System and method for protecting privacy of rental vehicle user

Abstract

A system and a method for protecting privacy of a rental vehicle user are disclosed. The system according to an embodiment comprises: a terminal for receiving an input of a seed and the size of a personal information storage area of a rental vehicle, generating a first random number sequence corresponding to the size of the personal information storage area on the basis of the seed, and generating Merkle tree-based verification information from the first random number sequence; and a personal information deletion device for receiving the seed and the size of the personal information storage area from the terminal, generating a second random number sequence corresponding to the size of the personal information storage area on the basis of the received seed, and masking the personal information storage area of the rental vehicle by using the second random number sequence.

Description

System and method for protecting the privacy of rental vehicle users

[0001] The disclosed embodiments relate to techniques for protecting the privacy of users of rental vehicles.

[0002] Recently, services such as car rentals and carsharing, which allow users to rent vehicles for a set period of time, have been growing rapidly. Due to the nature of rental vehicles, multiple users take turns using the same vehicle.

[0003] Meanwhile, recent vehicles often require users' personal information or connect to their mobile phones to provide navigation, infotainment, or other personalized services. In particular, rental vehicles are often used by an unspecified number of users, so even after the vehicle has been used, various types of personal information, such as navigation driving records, smartphone access information and history, and user account information, often remain in the vehicle's internal storage and are not deleted.

[0004] The disclosed embodiments are intended to provide a technical means for safely deleting personal information remaining in a vehicle after a rental vehicle user has finished using the vehicle.

[0005] According to an exemplary embodiment, a system for protecting the privacy of a user of a rental vehicle is provided, including: a terminal which receives a seed and the size of a personal information storage area of ​​a rental vehicle, generates a first random number sequence corresponding to the size of the personal information storage area based on the seed, and generates Merkle tree-based verification information from the first random number sequence; and a personal information deletion device which receives the seed and the size of the personal information storage area from the terminal, generates a second random number sequence corresponding to the size of the personal information storage area based on the received seed, and masks the personal information storage area of ​​the rental vehicle using the second random number sequence, wherein the terminal transmits a challenge to the personal information deletion device when the masking of the personal information storage area is completed, and compares a response to the challenge and verification information to verify whether personal information recorded in the rental vehicle has been deleted.

[0006] In one embodiment, the terminal can divide the first random number sequence into a plurality of strings having a predetermined length, and generate a first Merkle tree using the divided plurality of strings.

[0007] In one embodiment, the verification information may be the root node value of the first Merkle tree, and the challenge may be the position of any of the leaf nodes of the first Merkle tree.

[0008] In one embodiment, when a challenge is received from a terminal, the personal information deletion device may generate a second Merkle tree using a second random number sequence recorded in a personal information storage area, and generate a response to the challenge using the second Merkle tree.

[0009] In one embodiment, the response may include a sibling path necessary to compute the root node value of the second Merkle tree from a particular node of the second Merkle tree corresponding to the challenge.

[0010] In one embodiment, the terminal can verify whether personal information recorded in a rental vehicle has been deleted by calculating a root node value of a second Merkle tree using a sibling pass and comparing the calculated root node value of the second Merkle tree with verification information.

[0011] According to another exemplary embodiment, a method for protecting the privacy of a rental vehicle user is provided, the method comprising: receiving, at a terminal, a seed and a size of a personal information storage area of ​​a rental vehicle, and generating a first random number sequence corresponding to the size of the personal information storage area based on the seed; generating, at the terminal, Merkle tree-based verification information from the first random number sequence; receiving, at a personal information deletion device, the seed and the size of the personal information storage area from the terminal, and generating, at the personal information deletion device, a second random number sequence corresponding to the size of the personal information storage area based on the received seed; masking, at the personal information deletion device, the personal information storage area of ​​the rental vehicle using the second random number sequence; transmitting, at the terminal, a challenge to the personal information deletion device when the masking of the personal information storage area is completed; and comparing, at the terminal, a response to the challenge and verification information to verify whether personal information recorded in the rental vehicle has been deleted.

[0012] A method for protecting the privacy of a rental vehicle user is provided, wherein the terminal divides a first random number sequence into a plurality of strings having a predetermined length and creates a first Merkle tree using the divided plurality of strings.

[0013] In one embodiment, the terminal can divide the first random number sequence into a plurality of strings having a predetermined length, and generate a first Merkle tree using the divided plurality of strings.

[0014] In one embodiment, the verification information may be the root node value of the first Merkle tree, and the challenge may be the position of any of the leaf nodes of the first Merkle tree.

[0015] In one embodiment, when a challenge is received from a terminal, the personal information deletion device may generate a second Merkle tree using a second random number sequence recorded in a personal information storage area, and generate a response to the challenge using the second Merkle tree.

[0016] In one embodiment, the response may include a sibling path necessary to compute the root node value of the second Merkle tree from a particular node of the second Merkle tree corresponding to the challenge.

[0017] In one embodiment, the terminal can verify whether personal information recorded in a rental vehicle has been deleted by calculating a root node value of a second Merkle tree using a sibling pass and comparing the calculated root node value of the second Merkle tree with verification information.

[0018] According to the disclosed embodiments, personal information remaining in a rental vehicle after the rental vehicle user has finished using the vehicle can be safely deleted, thereby preventing personal information leakage due to the use of the rental vehicle and protecting the privacy of the user.

[0019] Figure 1 is an example diagram for explaining changes in the personal information storage area according to the use of a rental vehicle according to one embodiment.

[0020] Figure 2 is a block diagram illustrating a privacy protection system for users of rental vehicles according to one embodiment.

[0021] Figure 3 is a flowchart for explaining a method for protecting the privacy of a rental vehicle user according to one embodiment.

[0022] FIG. 4 is a flowchart for explaining in more detail the verification information generation step based on a Merkle tree among the privacy protection methods for rental vehicle users according to one embodiment.

[0023] Figure 5 is an example diagram for explaining the Merkle tree creation process according to one embodiment.

[0024] Figure 6 is a flowchart for explaining in more detail the personal information storage area masking step among the privacy protection methods for users of rental vehicles according to one embodiment.

[0025] FIG. 7 is a flowchart for explaining in more detail the response generation step for a challenge among the privacy protection methods for users of rental vehicles according to one embodiment.

[0026] Figure 8 is a flowchart for explaining in more detail the verification step for whether or not personal information has been deleted among the privacy protection methods for users of rental vehicles according to one embodiment.

[0027] FIG. 9 is a block diagram illustrating a computing environment including a computing device suitable for use in exemplary embodiments.

[0028] Hereinafter, specific embodiments of the present invention will be described with reference to the drawings. The following detailed description is provided to facilitate a comprehensive understanding of the methods, devices, and / or systems described herein. However, these are merely examples and the present invention is not limited thereto.

[0029] In describing embodiments of the present invention, if a detailed description of a known technology related to the present invention is judged to unnecessarily obscure the gist of the present invention, the detailed description will be omitted. In addition, the terms described below are terms defined in consideration of their functions in the present invention, and this may vary depending on the intention or custom of the user or operator. Therefore, the definitions should be made based on the contents throughout this specification. The terminology used in the detailed description is only for the purpose of describing embodiments of the present invention and should not be limited in any way. Unless clearly used otherwise, the singular form includes the plural form. In this description, expressions such as "comprises" or "having" are intended to indicate certain features, numbers, steps, operations, elements, parts or combinations thereof, and should not be construed to exclude the presence or possibility of one or more other features, numbers, steps, operations, elements, parts or combinations thereof other than those described.

[0030] In the following description, the terms "transmission," "communication," "sending," "receiving," and other similar terms for signals or information include not only the direct transmission of the signal or information from one component to another, but also transmission via another component. In particular, "transmitting" or "sending" a signal or information to one component indicates the final destination of the signal or information, and does not mean the direct destination. The same applies to "receiving" a signal or information. In addition, in this specification, the "relationship" of two or more pieces of data or information means that when one piece of data (or information) is acquired, at least a portion of the other piece of data (or information) can be acquired based on it.

[0031] Additionally, while terms such as "first" and "second" may be used to describe various components, these components should not be limited by these terms. These terms may be used to distinguish one component from another. For example, without departing from the scope of the present invention, a first component may be referred to as a "second component," and similarly, a second component may also be referred to as a "first component."

[0032] Figure 1 is an exemplary diagram illustrating changes in a personal information storage area according to the use of a rental vehicle according to one embodiment.

[0033] In Figure 1, reference numeral 102 represents a state before renting a rental vehicle, and reference numeral 102' represents a state after returning a rental vehicle. In the following description, a rental vehicle refers to a vehicle in which the user does not own the vehicle, but enters into a contract with the vehicle owner (or service provider), operates the vehicle for a certain period of time, and then returns it to the vehicle owner.

[0034] As illustrated, the rental vehicle (102) includes a predetermined storage area (104) therein. In the disclosed embodiments, the storage area (104) is a space where data necessary for the operation of the vehicle is stored. For example, the storage area (104) may include driving files and map files for driving navigation, data for driving an infotainment system, etc. In the disclosed embodiments, the storage area (104) may include, without limitation, all types of data storage media used in the vehicle, such as volatile or non-volatile memory, hard disks, solid-state drives, and removable storage media installed inside the rental vehicle (102). Furthermore, in some embodiments, the storage area (104) may be a network drive or cloud drive connected to the rental vehicle (102) via a network.

[0035] A part of the storage area (104) may be used as a personal information storage area (106). The personal information storage area (106) may be an area where all types of data related to the user who rents and drives the rental vehicle (102), such as the user's personal identification information, account information, navigation usage history, the user's vehicle operation log, infotainment usage information, and the user's mobile terminal connection information, are stored. As illustrated in FIG. 1, the personal information storage area (106) of the rental vehicle (102) before use does not store any data, but the personal information storage area (106') in the storage area (104') of the rental vehicle (102') returned after use stores various pieces of information according to the user's various actions. Since the rental vehicle (102) is a type of vehicle used by an unspecified number of users for a set period of time, a malicious user may collect personal information of previous users from the personal information storage area (106') of the rental vehicle (102) without permission or use it in a malicious manner. Therefore, identifying the personal information storage area (106') after use of the rental vehicle (102) and safely deleting the data stored in the area is an important issue for protecting the privacy of the rental vehicle (102) users.

[0036] In the disclosed embodiments, the personal information storage area (106') may have a fixed size or may have a variable size depending on the amount of data to be stored.

[0037] FIG. 2 is a block diagram illustrating a privacy protection system (200) for users of a rental vehicle according to one embodiment. As illustrated, the privacy protection system (200) according to one embodiment includes a terminal (202) and a personal information deletion device (204).

[0038] The terminal (202) may be a terminal of a user who wishes to delete the personal information storage area stored in the rental vehicle (102). In the disclosed embodiments, the terminal (202) may include various types of computing devices, such as smartphones, tablets, and personal computers, without limitation.

[0039] The terminal (202) may include a deletion request module (206) and a verification module (208).

[0040] The deletion request module (206) may receive a predetermined seed from the user. In addition, the deletion request module (206) may receive the size (N) of the personal information storage area (106) of the rental vehicle (102). In the disclosed embodiments, the deletion request module (206) may receive information related to the size (N) of the personal information storage area (106) from the rental vehicle (102). In some embodiments, the size of the personal information storage area (106) may refer to a memory area that has been changed since the rental time of the rental vehicle (102). In other embodiments, the size of the personal information storage area (106) may refer to the size of a preset personal information-related directory or file.

[0041] The deletion request module (206) generates a first random number sequence (RS1) corresponding to the size (N) of the personal information storage area based on the input seed (SEED), and also generates Merkle tree-based verification information from the first random number sequence (RS1).

[0042] The personal information deletion device (204) masks the personal information storage area (106) of the rental vehicle (102) and provides verification information necessary to verify whether the personal information storage area (106) is masked in the terminal (202). In the disclosed embodiments, the personal information deletion device (204) may be provided in the rental vehicle (102) as an internal element of the rental vehicle (102), or may be a separate computing device connected to the rental vehicle (102) via a wired or wireless communication means.

[0043] The personal information deletion device (204) may include a masking module (210) and a verification information provision module (212).

[0044] The masking module (210) receives a seed (SEED) and the size (N) of the personal information storage area from the terminal (202), and generates a second random number sequence (RS2) corresponding to the size (N) of the personal information storage area based on the received seed (SEED). The masking module (210) is configured to generate the second random number sequence (RS2) using the same algorithm as the terminal (202). Therefore, the first random number sequence (RS1) and the second random number sequence (RS2) generated from the same seed (SEED) have the same values.

[0045] The masking module (210) masks the personal information storage area (106) of the rental vehicle (102) using the generated second random number sequence (RS2). Since the size (length) of the second random number sequence (RS2) is the same as the size of the personal information storage area (106), all personal information stored in the personal information storage area (106) is deleted during the masking process.

[0046] When the masking of the personal information storage area (106) is completed by the personal information deletion device (204), the verification module (208) of the terminal (202) transmits a challenge (CH) to the personal information deletion device (204). Then, the verification information provision module (212) of the personal information deletion device (204) generates a response to the challenge (CH) and provides it to the verification module (208). Thereafter, the verification module (208) compares the response (RE) to the challenge and the previously generated verification information to verify whether the personal information recorded in the rental vehicle (102) has been deleted.

[0047] FIG. 3 is a flowchart illustrating a method (300) for protecting the privacy of a user of a rental vehicle according to one embodiment. The illustrated method may be performed in a computing device having one or more processors and a memory storing one or more programs executed by the one or more processors, for example, a system (200) for protecting the privacy of a user of a rental vehicle according to one embodiment. In the illustrated flowchart, the method or process is described by dividing it into a plurality of steps, but at least some of the steps may be performed in a reversed order, combined with other steps and performed together, omitted, divided into sub-steps and performed, or one or more steps not illustrated may be added and performed.

[0048] In step 302, the terminal (202) generates a first random number sequence (RS1) corresponding to the size (N) of the personal information storage area based on the input seed (SEED), and also generates Merkle tree-based verification information from the first random number sequence (RS1).

[0049] FIG. 4 is a flowchart for explaining in more detail the Merkle tree-based verification information generation step (302) among the privacy protection method (300) for users of rental vehicles according to one embodiment.

[0050] In step 402, the terminal (202) receives a seed from the user.

[0051] In step 404, the terminal (202) generates a first random number sequence (RS1) corresponding to the size (N) of the personal information storage area based on the input seed (SEED).

[0052] In step 406, the terminal (202) generates a first Merkle tree from the first random number sequence (RS1). In one embodiment, the terminal (202) may divide the first random number sequence (RS1) into a plurality of strings having a predetermined length, and generate the first Merkle tree using the divided plurality of strings.

[0053] FIG. 5 is an exemplary diagram illustrating a Merkle tree generation process according to one embodiment. The illustrated exemplary diagram illustrates an example of dividing a random number sequence (RS) into eight strings, Tx1 to Tx8, and generating a Merkle tree from these. However, this is merely exemplary, and it should be noted that the disclosed embodiments are not limited to the specific size or number of divided strings.

[0054] The value of the root node (ROOT1) of the first Merkle tree generated through this process is used as verification information in the subsequent verification process to determine whether personal information is masked.

[0055] In step 408, the terminal (202) deletes the remaining data except for the seed (SEED) and the root node value (ROOT).

[0056] Returning to Figure 3 again, in step 304, the terminal (202) transmits a personal information masking request including a seed (SEED) to the personal information deletion device (204).

[0057] In step 306, the personal information deletion device (204) that received the personal information masking request performs masking on the personal information storage area (306) in the rental vehicle (102).

[0058] FIG. 6 is a flowchart for explaining in more detail the personal information storage area masking step (306) among the privacy protection method (300) of a rental vehicle user according to one embodiment.

[0059] In step 602, the personal information deletion device (204) generates a second random number sequence (RS2) corresponding to the size (N) of the personal information storage area using the seed (SEED) from the terminal (202). Depending on the embodiment, the personal information deletion device (204) may receive information about the size (N) of the personal information storage area together with the seed (SEED) from the terminal (202), or may independently obtain information about the size (N) of the personal information storage area from the rental vehicle (102). As described above, the personal information deletion device (204) is configured to generate the second random number sequence (RS2) using the same algorithm as the terminal (202). Therefore, the first random number sequence (RS1) and the second random number sequence (RS2) generated from the same seed (SEED) have the same value.

[0060] In step 604, the personal information storage area (106) of the rental vehicle (102) is masked using the generated second random number sequence (RS2). Since the size (length) of the second random number sequence (RS2) is the same as the size of the personal information storage area (106), all personal information stored in the personal information storage area (106) is deleted during the masking process.

[0061] Returning to Figure 3 again, the personal information deletion device (204) that has completed masking the personal information storage area (306) in step 308 transmits a verification request to the terminal (202).

[0062] In step 310, the terminal (202) transmits a challenge (CH) for verification to the personal information deletion device (204). In one embodiment, the challenge (CH) may be the location of any node among a plurality of leaf nodes constituting the first Merkle tree.

[0063] In step 312, the personal information deletion device (204) generates a response (RE) to the received challenge (CH).

[0064] FIG. 7 is a flowchart for explaining in more detail the step (312) of generating a response to a challenge among the privacy protection method (300) of a rental vehicle user according to one embodiment.

[0065] In step 702, the personal information deletion device (204) generates a second Merkle tree using the second random number sequence (RS2) recorded in the personal information storage area (106). The personal information deletion device (204) can generate the second Merkle tree using the same Merkle tree generation algorithm as the terminal (202). Therefore, if the first random number sequence (RS1) and the second random number sequence (RS2) are identical, i.e., if personal information masking has been successfully performed, the first Merkle tree is identical to the second Merkle tree.

[0066] In step 704, the personal information deletion device (204) generates a sibling path corresponding to the challenge (CH) using the generated second Merkle tree. A "sibling path" of a Merkle tree refers to a path connecting a specific node and its parent node. In the disclosed embodiments, the response (RE) may include a sibling path necessary to calculate the root node value of the second Merkle tree from a specific node of the second Merkle tree corresponding to the challenge (CH).

[0067] Returning to Figure 3 again, in step 314, the personal information deletion device (204) transmits the generated response (RE) to the terminal (202).

[0068] In step 316, the terminal (202) verifies whether personal information has been deleted using the received response (RE).

[0069] FIG. 8 is a flowchart for explaining in more detail the step (316) of verifying whether personal information has been deleted among the privacy protection method (300) of a rental vehicle user according to one embodiment.

[0070] In step 802, the terminal (202) calculates the value of the root node (ROOT2) from the received response (RE), i.e., the sibling path.

[0071] In step 804, the terminal (202) determines whether the root node value (ROOT1) of the first Merkle tree and the root node value (ROOT2) of the second Merkle tree are the same.

[0072] If the judgment result of the above step 804 is the same, the terminal (202) determines that the verification of whether or not personal information has been deleted has been successful.

[0073] In contrast, if the judgment result of step 804 above is not the same, the terminal (202) determines that the verification of whether or not personal information has been deleted has failed.

[0074] FIG. 9 is a block diagram illustrating a computing environment (10) including a computing device suitable for use in exemplary embodiments. In the illustrated embodiment, each component may have different functions and capabilities other than those described below, and may include additional components other than those described below.

[0075] The illustrated computing environment (10) includes a computing device (12). In some embodiments, the computing device (12) may be a terminal (202) and a personal information deletion device (204) constituting a privacy protection device (200) of a rental vehicle. The computing device (12) includes at least one processor (14), a computer-readable storage medium (16), and a communication bus (18). The processor (14) may cause the computing device (12) to operate according to the exemplary embodiments mentioned above. For example, the processor (14) may execute one or more programs stored in the computer-readable storage medium (16). The one or more programs may include one or more computer-executable instructions, which, when executed by the processor (14), may cause the computing device (12) to perform operations according to the exemplary embodiments.

[0076] A computer-readable storage medium (16) is configured to store computer-executable instructions or program code, program data, and / or other suitable forms of information. A program (20) stored in the computer-readable storage medium (16) includes a set of instructions executable by the processor (14). In one embodiment, the computer-readable storage medium (16) may be a memory (volatile memory such as random access memory, non-volatile memory, or a suitable combination thereof), one or more magnetic disk storage devices, optical disk storage devices, flash memory devices, any other form of storage medium that can be accessed by the computing device (12) and store desired information, or a suitable combination thereof.

[0077] A communication bus (18) interconnects various other components of the computing device (12), including the processor (14) and computer-readable storage media (16).

[0078] The computing device (12) may also include one or more input / output interfaces (22) that provide interfaces for one or more input / output devices (24) and one or more network communication interfaces (26). The input / output interfaces (22) and the network communication interfaces (26) are connected to the communication bus (18). The input / output devices (24) may be connected to other components of the computing device (12) via the input / output interfaces (22). Exemplary input / output devices (24) may include input devices such as pointing devices (such as a mouse or a trackpad), a keyboard, a touch input device (such as a touchpad or a touchscreen), a voice or sound input device, various types of sensor devices and / or photographing devices, and / or output devices such as display devices, printers, speakers and / or network cards. The exemplary input / output devices (24) may be included within the computing device (12) as a component constituting the computing device (12), or may be connected to the computing device (12) as a separate device distinct from the computing device (12).

[0079] While representative embodiments of the present invention have been described in detail above, those skilled in the art will appreciate that various modifications to the above-described embodiments are possible without departing from the scope of the present invention. Therefore, the scope of the present invention should not be limited to the described embodiments, but should be defined not only by the claims set forth below but also by equivalents thereof.

Claims

1. A terminal that receives a seed and the size of a personal information storage area of ​​a rental vehicle, generates a first random number sequence corresponding to the size of the personal information storage area based on the seed, and generates Merkle tree-based verification information from the first random number sequence; and A personal information deletion device that receives the seed and the size of the personal information storage area from the terminal, generates a second random number sequence corresponding to the size of the personal information storage area based on the received seed, and masks the personal information storage area of ​​the rental vehicle using the second random number sequence, A privacy protection system for users of rental vehicles, wherein the terminal transmits a challenge to the personal information deletion device when the masking of the personal information storage area is completed, and verifies whether personal information recorded in the rental vehicle has been deleted by comparing the response to the challenge and the verification information.

2. In claim 1, A privacy protection system for users of rental vehicles, wherein the terminal divides the first random number sequence into a plurality of strings having a predetermined length and creates a first Merkle tree using the divided plurality of strings.

3. In claim 2, A privacy protection system for users of rental vehicles, wherein the verification information is a root node value of the first Merkle tree, and the challenge is the location of any node among the leaf nodes of the first Merkle tree.

4. In claim 1, A privacy protection system for users of rental vehicles, wherein the personal information deletion device, when receiving the challenge from the terminal, generates a second Merkle tree using the second random number sequence recorded in the personal information storage area, and generates the response to the challenge using the second Merkle tree.

5. In claim 4, A privacy protection system for a rental vehicle user, wherein the response includes a sibling path necessary to calculate a root node value of the second Merkle tree from a specific node of the second Merkle tree corresponding to the challenge.

6. In claim 5, A privacy protection system for users of rental vehicles, wherein the terminal calculates a root node value of the second Merkle tree using the sibling pass, compares the calculated root node value of the second Merkle tree with the verification information, and verifies whether personal information recorded in the rental vehicle has been deleted.

7. A step of receiving a seed and the size of a personal information storage area of ​​a rental vehicle from a terminal, and generating a first random number sequence corresponding to the size of the personal information storage area based on the seed; In the above terminal, a step of generating Merkle tree-based verification information from the first random number sequence; In a personal information deletion device, a step of receiving the seed and the size of the personal information storage area from the terminal, and generating a second random number sequence corresponding to the size of the personal information storage area based on the received seed; In the personal information deletion device, a step of masking the personal information storage area of ​​the rental vehicle using the second random number sequence; In the above terminal, when masking of the personal information storage area is completed, a step of transmitting a challenge to the personal information deletion device; and A method for protecting the privacy of a rental vehicle user, comprising a step of verifying whether personal information recorded in the rental vehicle has been deleted by comparing the response to the challenge and the verification information in the terminal.

8. In claim 7, A method for protecting the privacy of a rental vehicle user, wherein the terminal divides the first random number sequence into a plurality of strings having a predetermined length and creates a first Merkle tree using the divided plurality of strings.

9. In claim 8, A method for protecting the privacy of a rental vehicle user, wherein the verification information is a root node value of the first Merkle tree, and the challenge is a location of any node among the leaf nodes of the first Merkle tree.

10. In claim 7, A method for protecting the privacy of a rental vehicle user, wherein the personal information deletion device, when receiving the challenge from the terminal, generates a second Merkle tree using the second random number sequence recorded in the personal information storage area, and generates the response to the challenge using the second Merkle tree.

11. In claim 10, A method for protecting the privacy of a rental vehicle user, wherein the response includes a sibling path necessary to calculate a root node value of the second Merkle tree from a specific node of the second Merkle tree corresponding to the challenge.

12. In claim 11, A method for protecting the privacy of a rental vehicle user, wherein the terminal calculates a root node value of the second Merkle tree using the sibling pass, and compares the calculated root node value of the second Merkle tree with the verification information to verify whether personal information recorded in the rental vehicle has been deleted.

Images