe information is suspected of being forged. Fraud detection methods.

7. receiving and recording first probe information from a mobile information terminal mounted on the vehicle, the first probe information including a plurality of time series pairs of first location information, which is location information of the vehicle, and first time information, which indicates the time at which the first location information was acquired, and first identification information, which is identification information of the vehicle; receiving and recording second probe information from an on-board device installed in the vehicle, the second probe information including a plurality of time series pairs of second position information, which is position information of the vehicle, and second time information, which indicates the time at which the second position information was acquired, and second identification information, which is identification information of the vehicle; comparing the first probe information and the second probe information, in which the first identification information and the second identification information correspond to each other; determining whether the first probe information is suspected of being forged based on the comparison result; A program that causes a computer to execute the In the comparing step, the first location information and the second location information are compared when the first time information and the second time information are within a predetermined time difference, In the determining step, when a distance between the compared first location information and the second location information is greater than a first threshold, it is determined that the first probe information is suspected of being forged. program.

8. A first recording unit that receives and records first probe information including multiple sets of time series of first location information, which is location information of a vehicle, and first time information, which indicates the time when the first location information was acquired, and first identification information, which is identification information of the vehicle, from a mobile information terminal installed in the vehicle; a second recording unit that receives and records second probe information from an on-board device installed in the vehicle, the second probe information including a plurality of time series sets of second position information, which is position information of the vehicle, and second time information, which indicates the time at which the second position information was acquired, and second identification information, which is identification information of the vehicle; a comparison unit that compares the first probe information and the second probe information, in which the first identification information and the second identification information correspond to each other; a determination unit that determines whether the first probe information is suspected of being forged based on a comparison result by the comparison unit; a fraud detection device comprising: the in-vehicle device; Equipped with the comparison unit compares the first time information with the second time information when the first location information and the second location information are within a predetermined distance; The determination unit determines that the first probe information is suspected of being forged when a time difference between the compared first time information and the second time information is greater than a second threshold value. Fraud detection system.

9. A step of receiving and recording first probe information from a mobile information terminal mounted on the vehicle, the first probe information including multiple sets of time series of first location information, which is location information of the vehicle, and first time information, which represents the time when the first location information was acquired, and first identification information, which is identification information of the vehicle; receiving and recording second probe information from an on-board device installed in the vehicle, the second probe information including a plurality of time series pairs of second position information, which is position information of the vehicle, and second time information, which indicates the time at which the second position information was acquired, and second identification information, which is identification information of the vehicle; comparing the first probe information and the second probe information, in which the first identification information and the second identification information correspond to each other; determining whether the first probe information is suspected of being forged based on the comparison result; Including, In the comparing step, the first time information and the second time information are compared when the first location information and the second location information are within a predetermined distance from each other, In the determining step, if the time difference between the compared first time information and the second time information is greater than a second threshold, it is determined that the first probe information is suspected of being forged. Fraud detection methods.

10. A step of receiving and recording first probe information from a mobile information terminal mounted on the vehicle, the first probe information including multiple sets of time series of first location information, which is location information of the vehicle, and first time information, which represents the time when the first location information was acquired, and first identification information, which is identification information of the vehicle; receiving and recording second probe information from an on-board device installed in the vehicle, the second probe information including a plurality of time series pairs of second position information, which is position information of the vehicle, and second time information, which indicates the time at which the second position information was acquired, and second identification information, which is identification information of the vehicle; comparing the first probe information and the second probe information, in which the first identification information and the second identification information correspond to each other; determining whether the first probe information is suspected of being forged based on the comparison result; A program that causes a computer to execute the In the comparing step, the first time information and the second time information are compared when the first location information and the second location information are within a predetermined distance from each other, In the determining step, if the time difference between the compared first time information and the second time information is greater than a second threshold, it is determined that the first probe information is suspected of being forged. program.